How NZ businesses can detect, prevent, and respond to AI-generated voice cloning, video deepfakes, and social engineering attacks.
That's all the audio an attacker needs to clone your voice at 85% accuracy. A LinkedIn video, a podcast appearance, a voicemail greeting, or even a conference recording. Source: DeepStrike 2025
400 companies per day are targeted by CEO deepfake fraud. Attackers clone the CEO's voice, call the finance team, and request urgent wire transfers. It works because employees are trained to follow their boss's instructions quickly. Source: DeepStrike
An employee at international engineering firm Arup was invited to a video conference with what appeared to be senior management. Every person on the screen was an AI-generated deepfake. The employee was instructed to transfer funds across multiple transactions. Total loss: $25 million.
A Swiss businessman received a phone call from what sounded exactly like his long-time business partner. The cloned voice referenced specific details of their ongoing deals. The businessman authorised a transfer of several million Swiss francs before realising the call was fraudulent.
Over 10% of financial institutions have already suffered a deepfake vishing attack costing more than $1 million. The average loss at financial institutions is approximately $600,000 per incident. Attackers target finance teams because they're authorised to move money quickly. Source: Group-IB
Deepfakes are only part of the picture. AI is supercharging every form of social engineering:
8 million deepfake files are projected to be circulating online in 2025, with a 900% annual growth rate in deepfake video volume. ChatGPT is mentioned 550% more than any other AI model in criminal forums. Over 300,000 ChatGPT credentials have been exposed via infostealer malware. Sources: DeepStrike, CrowdStrike, IBM X-Force
Create a shared code word between executives, finance, and anyone who can authorise payments. Change it monthly. A deepfake can clone a voice, but it can't know your secret phrase.
Any request to transfer money, change bank details, or share sensitive data must be verified by calling back on a pre-registered number (not the number from the email/call). No exceptions.
No single person should be able to authorise a payment alone. Two people verify, two people approve. This simple control would have prevented the Arup attack.
Run a 15-minute session: show examples of AI cloned voices, demonstrate how easy it is, explain the code word system. Do this quarterly. Security training reduces phishing success by 86% after one year.
Attackers create urgency to bypass rational thinking. Policy: the more urgent a request, the more verification is required. "We need this done NOW" = slow down and verify harder.
Audit what executive audio/video is publicly available. Consider whether conference recordings, podcast appearances, or LinkedIn videos need to be public. Each one is potential cloning material.
If someone joins a video call requesting money or sensitive actions, verify their identity through a separate channel. A quick text to their known mobile: "Are you really on this call?"
Test your team with controlled deepfake scenarios. WeHack offers deepfake social engineering simulations to test whether your staff would fall for a cloned voice requesting a transfer.
Never rely solely on voice or video to authenticate a person's identity. Trust the process, not the voice. A well-designed verification procedure protects you even when the deepfake is indistinguishable from reality.
You're ahead of 90% of NZ businesses. A penetration test will validate your controls and find any remaining gaps.
Your business is vulnerable to deepfake social engineering. The good news: most of these items cost nothing to implement today.
New Zealand lost $7.8 million to cybercrime in Q1 2025 alone. The NCSC handles approximately one nationally significant cyber incident per day. While deepfake-specific NZ statistics are still emerging, the global trends are clear: NZ businesses face the same threats as every other country, often with fewer resources to defend against them.
25% of NZ's nationally significant incidents were linked to state-sponsored actors who increasingly use AI-powered social engineering as their primary access method.
The businesses that survive deepfake attacks are the ones that prepared before the call came. Your defence starts with a conversation.
Start with our free security assessment — 20 questions across 6 domains, with a personalised radar chart and risk exposure in NZD. Then let's talk about what to fix first.
Take Your Free Security Score →Every business has different security challenges. Book a free 15-minute chat and we'll recommend the right approach — no obligation.
Mustafa Demirsoy
Founder & Hacker, WeHack
wehack.co.nz | info@wehack.co.nz | 022 091 7242
148 Durham Street, Tauranga 3110