Deepfake attacks hit roughly 400 companies daily, up 2,137% in three years. A $25 million Hong Kong heist and a fabricated video defaming a Maryland school principal show the real damage. The panel demos a deepfake of their host and explains how to spot fakes: ask personal questions, request unusual gestures, and use second-line verification.
Many of you know our friends at Reveal Risk. They're the winners of the 2025 TechPoint Mira Award for Innovation Service Partner of the Year and deeply involved in the cyber and tech community here in Indiana. So please join me in welcoming Aaron Pritz, Cody Rivers, and Todd Wilkinson from Reveal Risk. Thank you so much.
Thank you, Matt, and thank you for that fine introduction. All right. So I think probably most of us here in 2025 know what a deepfake is. Deepfakes can show up in multiple ways. Images. You've probably seen online still images. Sounds. So think phone call or an audio recording and then recordings. And that's what we're going to kind of focus on today is the real time. This is what the threat actors have capitalized on by becoming you in real time versus like a prerecorded video that you can't adjust on the fly. 400 companies per day being impacted. A new stat: 37% of organizations have reported that they're experiencing deepfake voice fraud. And we're seeing from a threat actor standpoint, voice is a lot easier to get to, you know, again, our employees were getting social engineered by phone. And if you have somebody calling up that sounds like your boss exactly, that's a lot easier to get the prize of what you're looking for than trying to get somebody on a Zoom call and have video and voice. And there's a lot of technical things that can go wrong. And then this is the one I downloaded this morning. 3 years ago, deepfakes attacks were 0.1%. This is one security company that does monitoring, and that's gone up 2,137%. So now it's 1 in 15 of the attacks that this company was dealing with, was dealing with specifically with deepfake, both voice and audio.
With AI now, as you're seeing, a lot of opportunity. Some of the bad things happen. Obviously, today is about deepfake. Beyond that, that is misinformation. So with the privacy concerns and using it to— for your companies and kind of what platforms AI is enabled on, you have the sprawl of like of employee information, customer information. So you've got that being leaked out because it's hard to track where AI is within your existing tech stacks as well as new tech stacks. In addition to, you have data poisoning going on with a lot of AI models. So, and then lots of IP and customer sensitive information. So as cool as AI is, and without a lot of AI governance, employees are going to find this and say, what can I do? Can pop source code into it to run for bug testing, not knowing that I just released source code out into the open public. So there was one of an attorney in Texas that used AI for his kind of case precedent, and that's one where it delivered entire false information of case precedent that didn't exist. So a lot of that, again, it's very powerful, but with all the power still comes some constraints there. Some recent news cases, Hong Kong was kind of the first one that went off there. That was the $25 million heist. And then in the summer of last year, Ferrari was a near miss. So they didn't quite get it pulled off only because of an inadvertent question. Some didn't feel right, so he asked a question. He said, "What book did I give you last week to read?" And the scammer didn't know, so he couldn't answer the question. And that one little thing was what stopped him from the entire heist. And so you're seeing right now with deepfakes, there's not a lot of technology out there to stop it. So a lot of folks are looking at manual internal processes similar to just a second line of control check to say if this is authored or this is asked, here's how to validate it. There was a principal in Maryland and they used AI to deepfake him to say a lot of like racial or politically charged comments. It was put on YouTube. He was fired, lost his job, ridiculed the community, only to find out months later it was a deepfake and not even true of him. But at that point, damage is done. Tough situation. So Those are the areas around deepfake that we're seeing are causing malicious things in the news, and companies are trying to figure out a way to block.
A lot of these are coming, or we're starting to see they're going after that traditional, how do I break through email systems?
How do I make those financial changes behind the system?
And having just gone through an IPO, what we found is the attackers were not targeting the executives.
They were not targeting folks that had been in the company a long time.
They were watching LinkedIn. And they're looking for, well, who's going to be in your financial system who recently got a job, but they're not quite still getting coached. They've been there about 3, 4 months.
So they're like, I don't want to ask questions.
And if you start to see those patterns, instead of going after the executives who get asked questions all the time, those folks on the line, let's target the education towards them.
Let's give them an extra support because we're also the ones out there going, please process this financial statement. Please pay this bill quicker. Please get this PO out faster. So putting together compelling story that they can pay attention to and giving them that space to say, hey, stop, I got to ask a question.
All right.
So now as he's going through this, we train this model on just a few minutes of video from Matt that we have not—
it was just sitting on the internet.
We didn't get custom video libraries.
We didn't do a lot of footage. This was some random video we found online.
Now, Aaron, take— turn to the left. So it'll work, and then it starts to look a little weird. Come to the other side. Now that side looks a little bit better. We found there's more video of Matt's left side than the right side.
That's a good side.
Yeah, yeah.
So the models picked that up. And then, yeah, as you start to look away, that's where it starts to pick up a little bit. Now put your— roll your hand through there.
Let's see what that does.
It's certainly a lot of artifacts in there. So if you're ever curious and you're concerned about this, ask them just to look away, look up, put their hands— I want to see your hands. Do some weird question to get them to do something different. And that'll help filter some of these things out because most of the models are currently today are much better trained on the face.
They start to struggle on the hairline.
And now look, look down all the way. I wanna see.
Yeah, so it starts, it's trying, it's trying to keep that face there, but it just starts to distort over time.
And this is using, for the most part, a lot of off-the-shelf stuff. We've done some model training on our own that's out there, but a lot of this stuff is available to other people or variants of this.
So you're starting to see this all over the place, but just a few seconds of video might be just enough to convince somebody to make that transaction happen.
