Top Tips for Protecting Your Business from Deepfake Scams

Technology, Data & IP Partners Jessica Lipson and Fred Perkins and Associates Tess Bonoli and Allison O’Hara published a second Client Alert in their series on navigating the cyber landscape safely. In “Top Tips for Protecting Your Business from Deepfake Scams,” the authors discuss scams involving deepfakes – digital manipulations of synthetic media that appear to be a particular individual’s face or voice. They warn that, in addition to significant financial loss, a business that falls victim to a deepfake scam could also face legal liability. They address how deepfakes are used against businesses, how to detect them and how to prevent them. Morrison Cohen’s Chief Information Security Officer, Thomas Catenaccio, provided technical insights.

Key Takeaways:

Detecting signs of a deepfake scam:

• Audio and visual clues such as strange phrasing or inflection, unnatural pauses in speech, odd facial expressions, unusual body movements, background noise that does not match the speaker’s apparent location, visual glitches and poor audio quality.
• Deepfake messages may include a false sense of urgency in order to spur victims into action, originate from unfamiliar phone numbers or email addresses, or request a change or “update” to previously used wire instructions.

Protective measures that businesses can take to detect and reduce their susceptibility to deepfakes:

• Prior to wiring money, confirm the wire instructions by calling a known recipient at a known number.
• Implement real-time, face-to-face identification through video conferencing by having the individual confirming the transfer instructions show state- or federally issued identification, like a driver’s license or passport.
• Implement enhanced authentication methods such as multifactor authentication, biometrics and/or changing security tokens.  
• Establish clear company-wide communication protocols for verifying the authenticity of wire requests and instructions received via email, messaging platforms and phone calls.
• Provide employees with routine and regularly updated training on deepfakes, including what they are, how to detect them, how to respond, and how deepfake technologies are evolving.
• Regularly review and update security measures and protocols to adapt to new threats as they arise over time.

Our Technology, Data & IP team is available to assist clients with any questions regarding potential deepfake issues, including mitigating the effects of deepfake scams and developing and implementing protocols aimed at reducing a business’s susceptibility to deepfakes. 

To learn more about how to stay ahead of deepfake scams, read our Client Alert below.