What This Alert Means.
A deepfake alert means audio, video or images that imitate a real person may be circulating in your name. A voice clone is a copy of someone's voice made by software. Criminals use these to ask for money, passwords or private data.
The FBI has warned that criminals use AI-generated voice messages, a form of vishing (voice phishing), to pose as senior US officials. The FBI also notes that AI-generated content is often hard to identify. Do not rely on your ear or eye to decide if a clip is real. Use a verification process instead.
First 24 Hours.
The goal is to stop anyone acting on the fake request and to keep proof. Work through these steps in parallel where you can.
- SOC analyst Open the alert from the Brandefense executive protection module and save the clip, link, account name and dateCopy the file itself, not only the link
- Executive assistant Ask the executive, on a number from your own records, whether they made the call or videoNever use contact details from the suspicious message
- Finance lead Hold any payment, bank detail change or gift card request linked to this personConfirm by a second known channel before release
- IT admin Check whether anyone was asked for a login code or password, and reset those accountsRevoke active sessions too
- Communications Send a short warning to staff, assistants and finance explaining how to verify requestsDo not repeat the fake content in the note
- Security lead Identify who received the message and ask them not to reply or forward itList every recipient
- Legal Ask which notices, takedown routes and police reports apply in your countryCheck with your legal counsel before sending anything external
Investigation Checklist.
Find out where the fake came from, who saw it and whether anything was lost.
- Where was the clip posted or sent: phone call, voice note, video meeting, social post?Each channel has its own report route
- Who received it, and did anyone act on it?Include finance, assistants and partners
- Was money moved, or a login code or document shared?Treat each case as a live incident
- Is there a source recording, such as a public talk or podcast, that could have been used to copy the voice?This shows what the fraudster had to work with
- Does the sender address, phone number or account match the real person's?Look for small spelling changes
- Are there linked fake profiles or lookalike domains?Check for related fakes
- Did the same group target other leaders in your company?Check the whole leadership team
Containment And Removal.
Ask the right party to remove the content, and report the fraud where money or access was targeted. Keep a log of each report and its reply.
- Platform abuse or impersonation form: report the post, video or account on the site where it appears. Name the person being imitated and attach your evidence.
- Hosting provider abuse contact: if the clip sits on a standalone site, find the host and send a report with the exact page address.
- Registrar abuse contact: if the fake leads to a domain, send the registrar a report. ICANN requires accredited registrars to publish an abuse contact and to investigate reports.
- Your bank: if money was sent, call the bank at once and ask for a recall. The FBI advises this step for business email compromise.
- Law enforcement: in the US, file a complaint with the FBI IC3. In Turkiye, report through USOM (usom.gov.tr), which says its services, including incident reports, now continue on the Cyber Security Directorate site (siberguvenlik.gov.tr). Elsewhere, use your national CERT or police cybercrime unit.
Longer-Term Hardening.
You cannot stop people copying a public voice, so build habits that make a copy useless.
- Set a call-back rule. Any payment, bank change or access request made by voice or video must be confirmed on a known number. The FBI advises verifying new contact details through a previously confirmed platform or trusted source.
- Agree a code word. The FBI suggests a secret word or phrase to verify identity among family members, and the same idea can work for a leadership team. Share it only in person or on a trusted channel.
- Never share one-time codes. The FBI says never to give a two-factor code to anyone over email, text or messaging apps.
- Use dual approval for payments. No single person should be able to move money on a voice request alone.
- Review what leaders share in public. NCSC advises reviewing privacy settings because criminals use details found online, including on social media, to make phishing more convincing.
- Train staff with real examples. Short drills with a staged fake call help finance and assistants practise the call-back rule.
How To Measure That It Worked.
Use measures you can read from your own records.
- Share of payment and access requests that were verified by call-back.
- Number of suspicious requests staff reported, and how many were real attempts.
- Number of fake clips or accounts reported, removed or still live.
- Results of staged drills: how many people followed the rule.
- Repeat alerts for the same executive over time.
- Money lost or held, compared before and after the new rule.
Common Mistakes.
These errors help the fraud succeed or hide the evidence.
- Trusting a call because the voice sounds right.
- Verifying through the same channel the request arrived on.
- Deleting the clip or message before saving a copy.
- Telling only finance, and forgetting assistants, recruiters and partners.
- Sharing a one-time login code because the caller sounded senior.
- Sending a legal notice before your counsel has reviewed it.
- Closing the alert after one takedown, while other copies stay online.
Questions.
-
What is a deepfake voice scam?
It is fraud where software copies a real person's voice or face to make a believable call, voice note or video. The fraudster uses it to ask for money, login codes or private data. The FBI says AI content is often hard to identify, so confirm every request on a known channel.
-
How can I tell if a voice message is a clone?
You often cannot tell by listening. The FBI points to odd tone, word choice and lag, but also says AI content is difficult to spot. A safer test is to hang up and call the person back on a number you already had.
-
What should I do if my CEO's voice was cloned?
Confirm with the real executive on a trusted channel, hold any related payments, save the clip and message details, warn finance and assistants, and report the content to the platform. Ask your legal counsel about notices and police reports.
-
Where do I report deepfake fraud?
Report the content to the platform or host where it appears. In the US, file with the FBI IC3. In Turkiye, use USOM, whose reporting services now continue on the Cyber Security Directorate site. If money moved, call your bank first to ask for a recall.
-
Can a code word really stop voice-clone fraud?
It helps. The FBI suggests a secret word or phrase to verify identity, in its advice for families. It only works if it is never sent in the same message as the request, and if staff know they may ask for it from senior people.
Sources
This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.