A client sent us a voice note used to obtain a six-figure wire transfer from their controller. It imitated the CEO's voice, cadence, accent, and a familiar cough. The audio had been generated from forty-three seconds of a 2022 podcast recording. Investigating the incident took three weeks; producing the fake took twenty minutes.
Producing convincing synthetic media can be much cheaper than investigating it. A voice clone, altered video call, or fabricated screenshot may require little time or equipment. Investigative procedures need to account for that imbalance when deciding how to authenticate a request or preserve evidence.
Why detection alone will not save you
We test deepfake detectors as triage tools. Their output can help prioritize review, but it should be assessed alongside provenance, delivery records, and independent verification. Detection performance changes as generation techniques develop, so a score alone is insufficient evidence.
Combine detection, provenance checks, and behavioral verification. Each addresses a different part of the problem, and each has limits. Document how the team will handle conflicting signals and when a request must be paused for independent confirmation.
The new forensic playbook
1. Treat any high-stakes media as untrusted by default
Voice notes ordering wire transfers, video calls requesting access changes, and screenshots used in disputes need verification beyond the media itself. Our operating standard is to require a second channel and a callback to a known number for actions above a defined threshold. Establish that threshold before an urgent request arrives.
2. Build a provenance trail wherever you can
The C2PA standard records provenance information for media. Where capture tools support it, signed records can help reviewers inspect the content's origin and history. Missing provenance is a reason to investigate when a signature was expected; it is not by itself proof that the media is fake.
3. Pair detection with behavioral verification
Treat an unusual request on a video call as a reason to verify through a separate, known channel. Contextual questions may reveal inconsistencies, but they should support the verification process rather than replace it.
4. Investigate the trail, not the artifact
Investigate the delivery trail as well as the media file: the email that carried it, the account that posted it, available IP and device records, and the request that accompanied it. Those details can provide evidence that analysis of the media alone would miss.
How to brief a non-technical leader
Brief leaders on three points: convincing impersonation is possible, detection tools have limits, and consequential requests need independent verification. Agree which actions require a second channel and make the procedure clear to the people who receive those requests.
Where this is heading
Watch developments in detection tools and provenance standards, but assess each capability before adding it to the process. Establish how a warning will be reviewed, what a missing provenance record means, and which actions still require an independent callback. A signal is useful only if the team knows how to respond to it.
Deepfake response needs both technical checks and a clear operating procedure. Preserve the media and delivery records, verify consequential requests independently, and train staff on how to escalate uncertainty.
