The 11-minute deepfake: Why AI has rewritten the rules of

A finance head at an Indian organization was targeted by a sophisticated deepfake video call from an attacker impersonating their CFO to request an urgent vendor payment. The incident highlights the growing prevalence of AI-driven social engineering, where attackers use high-fidelity synthesis to bypass traditional security instincts.

What happened

The finance head received a real-time, moving, and talking video call from an individual who appeared to be their CFO. The attacker successfully mimicked the CFO’s appearance, including their clothing and office background, as well as their specific vocal rasp. The call lasted for eleven minutes, during which the participants believed they were interacting with the genuine executive. The request for an urgent vendor payment was framed in a way that appeared authentic, leveraging the visual and auditory accuracy of the deepfake to establish trust. The incident was only resolved when the finance head, exercising caution, hung up the call and verified the request by contacting the CFO through a previously saved, trusted phone number. This verification step prevented the fraudulent transaction, demonstrating that while AI can replicate familiar voices and faces, independent verification through a separate, known channel remains a critical defense against such sophisticated impersonation attacks.