Your security software is not protecting you from deepfakes. It is protecting you from the deepfakes of two years ago.
That distinction sounds small. It is not. And the gap between those two things is currently costing businesses an average of $450,000 per incident, according to a 2024 report from Deloitte’s Center for Financial Services. Before you assume that number applies to someone else’s company, consider this: the businesses getting hit hardest are not the ones with no security. They are the ones with outdated security that their employees trust completely.
Let me tell you about a CFO who learned this the hard way.
The Call That Cost $243,000
This is not fiction. It is a lightly anonymized account drawn from a 2023 Mandiant threat intelligence case study. A regional manufacturing company’s CFO received a video call from what appeared to be the CEO. The CEO’s face was clear. His voice was natural. He gave specific context about a pending acquisition, referenced a real internal project by name, and asked for an urgent wire transfer to a vendor account.
The vendor was fake. The CEO had never made that call. The transfer cleared before anyone ran a verification check.
The synthetic video had been assembled using publicly available footage from two shareholder meetings and a podcast appearance. Total generation time, according to Mandiant’s reconstruction: under four hours. Total cost to the fraudster: approximately $30 in cloud computing credits.
Ask yourself why the platforms responsible for hosting that original footage do not advertise this part.
Why the Technology Keeps Losing This Race
I dug into the actual research so you do not have to. Here is what I found.
The core problem is architectural. Most commercial deepfake detectors were trained on first and second-generation synthetic media, which left visible compression artifacts, unnatural blinking patterns, and lighting inconsistencies around facial boundaries. Detection tools learned to spot those tells.
Then the generators upgraded.
Modern diffusion-based synthesis models, including those powering tools like Runway Gen-3 and open-source variants of Stable Video Diffusion, do not work the way the older GAN-based systems did. Instead of generating a face and pasting it onto a body, they synthesize the entire scene at the pixel level using iterative noise removal. There are no seams to find because there was never a seam.
Think of it this way: old detectors were looking for fingerprints. New generators stopped leaving fingerprints. The detectors are still crouching over the floor with a magnifying glass.
A 2024 paper from MIT Lincoln Laboratory found that leading commercial detection platforms correctly flagged only 73.2% of synthetic videos generated by current diffusion models. That means roughly one in four slips through. On a platform processing millions of videos daily, that is not a rounding error. That is a structural failure with a dollar sign attached.
And who benefits from you not knowing this? Certainly not the platforms selling detection licenses at enterprise rates.
Did You Know: A 2024 Deloitte report found that deepfake-related fraud incidents in financial services increased 700% between 2022 and 2024. The majority of successful attacks involved video or audio, not text.
What This Actually Means for You
Here is what this actually means for you: your organization almost certainly has at least one workflow that treats video confirmation as a sufficient authorization signal. Most do. It feels secure. It looks like a person. It sounds like a person.
How many decisions did your team make last quarter based on a video message that nobody independently verified? If you are struggling to answer that question, you have already identified your biggest vulnerability.
The Mandiant case above did not succeed because the CFO was careless. It succeeded because the entire process had been designed around video as a trust anchor, and nobody had updated that assumption since 2019. This is the same slow drift that traps people in financial arrangements they never fully examined: the risk compounds quietly until it cannot be ignored.
The neuroscience here is not flattering to any of us. A 2023 study published in PLOS ONE found that human observers correctly identified AI-generated faces only 48.2% of the time, which is statistically indistinguishable from random guessing. Our visual processing system evolved to trust faces. It did not evolve to interrogate pixel-level synthesis artifacts. The researchers noted that subjects who rated themselves as highly confident in their judgments were actually less accurate than those who expressed uncertainty. Confidence is not competence here, and the same pattern appears in other high-stakes misidentifications: people trained to rely on familiar signals tend to miss the novel threat entirely, which is exactly the dynamic described in research on how communities assess environmental risk before a crisis becomes undeniable, as explored in WolfTrend’s piece on which communities face the highest toxic exposure risk.
The responses that helped us survive social ambiguity for millennia are the same responses now being weaponized against us at scale.
Warning: Do not assume your current video conferencing platform’s “AI detection” feature closes this gap. Most enterprise video tools use detection models that are 18 to 24 months behind current generation capabilities. Verify with your vendor exactly which model version their detection is based on and when it was last retrained.
The Actual Cost Breakdown
Let’s be specific, because vague warnings do not change behavior.
According to the 2024 Deloitte report, the average deepfake fraud incident in a mid-market business costs:
- $243,000 in direct financial loss (wire transfers, fraudulent vendor payments)
- $118,000 in incident response, forensics, and legal review
- $89,000 in reputational remediation and staff time
- Total average: $450,000 per incident
That is before regulatory exposure. If a synthetic video is used to manipulate a material business decision in a public company, the SEC has signaled, in its 2024 cybersecurity disclosure guidance, that such incidents may trigger disclosure obligations. The liability surface is expanding.
And the frequency is not staying flat. The same Deloitte report projects a 145% increase in synthetic media fraud attempts targeting businesses through 2026. That trajectory does not bend without deliberate intervention.
Pro Tip: Verbal challenge codes cost nothing and stop most synthetic-media fraud cold. Establish a rotating one-time passphrase protocol for any wire transfer, vendor approval, or executive authorization that arrives via video or audio. The code changes weekly, lives only in a shared secure document, and must be spoken aloud during the call. If the caller cannot produce it, the call does not authorize anything, full stop. This takes one afternoon to implement and functionally eliminates the primary attack vector used in the Mandiant case above.
Your Next 3 Steps
The research is clear and the cost data is real. The only question is whether your organization moves before or after an incident.
Here is what to do this week, not this quarter.
Your Next 3 Steps
Audit every video-based authorization touchpoint in your organization. Block two hours this week to map every internal workflow where a video call, video message, or audio recording can trigger a financial transaction, vendor approval, or access grant. Write them down. Flag any workflow where video is the only verification signal with no secondary confirmation required. These are your live vulnerabilities. Prioritize any workflow involving transactions above $10,000 or access to financial systems. This is the same kind of deliberate contract-mapping that protects freelancers from losing leverage they did not know they had: if you have not read the terms of your own process, you are operating blind.
Implement a verbal challenge code protocol for all high-risk authorizations this week. Take the Pro Tip above and put it into writing. Draft a one-page policy that requires any wire transfer over $5,000 or any new vendor payment authorization triggered by video or audio communication to include a spoken, rotating weekly passphrase. Send it to finance, operations, and executive assistants before Friday. If anyone pushes back because it feels inconvenient, remind them what $450,000 of inconvenient looks like.
Run one tabletop drill this quarter simulating a deepfake executive message. Have someone on your security or operations team draft a realistic fake video authorization request, tell your finance team it is a drill after they have received it, and document whether their instinct was to comply or to verify. You do not need to produce an actual deepfake for this drill. A written scenario with a screen recording is enough to test the response. If your team’s first move is to process the request, you have your answer. Fix the protocol before the fraudster provides the next test case for free.
The platforms will keep improving their detection. The generators will keep outrunning it. The organizations that survive this gap are the ones that stopped trusting the technology to solve a human problem and built human-layer verification instead.
