In early 2024, an employee at engineering firm Arup joined a video call with what looked like the company’s CFO and several colleagues. Every one of them was a deepfake, and by the end of the call, about $25 million had left the company in 15 transfers. Deepfake fraud has since moved from headline curiosity to everyday business risk.
Deepfake fraud uses AI-generated video, voice, or images to impersonate a real person and trick victims into sending money, sharing data, or granting access. We asked Tudor Damian, Cybersecurity, AI and Cloud Advisor at D3 Cyber, why deepfakes break the logic of Zero Trust, how companies can verify who is really on the call, and what AI is doing to the next generation of defenders.
A Certified Ethical Hacker and Microsoft MVP with more than 20 years in IT, Tudor returns to DefCamp with “The Identity Crisis: How Deepfakes Are Breaking Zero Trust”.
Why deepfake fraud became an urgent security problem
Zero Trust is a security model that treats every user, device, and request as untrusted until it is verified, no matter where it comes from. Tudor has spent years designing and reviewing these architectures, and he has repeated their motto on countless conference stages. Over time, though, one detail began to bother him: every verification step has to check against something. Deepfakes made him ask what that something really is.
I've been building and reviewing Zero Trust implementations for a good number of years, and everyone in that world knows the mantra by heart: never trust, always verify. It's a decent mantra; I've said it on stage more times than I can count. But with all the changes around AI and deepfakes, somewhere along the way a plain question started bothering me. Verify against what, exactly?
Well, for most companies, the honest answer is still a face and a voice. The finance director on the video call, the manager on the phone. We built layer upon layer of technology around identity, and at the very top of the pile we kept the same check people have relied on since long before we had writing: does this look and sound like someone I know?
Then early 2024 gave us a clear example: an employee at Arup in Hong Kong sat on a video call with what looked like the CFO and a few colleagues, and over fifteen transactions wired out roughly 25 million dollars. What was odd was something Arup's CIO said afterwards, namely that "no internal system had been compromised". Nothing was hacked; every control worked as designed. And yet, the attackers came in through a door nobody had thought to lock, because nobody had thought of it as a door.
Since then, the cost of pulling this off has gone down significantly. A few seconds of audio from a conference recording, a LinkedIn photo, and a free evening will do the trick. When something goes from nation-state budget to bored-teenager budget in under two years, it stops being a future risk and starts being just a regular Tuesday.
How to verify identity when anyone can look like your CFO
Deepfake fraud works because most people still treat a familiar face on a video call as proof that the person is real. Email lost that kind of trust years ago, after decades of phishing taught us to check the sender before acting. Video never went through the same lesson, because until recently faking it convincingly was too hard. So how should a company decide whether the person on the screen is who they claim to be?
FIDO2 is an open authentication standard that uses a physical security key or a device’s secure chip to prove identity, so a login cannot be completed by someone who only has a password or a convincing face.
Decide up front that the call is never the evidence. Everything after that is just implementation detail.
Think about what a live video call proves: pixels and audio arrived at your screen. That's it, that's the full list. We already treat email this way, useful for context and worthless as authorization (you know not to trust an email simply because it says it's from someone you know), and nobody wires money because an email told them to. Or at least, almost nobody. A video call still carries a strange authority, though, because our brains never had to deal with a world where a face can be "rented by the hour".
So, the answer about who someone is has to come from something the attacker can't easily provide. In practice, that's a secondary channel you initiate, rather than the one they contact you on. Call them back on their mobile number. Confirm the request is legit through a system they'd need real credentials to get into (e.g., the internal Slack chat). And for anything that moves money or grants access, add a hardware-bound step, something that lives on a security key or in a device's secure chip. A synthetic face can be very convincing, but it cannot press a FIDO2 button.
Ferrari showed the zero-budget version of this in 2024. One of their executives got a WhatsApp voice call from "the CEO" about an acquisition, and something felt slightly off. So, he simply asked: what was that book you recommended to me the other day? The line went dead. No vendor was involved, and nothing was purchased. The executive asked a question the attacker couldn't answer, because the answer had never passed through any channel they controlled.
The part people don't enjoy hearing follows from that. If your approval process can't survive the CFO being fake, the process was already broken in the first place. And the deepfake just showed you where and how.
The Ferrari case is a useful reminder that the best defense was a human habit. According to reports at the time, the cloned voice even reproduced CEO Benedetto Vigna’s southern Italian accent. What gave the attacker away was a simple question about a shared memory, one no AI model could have learned from public footage.
Where to start against deepfake fraud: process before tools
Vendors now pitch a long list of answers to deepfakes: cryptographic identity, FIDO2 keys, C2PA provenance and behavioral verification. C2PA is an industry standard that attaches a signed record to a photo, video, or audio file showing where it came from and how it was edited. Each of these has a place, but few organizations can roll them all out at once. Tudor’s advice starts somewhere much cheaper than any of them.
None of the four are really that critical, if I'm honest. The thing organizations miss most is the process around identity. Those are just technical solutions that cascade from that. I've seen companies buy FIDO2 keys for everyone and keep a policy that says a manager can approve a payment verbally over the phone. The key protects the login, yet nobody protected the decision. It's like installing a vault door on a room but keeping the window open, because the window was never in the vault brochure.
However, if I were to pick one out of the four on the list, I think C2PA provenance is the one most people misunderstand. It's a good idea for media integrity. But it ends up being close to useless against a live impersonation on a video call, because there's no captured file to sign. Companies hear "provenance check" and think they've bought deepfake protection, when what they've bought is a labeling scheme for files.
Now, where to start if you can't do everything? This costs a spreadsheet and one afternoon. List every workflow where a human voice or face currently counts as authorization: wire transfers, payroll changes, vendor bank detail updates, MFA resets, access grants, and the classic "urgent" request from the boss. Then change each one so the call or voice alone can't complete the action. A callback on a pre-registered number does wonders, and so does an authenticated step in a system the impersonator doesn't control. Do that, and the exact attack Arup fell victim to stops working against you.
After that, implement some form of hardware-bound authentication for the people who can move money or grant access. Only those people should be enough to begin with. Behavioral verification comes last. It's promising, but it's expensive and noisy, and the vendors are currently a fair bit ahead of the evidence.
How AI changes who does the work in cybersecurity
After more than 20 years in IT, Tudor has seen plenty of technologies promise to change everything. Mobile, virtualization and cloud all reshaped how companies work, yet attackers and defenders stayed recognizably human. In November 2025, Anthropic published a report on a state-sponsored espionage campaign, tracked as GTG-1002, in which an AI model carried out an estimated 80 to 90 percent of the tactical work. For Tudor, that report changed a mental model he had carried for his entire career.
It's true, I've been in IT long enough to watch a few waves come through, each one announced as the thing that changes everything. Mobile, virtualization, cloud, you name it. They did change a lot, but they changed the same kind of thing: where the workloads ran and where the people sat. The attacker was still a person, and so was the defender.
AI changes who does the work, and that's the difference. For twenty-odd years the real constraint on attackers was skilled human hours. Someone had to write the phishing lure in fluent Romanian, adapt the exploit, and then sit at the keyboard for hours during an intrusion. That constraint capped how many competent attacks the world could produce. Anthropic's GTG-1002 report from last November described an espionage campaign where the model itself did an estimated 80 to 90 percent of the operational work. When I read that, I realized a mental model I'd carried my whole career fell apart. I think the industry had always assumed both sides were limited by the same talent shortage. But that moment was proof that one side just hired an unlimited number of juniors who don't sleep. And those juniors will only get better in time.
The second thing worries me more over the long run, and it's what these tools do to defenders. I've spent a good part of the last two years looking at how AI hollows out the apprenticeship path across professions, and security is very much an apprenticeship discipline. You learn by doing tedious things until your instincts wake up. If juniors skip that stage, we end up with analysts who can drive the tool but can't tell when the tool is wrong. And that's the exact reflex deepfakes exploit: accept what's in front of you, and skip the check. So I would say that if we keep doing what we're doing, things are only going to get worse.
Paper tiger compliance: secure on paper, vulnerable in practice
Certifications and regulations have pushed security higher on every management agenda. ISO 27001 sets out how an organization should run its information security management system, while the NIS2 Directive obliges essential entities across the EU to manage cyber risks and report incidents. Passing an audit, though, only proves that a control is written down. Tudor calls the gap between the two “paper tiger” compliance, and he meets it almost every week.
Quite a few. I'd go as far as saying it's most of my week. Here's an example of a classic case we often run into: a company passes its ISO 27001 audit with a documented incident response plan that nobody in the building has ever run. The plan names a coordinator who left the company two years ago. The auditor checked that the document exists, and existence was the control.
Another one I keep meeting in NIS2 work is a policy line that says "MFA everywhere". When you go and look, it means (an outdated approach of) sending SMS codes for the workforce, and using a shared admin account on the backup system with a password from 2019, that's written in the policy, in plain text. The report says "compliant". But it's that backup system where the ransomware will be heading.
And then there's the one this talk is all about: a payment procedure that says, "dual authorization required", where the second authorization is a phone call. On paper, two people approved the transfer. In practice, one person and one voice clone did. An auditor will never catch it, because the procedure exists and gets followed every single time. It just doesn't do anything to prevent real-life attacks.
Compliance asks whether you can describe a control, while security asks whether the control still holds while someone is trying hard to break it. And that's where the disconnect lies with most companies. Auditors only ever test the first, and most of the incidents we've been called into started somewhere in the gap between the two.
Can people still be trusted as a form of authentication?
If a face and a voice can be faked for the price of a free evening, it is tempting to conclude that humans have no place left in identity checks. Tudor draws a sharper line. He separates recognizing someone from judging whether a request makes sense, and those turn out to be very different jobs. One of them, he argues, people lost years ago; the other they are still better at than any machine.
For one specific job, yes, and we got there a couple of years ago. Recognizing someone remotely by sight and sound no longer works. A face on a screen and a voice on a phone line aren't evidence of identity anymore, and any process that still treats them that way is running on nostalgia.
That's a much narrower claim than "people can't be trusted", though. Humans are still very good at a different job, which is noticing that something is off and refusing to go along with it. What the Ferrari executive picked up on was pressure, an odd cadence, a request that didn't quite fit, and he decided to test rather than comply. None of that required spotting a deepfake. That instinct is worth more than any detection model on the market, and unlike the detection model, you can train this behavior during a lunch break.
So, I'd split the work: machines can still own recognition, through cryptographic identity bound to hardware, because recognition is a math problem and math doesn't get tired at 5pm on a Friday. Humans should continue to own judgment, meaning the decision to slow down and verify through a channel they control. The failure mode we're drifting into is the reverse. Companies keep asking people to do recognition, which they can no longer do, and nobody gets assigned the judgment part at all.
Years ago, I wrote a piece about how we'd traded faces for screens, and how people were quietly looking for ways to be in the same room again. I was writing about board games at the time, but it turns out the same thought applies here. The screen was never proof of the person you're interacting with. We just hadn't been properly reminded of this yet.
Tudor's message for DefCamp 2026 attendees
Two days at DefCamp bring a flood of new research, live demos, vendor pitches, and hallway conversations. Some of it will change how attendees work, and some of it will simply sound convincing. Tudor hopes people leave with a habit that helps them tell the difference. His advice is to bring skepticism, and to aim it at yourself first.
Bring your skepticism along, and point it at yourself first.
Most of us in this industry are good at distrusting other people's systems. We're much worse at distrusting our own reflexes, and the whole synthetic media problem runs on reflexes. This looks like my boss. This sounds like my colleague. This output from the tool reads fine. The real target is the half-second where you decide something doesn't need checking, and no firewall or tool can come in to cover that half-second.
So, the habit I'd like people to bring, and sharpen over the two days, is one question: how do I actually know that? Try it on the demo on stage, on the vendor pitch in the hallway, on the AI summary you skimmed on the train in, and yes, try it on my talk too. Then go and find the people asking the same question and sit at a table with them, face to face, phones down. Nobody has managed to deepfake that channel. Well, at least not yet.
If you leave DefCamp a bit slower to believe things and a bit quicker to verify them, the conference did its job, and so did I.
Meet Tudor Damian at DefCamp 2026
Want to know how to verify identity when seeing is no longer believing? Catch “The Identity Crisis: How Deepfakes Are Breaking Zero Trust”, Tudor Damian’s talk at DefCamp 2026.
You can learn from new research, meet attendees from more than 50 countries, and compare notes with the specialists who defend organizations every day.
