Deepfake Inc.

Two years later, the Arup case is no longer an outlier. It is a template. Deepfake fraud drained $1.1 billion from US corporate accounts in 2025, tripling from $360 million the year before. The number of deepfakes circulating online exploded from 500,000 in 2023 to over eight million in 2025. Voice cloning fraud rose by 680 percent in a single year. Pindrop, a voice security firm, reported a 1,300 percent year-over-year surge in deepfake attempts targeting contact centers.

CrowdStrike documented a 442 percent increase in vishing attacks. What was once a curiosity, a party trick involving celebrity face-swaps on social media, has matured into one of the most dangerous weapons in the cybercriminal arsenal. And it is aimed squarely at business.

The anatomy of a deepfake attack

Understanding why deepfakes are so effective requires understanding what they exploit. Traditional phishing attacks rely on text: a convincing email, a spoofed domain, a sense of urgency. Deepfakes bypass the defenses that organizations have spent decades building against text-based fraud. They exploit something far more difficult to defend: human trust in faces and voices. A deepfake CEO fraud attack typically begins with reconnaissance. Attackers scrape publicly available video and audio of a target executive from earnings calls, conference presentations, YouTube interviews, and podcast appearances.

Modern AI tools can clone a voice with as little as three seconds of sample audio. Video generation models can produce real-time face-swaps that are indistinguishable from genuine footage on a standard video call. The attacker then stages a scenario designed to trigger an urgent financial action: a wire transfer, an investment authorization, a vendor payment.