Notifications
Clear all
Topic starter
15/08/2026 6:09 pm
TL;DR: Deepfake-enabled fraud is exploiting the gap between system authentication and human-to-human trust, with Arup’s Hong Kong office losing about $25 million in one incident and forecasts putting annual losses at $40 billion by 2027, according to SlashID. Perception-based verification is no longer enough; identity programmes must account for cryptographic proof in live communication as well as login events.
NHIMG editorial — based on content published by SlashID: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- The 2024 fraud against Arup’s Hong Kong office led to approximately $25 million in transfers after a deepfake-enabled video meeting.
Questions worth separating out
Q: How should security teams handle identity verification in high-risk video calls?
A: Security teams should treat high-risk video calls as identity checkpoints, not just collaboration sessions.
Q: Why do deepfake attacks bypass normal MFA and SSO controls?
A: Because MFA and SSO authenticate a person to a system, not necessarily a person to another person in a live conversation.
Q: What do organisations get wrong about human identity fraud?
A: They often assume that strong login controls are enough to protect downstream decisions.
Practitioner guidance
- Map high-risk human interactions Identify call, video, and chat workflows that can trigger money movement, credential resets, vendor approval, or privileged disclosure.
- Separate login trust from conversation trust Document where MFA, SSO, and passkeys end and where live interaction trust begins.
- Add cryptographic verification to sensitive approvals Introduce mutual proof steps before any transfer, reset, or escalation that relies on identity confirmation in a live call.
What's in the full article
SlashID's full article covers the technical detail this post intentionally leaves for the source:
- How Mutual TOTP is provisioned on devices and how the shared secret is delivered and protected
- The precise session flow for bidirectional verification during a live conversation
- The TOTP timing model, including the 30-second code rotation and the 2-minute session timeout
- How the approach maps to real-world deepfake impersonation scenarios in calls and video meetings
👉 Read SlashID's analysis of deepfake impersonation and Mutual TOTP →
Deepfake impersonation and mutual verification: what IAM teams must change?
Explore further
15/08/2026 6:17 pm
Human identity assurance no longer ends at successful login. The core failure exposed by deepfake fraud is that many identity programmes still assume authentication of a user to a system is enough to trust that person in a conversation. That assumption breaks when the attacker can convincingly impersonate voice and video in real time. The implication is that human IAM must now distinguish between session access and interaction trust.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity control depends on partial inventory and incomplete governance.
A question worth separating out:
Q: Who is accountable when a deepfake impersonation bypasses identity controls?
A: Accountability sits with the organisation that allowed one trust signal to carry too much decision weight. Identity, fraud, and application owners all share responsibility when verification design permits synthetic presence to reach high-risk actions. Governance frameworks should map that responsibility before incidents occur.
👉 Read our full editorial: Deepfake impersonation is breaking human trust assumptions in IAM
