Deepfake and social engineering attacks

In recent years deepfake technology has moved from laboratory experiments to everyday tools, used both for legitimate purposes in film, entertainment and education, and for malicious ones. A deepfake is a weapon of digital social engineering: attackers create convincing false material in order to manipulate the emotions, beliefs or decisions of a person or an organisation.

How the technology works

Deepfakes rely on artificial intelligence, in particular on generative adversarial networks. A generator creates the false content, whether image, voice or video. A discriminator compares the fake against real material and corrects it. The result is material that is almost impossible to distinguish from the authentic thing.

• Voice cloning: from a few minutes of recorded audio, an algorithm can replicate a voice with natural intonation and rhythm.
• Face swapping: replacing the face in a video with that of another person.
• Lip sync deepfakes: matching lip movement to a false audio message.

How deepfakes are used in social engineering

• Fraudulent transfer requests, where a cloned voice of a manager instructs an employee to make a payment
• Fake video calls used to authorise decisions or to obtain credentials
• Compromising material created to blackmail an individual
• Fabricated public statements attributed to real people, used to move opinion or markets
• Identity verification bypass, where synthetic faces defeat weak remote onboarding checks

How to defend against them

• Treat any urgent financial or access request as unverified until confirmed on a second, known channel
• Agree in advance on a verification procedure inside the organisation, independent of voice or video
• Be sceptical of emotionally charged material that arrives out of context
• Look for the original source before believing or sharing a recording
• Train staff specifically on this scenario, because technical controls alone do not cover it

Under the NIS 2 Directive, staff training is a mandatory security measure. Related material: the course on countering disinformation.