AI voice cloning can replicate a person's voice from as little as three seconds of audio. Video deepfakes are increasingly convincing and increasingly accessible. In 2024, these tools moved from research demonstrations to active use in financial fraud targeting businesses. Here's what NZ businesses need to know.
In January 2024, a finance worker at a multinational corporation's Hong Kong branch attended a video conference with colleagues, including what appeared to be the company's CFO. He was instructed to transfer HKD 200 million (approximately NZD $38.5 million) to a specified account. The instruction was followed. Every other participant in the video call was a deepfake — AI-generated video and audio impersonations created from publicly available content. The CFO was in another country and had no knowledge of the meeting.
This wasn't a one-off incident. Hong Kong Police reported multiple similar attacks using the same technique in the same period.
The Technology Behind Voice Deepfakes
Voice cloning technology has become dramatically more accessible. Tools including ElevenLabs, PlayHT, and open-source models can generate realistic voice clones of specific individuals from as little as three seconds of reference audio. Audio of business leaders is often available from conference recordings, video interviews, podcast appearances, and company promotional content — all publicly accessible.
The practical implication: any NZ business leader who has appeared in publicly available audio or video content has a voice clone that a motivated attacker could create in minutes. The same voice can be used in real-time phone calls using tools that route synthesised voice through the phone call, making it indistinguishable from a real call to the recipient.
How Deepfake Attacks Target Businesses
The most common financial deepfake attack pattern: an attacker obtains the target company's org chart (LinkedIn, company website), identifies who has payment authority and who they would respond to (the CEO, the CFO, a board member), creates a voice or video deepfake of that authority figure, and calls the target with an urgent payment instruction — a supplier payment, an emergency business expense, a confidential transaction that can't be discussed with anyone else.
The psychological dynamics that make CEO fraud email attacks work are amplified by voice or video: hearing a familiar voice creates a much stronger sense of legitimacy than reading an email. The real-time nature of a phone call suppresses the instinct to pause and verify.
Process Controls That Defeat Deepfake Fraud
Technical detection of deepfake audio is improving but unreliable for real-time use. Process controls are currently more effective. For any verbal instruction to authorise a payment: a written confirmation via a separate communication channel (not the same phone number or email account the instruction came from) should be required. A simple shared code word between executives — known only to them, required to verify identity for any financial instruction — provides a low-tech but highly effective verification layer that deepfakes cannot replicate.
Deepfake fraud is no longer a research scenario — it's a documented attack technique that has successfully stolen tens of millions of dollars. The defence is process, not technology: verify financial instructions through an independent channel, always, regardless of how convincing the voice or video seems.
