Company Loses Millions on Deepfake Scam

Unlike decades ago, where only celebrities or political figures would have videos, movies or news clips posted online, we’re now a social media society. There are a multitude of social media platforms that contain our images, videos and voice imprints which thieves can potentially cull from. In the subject case, it is believed the scammers may have pulled a publicly available video from a local online newspaper to ultimately duplicate the video call.    

If the deepfake technology is only to become more sophisticated, how can companies protect themselves from these ever-evolving scams? The primary focus for cybercriminals is financial gain. It is important that any company, large or small, have a well-developed protocol regarding the review and authorization for financial transactions.  

While it may seem antiquated or low-tech, a preset internal series of security questions or passcodes is an excellent way to ensure that information is being provided to the genuine individual. As far as we know, no matter how sophisticated the deepfakes are, the scammers can only duplicate and produce publicly available information. Presumably, they would have no way of providing a confidential set of predetermined security responses or passwords.  

Additionally, a callback to a trusted phone number is a good practice to implement. Email correspondence can be spoofed or hijacked, and calling a number on a potentially hijacked email thread can also be unsecure.   

Finally, ensure that employees receive consistent cyber training and are taught how to not only spot scams but also the importance of following internal security protocols.  

Cyber insurance policies may provide some protection against losses such as the losses in this example. Furthermore, NFP has access to resources we can share with you that will assist you in reviewing cybersecurity protocols and in guiding you through making security enhancements.  

In addition, coverage for social engineering/fraudulent instruction losses such as this may be added to a company’s crime policy. When a social engineering/fraudulent transfer incident triggers coverage under the crime and cyber policies, we can assist in securing and maximizing coverage under both.  

Significant losses like this one may have a negative impact on a company’s bottom line. Shareholders have sought to hold directors and officers accountable for a perceived failure to adequately assess or address cyber risks the company may face. In those instances, a directors and officers/company securities liability policy may help in defending against such litigation.