Deepfake fraud is the use of AI-generated voice, video or text to impersonate someone your staff trust, usually a director, a supplier or a colleague, in order to trigger a payment or a change of bank details. The old warning signs of fraud, poor grammar, odd phrasing and unfamiliar email addresses, no longer apply. The controls that still work are procedural: independent callback verification, dual authorisation, and a culture in which staff are expected to check. Since September 2025 large organisations can also be prosecuted for failing to prevent fraud committed by their staff if they cannot show reasonable procedures, including training.
For years, fraud awareness training taught people to spot the fake. That advice is now dangerous, because it teaches staff to trust anything that looks and sounds right. This guide explains how the attacks work, what the law now expects, and what a training programme needs to cover in 2026.
How the attacks work
Three techniques account for most of the losses.
- AI-written phishing. Criminals now produce fluent emails in your house style, referencing real projects and real colleagues scraped from LinkedIn and your website. Spelling and grammar checks find nothing.
- Voice cloning. A few seconds of audio from a voicemail, a webinar or a social media video is enough to clone a voice. The finance team then receives a call from the “managing director” asking for an urgent payment to a new supplier.
- Deepfake video calls. In the most widely reported case, a finance employee at a multinational engineering firm joined a video call in early 2024 with what appeared to be the company’s chief financial officer and several colleagues. Every participant other than the victim was a deepfake. The employee made transfers worth around £20 million.
The tools behind these attacks are cheap and easy to use, and the targets are increasingly ordinary businesses. A firm with a finance function of two people and a managing director who travels is an ideal target, because urgent instructions from an absent boss are normal.
Why the old training makes it worse
Traditional fraud training relies on detection: look for the tell, spot the fake. Deepfakes remove the tell. Staff trained that way are confident they can recognise a scam, and confident staff make payments. The mindset needs to change from “does this look genuine?” to “has this been verified through a channel the fraudster cannot control?”
The controls that still work
None of these need new technology. They need to be written down, trained, and enforced without exception.
- Independent callback. Any request to make a payment, change bank details or release data is verified by calling the requester back on a number already held on file, never a number given in the request.
- Dual authorisation. Payments above a set threshold, and every change to supplier or payroll bank details, need two people to approve.
- Code words. Directors and finance staff agree a phrase that must be used for urgent out-of-band requests. A cloned voice will not know it.
- No exceptions for seniority. The attack depends on the target being afraid to question the boss. The policy must say that the managing director will be verified like everyone else, and the managing director must mean it.
- A no-blame culture of checking. Staff who slow down a genuine payment to verify it should be thanked, not told off. Fraud only succeeds when the process fails.
What the law now expects
The Economic Crime and Corporate Transparency Act 2023 created a corporate offence of failure to prevent fraud, in force since 1 September 2025. It applies to large organisations, meaning those meeting two of three tests: more than 250 employees, turnover above £36 million, or a balance sheet above £18 million. If a person associated with the organisation commits fraud intended to benefit it, the organisation is liable unless it can show it had reasonable fraud prevention procedures in place. Documented staff training is a core part of what “reasonable procedures” means.
Smaller businesses are outside the offence but not outside the risk. Banks are under no obligation to reimburse a business that authorised a payment to a fraudster, and most do not. The money is usually gone within hours.
What a training programme should cover
Effective training in 2026 is short, specific and repeated. It should show staff real examples of cloned audio and deepfake video so they stop believing they can tell the difference. It should walk through the exact verification steps for the requests that matter: payments, bank detail changes, data releases and credential resets. And it should be refreshed at least annually, because the techniques change. If you have not yet written an AI policy, our guide to AI in the workplace covers where to start.
Reset your team’s fraud defences for the AI era
AI-Enabled Fraud and Deepfake Awareness is a one to two hour online course for all staff, built around real cases, with an NFAQ certified certificate on completion. Suitable as evidence of reasonable procedures.
Frequently asked questions
Can software detect deepfakes reliably?
Not reliably enough to depend on. Detection tools lag behind generation tools, and a false sense of security is exactly what the attacker wants. Treat detection as a bonus and verification as the control.
Who is most at risk in a business?
Anyone who can move money or change data: finance, payroll, accounts payable, HR and IT support. Executive assistants are frequently targeted because they act on instructions from senior people every day.
Does the failure to prevent fraud offence apply to small businesses?
No, it applies only to large organisations as defined above. Subsidiaries of large groups can be caught, and smaller businesses are often asked by large customers to show they have equivalent controls.
Should we tell staff about attempted frauds?
Yes. Sharing real attempts against your own business, anonymised where needed, is the most effective training you can give.
This article was published in September 2026 by National Compliance Training. Regulations change, so always check the latest guidance from GOV.UK for the current position. This article does not constitute legal advice.