That urgent call from your boss? It might not actually be your boss.
Artificial intelligence is making it easier for cybercriminals to impersonate business owners, executives, and trusted vendors. And these scams are becoming increasingly difficult to recognize.
For businesses, the consequences can be expensive. A convincing phone call or email could be all it takes for an employee to unknowingly transfer thousands of dollars to a criminal.
How Deepfake Fraud Works
Deepfake technology uses AI to imitate someone’s voice, appearance, or communication style. Combined with social engineering tactics, it can make fraudulent requests appear legitimate.
Consider these scenarios:
- The CEO calls with an urgent request. An employee receives a call that sounds like the company owner requesting an immediate wire transfer. The voice is convincing, but it’s AI-generated.
- A trusted vendor changes banking information. An email arrives with updated payment instructions. Everything looks familiar, except the new bank account belongs to a criminal.
- Leadership joins a video call. An employee participates in what appears to be a legitimate meeting, only to discover later that the participants were AI-generated impersonations.
These scams exploit something every business depends on: trust.
Five Ways to Reduce Your Risk
Fortunately, protecting your business doesn’t have to be complicated.
- Verify payment requests. Confirm banking changes and unusual transfers using a trusted phone number already on file.
- Require dual approval. Have two authorized employees approve significant financial transactions.
- Train your team. Help employees recognize urgency, impersonation, and unusual requests—not just suspicious links.
- Strengthen security. Use multifactor authentication, email security tools, and appropriate access controls.
- Make verification part of your culture. Employees should feel comfortable questioning a request, even when it appears to come from leadership.
Does Cyber Insurance Cover Deepfake Fraud?
Here’s where things can get complicated.
Many business owners assume their cyber insurance will cover any loss involving a fraudulent email, AI-generated voice, or electronic transfer. That’s not necessarily the case.
Depending on the circumstances, coverage may fall under cyber liability, commercial crime, social engineering fraud, or funds transfer fraud provisions.
These coverages aren’t interchangeable. Some policies distinguish between an unauthorized transfer and a transfer willingly initiated by an employee who was deceived. Coverage may also be subject to separate limits, exclusions, and verification requirements.
The bottom line? Don’t assume you’re covered simply because you have a cyber policy.
A Good Time to Review Your Protection
AI-driven fraud is evolving, but some of the best defenses remain straightforward: informed employees, clear financial procedures, and appropriate insurance protection.
At Conexus Insurance, we help businesses understand their exposures and evaluate how their insurance programs address emerging risks.
If it’s been a while since you’ve reviewed your cyber liability or commercial crime coverage, let’s have that conversation.
Coverage is subject to the terms, conditions, limits, and exclusions of the applicable insurance policy. This article is for general informational purposes and does not guarantee coverage.