Deepfake voice and video scams: a payment check that works even when the fake is good

A phone call from your boss, asking you to pay a supplier today. A voice note from a regular supplier with new bank details. A video call where everyone looks right and sounds right. Until recently, those would have settled most people's doubts. Now artificial intelligence can copy a voice, polish a fake message and build a convincing copy of a website in minutes. This post explains what is actually known, what the official advice is, and the handful of habits that protect a small business without costing anything.

What the figures say

UK payment fraud losses reached £1.28 billion in 2025, up 4% on the year before, according to a UK Finance article on its 2026 Fraud Report. Within that, authorised push payment (APP) scam losses rose 19% to £576.4 million. APP fraud is the kind where the victim is tricked into sending the money themselves, which is exactly what happens when someone is fooled by a fake request to pay an invoice.

The same article says criminals use "AI-enabled social engineering techniques" to manipulate people into authorising payments. A caution on that source: it is an opinion piece by an adviser at a fraud-analytics company, not a statement of UK Finance's own view, and it does not mention deepfakes specifically. So the honest summary is this: losses are rising, and AI is part of how criminals operate, but there is no tidy UK figure for deepfake fraud against small firms. Be wary of any vendor who claims one.

What a deepfake is, and what it is not

A police leaflet from Surrey Police and the Police and Crime Commissioner defines deepfakes as pictures, video or audio clips generated or manipulated by AI to look real. It lists the common uses: fake investment adverts using public figures, fake dating profiles, extortion, voice messages pretending to be a friend or relative in an emergency, and realistic fake websites, emails and texts pretending to be from banks and official bodies.

The leaflet cites Action Fraud as saying that in 2024 more than £10 million was lost by victims convinced by deepfakes featuring influential people advertising fake investment schemes. It also cites a YouGov poll for Ofcom from June 2024 finding that 53% of people aged 16 and over are not confident they can identify a deepfake.

That second figure is the important one for a business owner. If more than half of people cannot reliably tell, then "be more careful about spotting fakes" is weak advice on its own. The better approach is to make your process safe even when the fake is good.

The five pressure points the NCSC describes

The National Cyber Security Centre says scam messages and calls tend to use five tactics. They work just as well whether a human or an AI wrote the script:

• Authority: the message claims to come from someone official or important. A "director" or "the bank" fits here.
• Urgency: a short deadline or the threat of a penalty.
• Emotion: panic, fear, hope or curiosity.
• Scarcity: something in short supply, so you feel you must act fast.
• Current events: a link to the news or a time of year, such as tax reporting, to seem relevant.

Notice what is missing from that list: poor spelling. The Surrey leaflet warns that scammers use AI to produce realistic-looking messages, so polish is a poor test. The NCSC's checks focus on the pressure being applied instead. If a request combines authority and urgency and involves moving money, treat that combination itself as the alarm.

The one rule that beats a good fake

Both the NCSC and the Surrey leaflet give the same core instruction: if you are contacted out of the blue, break contact and reach the person or organisation yourself, using details you already trust. The NCSC says not to use the numbers or addresses in the message, but to use the details from the organisation's official website, or printed on paper statements or cards. Surrey Police says to hang up or reject the messaging platform and make contact through a method you know for sure is genuine.

For a small business, turn that into a written rule that everyone who touches money follows:

• Any request to pay a new supplier, change bank details, or make an unusual payment is confirmed by calling back on a number already in your records, never one supplied in the request.
• A voice, a video call or a familiar name on a message does not count as confirmation. A callback does.
• Two people are involved in any payment above an amount you choose, such as one who sets it up and another who approves it. In a business with only two or three staff, the owner can be the second person.
• Staff are told in advance that they will never be criticised for pausing a payment, even when the request appears to come from the owner.

That last point matters more than it sounds. Pressure from a senior name only works if the person receiving it feels unable to say "I will call you back."

Make yourself harder to copy

The Surrey leaflet notes that scammers can trawl social media and use the pictures, video and personal details they find to build deepfake content. The NCSC similarly advises limiting the personal information you share online and reviewing social media privacy settings, because criminals use it to make their messages more convincing.

In practice for a business that means a quick audit this week. Look at what is publicly visible: staff names and job titles, who approves payments, holiday announcements saying the owner is away, and videos with clear voice recordings. You do not need to hide your business, but you should know what a criminal could learn from it in ten minutes.

The Surrey leaflet also recommends turning on two-step verification (2SV) for important accounts, and using strong, unique passwords made of three random words. A business email account without 2SV is the easiest route for a criminal to see real invoices and then send a convincing fake. If your accounts, email and cloud tools need a proper review, our cloud and security work covers exactly that.

If you think you have been caught

Take Five, the national anti-fraud campaign, boils its advice down to three steps: Stop and think before parting with money or information; Challenge whether the request could be fake; and Protect yourself by contacting your bank immediately if you think you have been scammed, then reporting it to the police at reportfraud.police.uk or on 0300 123 2040. Speed matters with payments, so make sure everyone knows who to phone at your bank before an incident, not during one.

The NCSC also runs free reporting routes for scam emails, texts, phone calls, websites and adverts, and says reports let it investigate and take down scam addresses and sites. Reporting a near miss is worth doing too, because it makes you a harder target and helps others.

A checklist for this week

• Write down the callback rule for new payees and changed bank details, and tell everyone who handles money.
• Keep a list of trusted phone numbers for your key suppliers and your bank, stored somewhere a scammer cannot edit.
• Switch on two-step verification for email, banking and accounting software.
• Agree who can approve payments and what happens when the owner is unreachable.
• Check what staff and payment details your website and social media reveal.
• Save the bank's fraud number and the reporting details above where the team can find them quickly.

None of this needs special software or a big budget. The reason it works is that it does not depend on spotting the fake. It depends on checking through a channel the fraudster does not control.