Deepfakes, Impersonation and the Growing Challenge of Digital Trust
For years, employees have been trained to watch for suspicious emails.
Check the sender. Look for spelling mistakes. Be cautious when someone asks for money or sensitive information.
That advice still matters — but artificial intelligence is making impersonation considerably more convincing.
AI-generated voices, images, video and written content can now be used to imitate executives, employees, vendors and other trusted contacts. A fraudulent request may no longer arrive as an obviously suspicious email. It could appear to come from a familiar executive, contain a realistic invoice, imitate someone’s writing style or even use a convincing voice or video.
For organizations, this creates a broader challenge:
How do you establish trust when seeing or hearing someone is no longer enough to prove who they are?
Gartner identified deepfake identity impersonation as one of the critical cybersecurity threats facing organizations in 2026, noting that generative AI has increased the accessibility, quality and potential uses of fake voice, video and images.
Impersonation Is Not a New Problem
Cybercriminals have impersonated executives and vendors for years.
Business email compromise, phishing and spoofed domains commonly rely on convincing an employee that a request is coming from someone they trust.
The FBI describes spoofing as disguising an email address, sender name, phone number or website so that it appears to come from a legitimate source. The objective is often to persuade someone to transfer money or disclose sensitive information.
AI makes these familiar attacks more sophisticated.
A criminal can potentially create more realistic emails, fabricate supporting documents and conversations, generate voices or images, and personalize attacks using information that is publicly available online.
Microsoft recently reported detecting a campaign involving more than one million fraudulent emails in which attackers impersonated corporate executives, created fabricated invoices and supporting email conversations, and attempted to convince finance employees to authorize payments. Microsoft found indicators consistent with generative AI being used to improve the fraudulent messages.
The technology may be new, but the underlying objective remains familiar: convince someone to trust the wrong person.
The Risk Goes Beyond Email
The growing concern is that organizations can no longer think about impersonation as simply an email-security issue.
Deepfakes can potentially be used in several ways:
- An employee receives a voice message that appears to come from an executive requesting an urgent payment.
- A video call includes someone who appears to be a colleague or senior leader.
- A vendor’s identity is impersonated to request changes to banking information.
- Fraudsters attempt to defeat voice or facial authentication.
- A fake candidate uses an altered identity during a remote hiring process.
- Synthetic content is circulated publicly and falsely attributed to an organization or one of its executives.
Gartner notes that deepfake identity impersonation is already being used for social engineering, attacks against biometric processes, recruitment fraud and disinformation.
This means Finance, Human Resources, Communications, IT and senior leadership all have a role in managing the risk.
Technology Alone Won't Solve the Problem
Deepfake detection technology is developing rapidly, but organizations should not assume that a single security product will identify every fraudulent communication.
Gartner recommends using a combination of stronger business processes, employee awareness and available detection technologies rather than relying solely on deepfake detection.
In practice, some of the most effective protections may be surprisingly straightforward.
An organization might require an employee to independently confirm changes to vendor banking information using a previously verified phone number.
Large or unusual payments could require approval from more than one person.
Sensitive password resets or account changes could require additional identity verification.
Employees could be instructed that an urgent voice call, text message or video request does not override established approval procedures.
In other words, organizations need to ensure that important decisions are based on verified identity and established processes rather than the apparent authenticity of a message.
Building a Verification Culture
Employees are often told to “be careful,” but that instruction alone is becoming less useful as fraudulent communications become more sophisticated.
Organizations need clear procedures for situations where impersonation could cause significant financial, operational or reputational damage.
Questions worth considering include:
- How do we verify an unusual financial request?
- What happens when a vendor asks us to change payment information?
- Can one employee authorize a significant transaction?
- How do we verify sensitive requests from executives?
- What procedures exist for resetting privileged accounts?
- Are employees comfortable challenging an urgent request?
- What should someone do if a voice, video or email communication seems unusual?
- Who should be contacted when impersonation is suspected?
The goal isn’t to make every business interaction difficult.
It is to introduce additional verification where the consequences of getting something wrong are significant.
From Cybersecurity to Digital Trust
The larger issue extends beyond deepfakes.
Organizations increasingly operate in an environment where digital content itself may need to be authenticated.
Gartner describes an emerging market for digital trust and authenticity technologies designed to help organizations determine whether digital content, identities and interactions are legitimate.
This represents an important shift in cybersecurity.
Traditionally, organizations focused heavily on determining whether a device, network connection or user account could be trusted.
Increasingly, they will also need to ask:
Can we trust the communication itself?
As synthetic content becomes more common, verification processes, identity controls and digital provenance are likely to become increasingly important parts of organizational security.
How Litcom Can Help
Litcom helps organizations assess and strengthen their cybersecurity, identity, governance and technology environments.
We can help organizations review authentication and access controls, evaluate high-risk business processes, strengthen IT and security policies, identify gaps in verification procedures, and develop practical approaches for reducing the risk of fraud and impersonation.
As AI makes impersonation more convincing, strong technology controls need to be supported by equally strong business processes. Contact Litcom to discuss how we can help strengthen your organization’s approach to cybersecurity and digital trust.
