The Deepfake Playbook For Counsel: Exposure, Gaps, And Controls

In early 2024, a finance employee in the Hong Kong office of engineering firm Arup joined a video conference that appeared to include the company's chief financial officer and several colleagues. After receiving instructions during the call, the employee authorized multiple transfers totaling roughly $25 million. The other apparent participants were synthetic representations. Seeing is no longer believing.

Many organizations have not yet translated that shift into their payment, personnel and incident response procedures. The hard problem with deepfakes is managing what happens in the minutes after someone believes one. 

We previously examined the rise of deepfakes-as-a-service and the fragmented legal, insurance, and governance landscape surrounding synthetic media. This installment focuses on the next operational question: what should an organization do when synthetic content reaches someone with authority to act?