Business Email Compromise (BEC) has long been a serious financial threat to companies. A common way for cybercriminals to commit BEC was by compromising an executive’s email account and using it to trick the finance team or global partners into sending fraudulent wire transfers. As of 2026, global verification protocols became stricter and cybercriminals became creative in their methods. The next major cybercrime capability has now become an even more serious threat: synthetic business identity compromise (SBIC).
The next wave of corporate fraud and identity weaponization will be via deepfakes.
1. The Death of Voice Verification
One of the biggest challenges the SBA has faced is that SBIC does not require a voice call or video call to verify the transaction, which is one of the last steps in processes like this. In the past, if someone received an email requesting an immediate transfer of money (for example - a $1 million wire transfer) from the CFO to the CEO, the CFO would call the CEO to verify the legitimacy of the request.
In today's world, cybercriminals are using generative AI models to create "synthetic" clones of an executive, which can be very hard to distinguish from the real executive. In order to create these "synthetic" models, it only takes a few minutes' worth of publicly available content (from earnings calls, YouTube videos, and podcast appearances), and they can quickly harvest enough content to create a synthetic model of the executive to use in an email.
As can be seen by the image that was created, when a deepfake (whose verification has been blocked by verification monitoring systems) contacts someone asking for a transfer of funds, they sound and look exactly like the executive. They have been able to completely invalidate the last defence mechanism that existed. In a fast-paced, high-pressure environment where people are working, very seldom will someone notice the subtle, milliseconds of delay in visual geometric artifacts or flickering grids that reveal that the video call is synthetic.
2. A Coordinated Multi-Channel Attack
Synthetic fraud doesn't occur in a vacuum. It is the sophisticated, coordinated attack that occurs after building on a series of other attacks. The attackers do not begin with the deepfake call, but rather they build toward it.
First, they start gaining initial access to a corporate network using either traditional infostealer tools (as previously discussed in past articles) or via dark web marketplaces (image 4 & image 6), and begin building an understanding of how that organization works internally (i.e. the company's internal processes, organizational reporting hierarchies, and financial transactions).
They identify the specific gap or event the fraud/thievery will take place (i.e. the account payable vendor payment schedule; or some type of urgent acquisitions project) so that when a high-value transfer occurs under that circumstance, it will be plausible. The deepfake call will take place at precisely the right time/within that timeframe to take effect, often using a video conferencing tool (e.g., Zoom, Microsoft Teams) to provide the “final authorization” needed to override standard security prompts. The image of the actual CEO is seated at the boardroom table and appears confused, entirely unaware that his identity is actively being used as a weapon to divert $1.2 million from the company's bank account.
3. Beyond Financial Fraud: Brand Weaponization
The threat of synthetic identity extends far beyond financial theft. If a cybercriminal can successfully deploy a deepfake model of a C-Suite executive, they can weaponize it to destroy corporate reputation.
Imagine a deepfake video surfacing on X (formerly Twitter) or being distributed via Telegram markets, showing the CEO making explosive statements about earnings manipulations, pending lawsuits, or confidential acquisitions. A well-timed, hours-long synthetic attack could manipulate stock prices or create PR chaos that lingers long after the fake is debunked.
The Shift to Anti-Synthetic Defense
The reactive approach of SBIC does not work. Traditional anti-phishing tools, MFA, or traditional EDR do not have any effect against a post-authentication attack using an authorized, highly-trusted identity.
To protect against synthetic identity, the organization must have a proactive approach through the use of identity verification and anti-synthetic technology, which means they will have to move from "detecting the breach" to "detecting the synth."
Organizations need sophisticated monitoring solutions - like those in the left half of the image - that cover discussions about deepfake technologies, lists of executives being targeted, and publicly available media samples of executives, and will continue to monitor these items for their potential to be used as weapons. When a fraud attempt is made, they require identity assurance solutions that can identify the digital inconsistencies caused by synthetic identity before the fraudulent transfer occurs.
DarkX - DarkX gives organizations the critical, AI-driven visibility they need by constantly monitoring dark web marketplaces, forums and underground conversations for new deepfake technologies, lists of targets and media assets stolen from executives. By identifying the potential weaponization of identity at its source, DarkX enables companies to detect and prevent synthetic fraud prior to the "Golden Hour" of deepfake deployment.
For more research on cybersecurity, privacy, and emerging digital risks, visit:
IntelligenceX — IntelligenceX enables users to discover digital evidence in a privacy-friendly way.
Top comments (0)