Deepfakes Increase Fraud Risks for Corporations, Warns Swiss Re

Deepfake technology, driven by AI, has emerged as a significant threat to the corporate world, as highlighted in the latest SONAR report by Swiss Re. This once theoretical risk is now actively utilized in sophisticated fraud schemes and cyberattacks, prompting organizations to reassess their security measures to adapt to this evolving risk environment.

The report emphasizes that the advancement and accessibility of Generative AI tools are the primary drivers behind the proliferation of this threat. According to the analysis, deepfake technology and disinformation are posing notable risks by enabling intricate insurance fraud and cyberattacks. Instances involving deepfakes in the fintech sector surged by 700% in 2023, underscoring the swift uptake of this technology by malicious entities seeking to exploit vulnerabilities in business processes.

Deepfakes encompass synthetic media content, including images, videos, and audio, that are generated through deep learning algorithms, predominantly utilizing Generative Adversarial Networks (GANs). These networks consist of a “generator” network that produces counterfeits and a “discriminator” network that strives to identify them. Through numerous iterations, the generator learns to create content that is increasingly realistic and difficult for the human eye to distinguish from the original.

Initially leveraged for political misinformation or altering images of public figures, deepfakes have swiftly infiltrated the corporate realm. The shift to digitalized operations, remote work setups, and heightened dependence on digital communications have fostered an environment conducive to their utilization in social engineering attacks. Malicious actors exploit the implicit trust in internal communications to masquerade as high-ranking executives, employees, or business associates with unparalleled lifelike accuracy, transcending the barriers of traditional phishing emails.

The implications of deepfake technology on corporate cybersecurity are extensive and varied, with attacks now encompassing complex operations resulting in multi-million dollar losses. Identity theft for financial fraud stands out as the primary attack vector, with criminals employing deepfake audio or video to imitate an executive’s voice or appearance and instructing employees to execute urgent and confidential fund transfers. The insurance sector is a prime target, facing fraudulent claims supported by falsified evidence and direct assaults on insurers themselves, necessitating advanced detection technologies and specialized training to authenticate digital evidence.

Market manipulation and reputational harm pose additional severe threats, where the dissemination of fake videos depicting a CEO reporting unfavorable financial results or product crises can trigger a stock value dip, investor confidence erosion, and lasting brand impairment, the report outlines.

According to the Regula Survey 2024, a vast majority of companies globally experienced financial losses due to deepfake-related incidents, with a considerable portion reporting damages surpassing US$1 million. Despite this, a substantial awareness gap persists, with a significant number of business leaders lacking familiarity with the technology and underestimating the associated fraud risks. Many companies have not provided employees with specific training to detect or mitigate deepfake attacks, underscoring the critical need for ongoing education to recognize these threats’ evolving characteristics.

Swiss Re foresees the evolution of deepfake threats towards more automated and scalable attacks, combining Generative AI with other technologies to exploit vulnerabilities in real-time. The convergence of deepfakes with malware and ransomware attacks could introduce novel forms of digital extortion. To counter this emerging risk, Swiss Re advocates for a defense-in-depth strategy comprising biometric authentication tools, liveness detection technologies, blockchain-implemented digital watermarks, enhanced verification protocols, and continuous employee training to bolster organizational resilience against deepfake threats.