Topic starter
15/08/2026 6:09 pm
TL;DR: Deepfake-enabled fraud is exploiting the gap between system authentication and human-to-human trust, with Arup’s Hong Kong office losing about $25 million in one incident and forecasts putting annual losses at $40 billion by 2027, according to SlashID. Perception-based verification is no longer enough; identity programmes must account for cryptographic proof in live communication as well as login events.
Editorial analysis by NHI Mgmt Group, based on content published by SlashID: “Deepfake Impersonation Attacks (Part 2): Defending with SlashID Mutual TOTP”.
Key questions
A: Voice recognition and caller ID break down because both are easy to spoof or synthesize.
Q: Why do deepfakes create fraud risk even when MFA is already deployed?
A: MFA protects system access, not human trust inside a live conversation.
Q: What are the signs that conversational identity controls are failing?
A: Common warning signs include urgent payment requests, unusual escalation paths, staff accepting requests because the voice sounds familiar, and approvals made without any independent proof.
Practitioner guidance
- Define a high-risk conversation policy Classify finance approvals, password resets, privileged requests, and vendor payment changes as interactions that require explicit identity verification before any action is taken.
- Deploy mutual verification for sensitive calls Require both participants to prove device possession before sharing sensitive information in meetings, voice calls, or ad hoc escalation channels.
- Separate recognition from authorization Stop allowing familiarity with a voice or face to satisfy approval conditions, especially where money movement or access changes are involved.
Bottom line: Deepfake impersonation shifts the problem from system authentication to human trust, which means login controls alone cannot protect sensitive conversations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:17 pm
Perception-based trust is no longer a viable identity control for high-risk conversations. The article shows that deepfakes do not need to break authentication systems to succeed; they only need to hijack the human trust layer that sits around them. That means IAM programmes must stop treating voice, face, and familiarity as sufficient evidence of identity. The practitioner conclusion is simple: live communication needs its own assurance model.
A question worth separating out:
Q: How should security teams handle identity verification in high-risk video calls?
A: Security teams should treat high-risk video calls as identity checkpoints, not just collaboration sessions. Use participant verification before approving hiring, account recovery, payments, or privileged changes. The goal is to confirm the human behind the screen and the integrity of the camera source before any trust-sensitive decision is made.
👉 Read our full editorial: Deepfake impersonation is breaking human trust assumptions in IAM