Deepfake as an Operational Cost: How SMEs Lose Financial Control When the CEO's Voice Is No Longer Proof
The typical narrative of corporate fraud used to be linear: a fake email, a new bank account, a distracted employee, and a payment that should never have been made. Deepfake technology has broken this script, replacing it with something far more expensive to defend against, as it attacks an area where an organization concentrates substantial value: authority.
The risk is not just technological: it also depends on the preparedness of those who authorize payments. In a business.com survey conducted in May 2024 among 244 business leaders, 32% had no confidence that their employees could recognize deepfake fraud attempts, and 61% said they had not established protocols to address that risk. These are responses from a specific sample, not a universal measure of preparedness or an estimate of corporate losses. For management, the useful signal is the gap between the authority granted to an instruction and the evidence required to carry it out.
For an SME, this isn't a matter of "sophisticated governance" or committees; it’s a continuity problem: when a business cannot differentiate a legitimate order from a simulated one, its payment system becomes a margin vulnerability.
The Mechanics of the Attack: Deepfake Turns Urgency into Authorization
A case documented by the Hong Kong government illustrates the mechanism. In late January 2024, police received a report concerning a prerecorded video conference impersonating a company's chief financial officer: the victim authorized transfers and lost approximately 200 million Hong Kong dollars. According to the investigation described in June that year, the video had been assembled from publicly available images and voices; there was no actual interaction during the meeting, and instructions continued through messaging. The case shows how several channels can appear to confirm the same authority without providing independent verification.
What matters for an SME is not the specific amount, but the structure of persuasion.
1) Deepfakes can compromise human processes without first penetrating a system. A video call or audio message can serve as the modern equivalent of “please pass it along, it's urgent.” In organizations with weak controls, urgency replaces verification. This does not rule out other attacks combining impersonation with a technical intrusion.
2) The attack is already multi-channel. Picture messaging, Teams calls, formal emails, and sometimes temporal pressure; this combination creates a false sense of "cross-confirmation." When the attacker simulates multiple sources, the victim believes they have validated the request.
3) It targets the point where trust converts to money: treasury. There’s no need to penetrate an ERP if the process allows a payment instruction to be issued on perceived authority.
In simple financial terms, deepfake acts like a liquidity tax: it increases the likelihood that a cash outflow occurs without real consideration. And this type of leak cannot be recovered with marketing or increased sales; it requires disciplined controls or external capital.
The Real Cost for SMEs: It’s Not Fraud, It’s Redesigning Internal Controls
An SME often regards cybersecurity as discretionary spending until an incident occurs. Deepfake compels treating it as a structural cost, as it elevates the expected cost of every exception in payments.
The key metric is expected loss, which does not require sophisticated mathematics: incident probability multiplied by average impact.
Security providers' observations describe activity within their own customer networks; they cannot establish the exact probability of fraud for any given SME. A finance team should therefore not turn a sector-level rate into an automatic loss forecast. It needs to assess its exposure: who can order payments, through which channels, and with what controls. Two potential risk multipliers stand out in a company with informal processes.
- Concentration of authority. In SMEs, a CEO or CFO typically approves payments, account changes, and exceptions. If that identity is cloned, the company’s “seal” gets cloned too.
- Operational tolerance for exceptions. SMEs gain speed through shortcuts: payments via WhatsApp, audio approvals, account changes confirmed by calls. Deepfake turns this speed into a loss vector.
The secondary effect is equally expensive: operational paralysis. If a company reacts too late, it freezes payments, hinders purchases, compromises relationships with suppliers, and might incur penalties. Fraud is the cash outflow; operational damage compresses margins due to inefficiency and urgency.
The right reading for general management is this: defenses should not revolve around "detecting deepfakes" like an antivirus but revolve around ensuring that payment authorization does not depend on a falsifiable channel. Voice and video can now be convincingly faked at minimal cost.
Protocols That Do Change the Numbers: Separating Authority from Execution
The 61% reporting no protocols in business.com's 2024 survey identifies a specific gap within that sample. It does not prove that all companies are equally exposed, but it raises an operational question: if a payment order arrives tomorrow using a fabricated voice or image, what procedure will stop urgency from replacing verification?
In an SME, the goal isn’t to bureaucratize but to design a system where fraud needs to breach multiple pieces simultaneously. Three practical decisions can directly impact cash control.
1) Payment thresholds with genuine dual control, not nominal. Double control means two people and two distinct channels, with evidence. If a transfer exceeds a threshold, approval cannot be granted via audio, video call, or messaging. A second operational factor must exist: a flow in corporate banking with separate permissions or a confirmation via a previously agreed-upon and recorded channel.
2) Supplier bank accounts with a “cooling-off” period. Account changes are classic points of fraud. The financially sensible rule is simple: account changes do not apply on the same day for large payments. Changes get recorded, validated through a non-improvised channel, and executed after a minimum period. This reduces the value of urgency attacks, which is their primary leverage.
3) Exception process with traceability. Deepfake thrives in exceptions: “do it quickly,” “it's confidential,” “don’t escalate it.” An SME needs the equivalent of a “financial close” for urgent payments: any exception must require documentation, reason, and evidence. Not to punish but to inform the team that the exception is an audited event.
These measures do not necessarily require enormous budgets. They require accepting an uncomfortable idea: internal trust is not sufficient evidence. Pindrop reported a year-over-year increase of 680% in deepfake activity during 2024 within its call analysis. Separately, Ontinue reported a 1,633% increase in vishing-related incidents detected by its ATO team in the first quarter of 2025; its report compares this with the previous quarter. These are provider observations of different phenomena, not interchangeable global rates or measurements of cash losses. For an SME, their value is in supporting verifiable controls, not predicting how much money it will lose.
The Angle Boards Often Overlook: Deepfakes Also Hit Cash Flow
Media headlines often focus on reputation or on the “CEO’s image risk.” For an SME, the material blow happens sooner: in daily treasury operations.
When a company faces a fraudulent transfer, it doesn’t just lose money. It loses options.
- It loses negotiating power with suppliers if liquidity runs dry at the wrong moment.
- It loses margin if it must borrow at high cost to cover a cash gap.
- It loses investment capacity if it must redirect budget to fill the hole.
In customer-financed companies, cash flow is their lifeblood. A fraud incident, even smaller than headline-making cases, can force aggressive discounts to generate quick cash, alter collection policies, or postpone critical purchases. This translates into service deterioration, customer churn, and falling future revenues. The attack incurs costs twice: first as a direct loss, then as operational erosion.
That’s why the debate of "the board isn’t ready for the AI era" hits SMEs as a concrete directive: the CEO and the finance team must agree on an authorization matrix that survives identity forgery.
Perception matters too: in business.com's May 2024 survey, 31% of the leaders surveyed believed that deepfakes had not increased their fraud risk. The survey does not measure how much that belief raises or lowers the cost of an attack. My interpretation for management is that underestimating exposure can delay investment in controls and prolong weak processes. Attackers do not need every company to be vulnerable; they only need to find one that leaves a payment route without independent verification.
The Right Direction: Transform Payments into a Verifiable System, Not an Act of Faith
The effective response combines technology and process, but the order matters. If an SME purchases tools without redesigning its authorization flow, costs rise and risk remains. If it redesigns the flow first, technology becomes a multiplier.
My recommendation, strictly from a financial architecture perspective, is to treat every cash outflow as a miniature contract: evidence, traceability, and separation of duties. The company does not need to embrace paranoia; it needs to embrace accounting.
The ability to impersonate voices and images calls for an operational cultural shift: no one should “obey” a voice as the sole evidence when money is involved. A protocol should be followed. There is no need to assume a global fraud figure to make this decision: documented cases are enough to prompt a review of whether payment authorization depends on signals that can be falsified. An SME better preserves its control when it makes authorization a repeatable system, with evidence and separation of duties.
Cash is not defended with speeches or hierarchy; it’s defended with mechanisms that make it more expensive to err than to verify, because the only financing that maintains control in a company is customer money collected with margins and protected by processes.
