Deepfake awareness training: a quick guide

In February 2024, a finance employee at the engineering firm Arup joined a video call with what looked and sounded like the company’s CFO and several colleagues. Every person on that call except the employee was a deepfake. By the end of the week, US$25.6 million had been transferred to the attackers.

That is the reality of deepfake fraud in 2026: it no longer looks like a badly lip-synced celebrity video. It looks like your CEO on Teams, asking for something urgent. This guide explains what deepfakes are, how they are used against organizations, which verification rules actually stop them, and which deepfake awareness training platforms you can use to prepare your employees.

What are deepfakes and why are they dangerous?

Deepfakes are synthetic media (video or audio) generated or manipulated using artificial intelligence to make people appear to say or do things they never actually said or did. Faces can be swapped and voices can be cloned to sound eerily convincing. A deepfake can convince others that a person has said or done things they never did.

Over the years, we’ve all learned to not always trust what we read. However, people haven’t yet learned to distrust everything they see and hear. This is currently being exploited by cyber criminals. Whether it’s a fake video of a CEO making a controversial statement, or a cloned voice urgently requesting sensitive information, deepfakes can cause real-world damage.

Key risks of deepfakes for organizations

Deepfakes create multi-layered threats for businesses. The main risks include:

CEO fraud and financial loss

One major threat is deepfake-powered CEO fraud. Criminals use a cloned voice or video of a senior executive to trick employees into transferring money. These attacks are already happening. For example:

• In 2019, a UK energy firm lost $243,000 after a deepfake voice call from a “CEO”.
• In 2020, fraudsters used deepfake voice technology to steal $35 million.
• In 2024, a UK engineering firm lost over £20 million after a fake video call impersonated a high-level executive.

Employees naturally tend to obey urgent requests from leadership, especially under pressure. Deepfakes exploit this instinct, bypassing usual verification procedures.

Reputational damage and disinformation

Deepfakes can also be weaponized to destroy reputations. Imagine a fake video of your CEO making racist remarks—or fake evidence that your product is unsafe—going viral online. Even if later disproven, the damage to trust and public perception can be irreversible.

Europol warns that deepfakes could be used to spread false information about companies, creating shareholder panic, customer boycotts, or even regulatory investigations.

Targeted phishing and social engineering

Deepfakes take social engineering to a whole new level. Instead of a suspicious email, imagine receiving a convincing video call from your “IT department” asking you to log into a phishing page. Or a voice message from your “CFO” requesting urgent confidential information.

• Vishing (voice phishing) and video phishing are rising threats.
• Attackers need only a short audio clip (e.g., from social media) to clone a person’s voice convincingly.

Deepfakes create emotional authenticity, making it harder for employees to detect fraud based on instinct alone.

In private life, many people have already been targeted by deepfakes from their children or parents. If your son’s unmistakable voice tells you he is in danger and needs money now, are you calm and aware enough to double-check his identity?

Three real deepfake attacks on companies (and what stopped two of them)

Arup, Hong Kong, 2024. A finance employee received an email about a “confidential transaction”, then joined a video call where the CFO and other colleagues appeared live. All were AI-generated. The employee made 15 transfers totalling HK$200 million (about US$25.6 million). Nothing in the technology stack failed; the attack worked because a video call was treated as proof of identity.

Ferrari, 2024. An executive received WhatsApp messages and then a phone call from someone with the voice of CEO Benedetto Vigna, including his southern Italian accent, about a confidential acquisition. The executive asked a question only the real CEO could answer (the title of a book he had recommended days earlier). The caller hung up. Cost: zero.

WPP, 2024. Attackers set up a Microsoft Teams meeting using a public photo of CEO Mark Read, a cloned voice and YouTube footage, and tried to get an agency leader to set up a “new business” and share money and personal details. The target became suspicious and reported it. Cost: zero.

The pattern is the same every time: a trusted face or voice, a reason for secrecy, and time pressure. The difference between a US$25 million loss and no loss was not detection skill. It was whether the employee verified through a second channel before acting.

Why traditional security awareness is no longer enough

Most companies offer annual security awareness training, covering phishing, password hygiene, and basic cyber hygiene. But that’s no longer sufficient against deepfakes:

• Deepfakes are a new, rapidly evolving threat. Employees must learn to question even trusted sources like videos and phone calls.
• Most traditional training programs don’t even mention deepfakes.
• Research shows that even after being warned about deepfakes, people are poor at detecting them.
• Traditional security training is static, while deepfake techniques evolve monthly.
• Deepfake incidents require new procedural responses, like verifying suspicious calls via alternate channels and having clear reporting mechanisms.

Without specific deepfake awareness training, employees may fall for attacks because they underestimate how convincing synthetic media can be.

The deepfake verification protocol: five rules that stop almost every attack

Employees cannot be expected to spot a good deepfake. Audio clones (see vishing) now need a few seconds of sample audio, and live video deepfakes run on consumer hardware. Training therefore has to shift from detection to verification. These five rules cover the large majority of real incidents:

1. Call back on a known number. Any request involving money, credentials, personal data or access rights that arrives by call, video or voice message is confirmed by calling the person back on the number already in your phone or directory. Never on a number given in the message.
2. Agree a code word for urgent requests. Leadership and finance share a simple verbal passphrase that is never written down in email or chat. If a “CEO” cannot give it, the conversation ends.
3. Four eyes on every payment and bank-detail change. No single employee can execute a transfer above a set threshold or change a supplier’s bank account. Deepfakes target individuals; a second approver breaks the attack.
4. Urgency plus secrecy equals stop. “Don’t tell anyone” and “it has to happen today” are the two phrases that appear in nearly every deepfake fraud case. Train employees to treat the combination as a trigger to pause, not to act.
5. Switch channels. Request came by video? Confirm by phone. Came by phone? Confirm in person or via the company chat. Attackers rarely control two channels at once.

Put the five rules on one page, have leadership sign it, and make it part of onboarding. A protocol that leadership visibly follows is worth more than any detection tip.

Practical tips: preparing employees for deepfake incidents

Here’s how organizations can start preparing today:

• Awareness campaigns with real examples: Show employees real-world examples of deepfakes. Comparing real vs. fake videos helps build healthy skepticism. The key here is repetition. A yearly training is forgotten after mere weeks.
• Teach detection skills: Train staff to spot subtle inconsistencies (e.g., mismatched lip movements, odd lighting, monotone voices).
• Define clear reporting procedures: Employees should know how to verify unusual requests and report suspicions without fear of blame.
• Use technical tools: Explore software that can detect synthetic media or implement two-factor verification for sensitive requests.

Deepfake awareness training by role: who needs what

A generic “deepfakes exist” module changes little. Target the people who are actually attacked:

Finance and accounts payable

Scenarios: urgent transfers, supplier bank-detail changes, “confidential acquisition” payments. Drill the callback rule and the four-eyes rule until they are reflexes. Run at least one voice-clone simulation per quarter.

HR and payroll

Scenarios: salary account changes, “new employee” onboarding with synthetic identities, fake candidates in video interviews. Train HR to verify identity documents against a live, unscripted interaction and to confirm account changes through a second channel.

Executives and executive assistants

Executives are the most cloned voices in the company because their audio is public. Train assistants to treat any unusual request “from the boss” as unverified, and train executives to accept being called back without irritation. The protocol only works if leadership plays along.

IT and the helpdesk

Scenarios: password resets and MFA resets requested by “an employee” on a call, remote-access requests from a “vendor”. The MGM Resorts breach in 2023 started with a helpdesk call. Require identity verification steps that a voice alone cannot pass.

How to offer effective deepfake security awareness training

Guardey helps organizations build ongoing cyber resilience with user-friendly, gamified security awareness training that includes deepfake awareness:

• Gamification: Employees earn points, badges, and compete in friendly leaderboards, making learning fun and memorable.
• Continuous learning: Instead of one annual session, Guardey offers weekly or monthly microlearning, helping employees stay updated as deepfake threats evolve.
• Relevant content: Guardey tailors scenarios to each customer’s sector, making the lessons highly relatable.

Guardey’s continuous, gamified model encourages employees to think critically about what they see and hear, building lasting habits of skepticism.

→ Learn more about Guardey during a demo

Deepfake awareness training platforms and tools compared

Most security awareness platforms now include a deepfake module. The differences are in how realistic the simulations are, whether voice and video are covered, and whether training is continuous or a one-off course.

Whichever platform you choose, check three things: does it simulate voice or video (not only email), does it train continuously rather than once a year, and can you see per-employee who verified and who did not? If the answer to the last question is no, you cannot measure whether the training works.

Deepfake awareness checklist for your organization

• Verification protocol written down, signed by leadership, part of onboarding
• Callback numbers for all executives and finance staff in a directory employees actually use
• Code word agreed between leadership, finance and executive assistants
• Four-eyes rule configured in the payment system, not only in policy
• Role-based modules assigned: finance, HR, executives, IT
• At least one voice-clone or video simulation per quarter
• Reporting channel for suspicious calls that is faster than sending an email
• Public audio and video of executives reviewed (what is out there is what can be cloned)
• Incident playbook: who to call in the first 30 minutes after a suspected deepfake transfer
• Metrics tracked: verification rate in simulations, time to report, not course completion

Frequently asked questions

What is deepfake awareness training?

Training that teaches employees how AI-generated voice, video and images are used in fraud, and gives them verification rules to follow before acting on any request that seems to come from a known person.

Is there a deepfake course for employees?

Yes. Most security awareness platforms offer a deepfake module or course; Guardey covers deepfakes, vishing and CEO fraud in its weekly challenges, alongside its AI awareness training. A standalone course is a good start, but one-off courses are forgotten within weeks. Continuous short training with simulations is what changes behaviour.

What is deepfake phishing training?

Training combined with simulations in which employees receive realistic but harmless deepfake calls, voice messages or video invitations, so you can measure who verifies and who acts.

How often should employees be trained on deepfakes?

Short content monthly, a simulation at least quarterly for high-risk roles. Deepfake techniques change fast enough that an annual module is outdated by the time it is finished.

Conclusion: act now to stay ahead

Deepfakes are not science fiction anymore. Left and right, cyber criminals are trying to deceive employees into doing things that can harm your organization’s finances or reputation. Investing in recurring training is the only option to prepare your employees.