How Do You Protect a Business from Deepfake Fraud in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What do the 2026 Indian deepfake fraud cases have in common?

Three patterns recur across the documented cases. The first is a trusted channel faked: a voice-cloned managing director on a call, a deepfake video advertisement featuring a Union minister, a WhatsApp message appearing to come from a company director. The second is a slow build, where a small genuine refund or a dashboard showing a growing balance establishes credibility before the real extraction. In the Pune case a businessman made 36 transfers totalling over Rs 1.07 crore between 2 June and 23 July 2026, and a Rs 7 lakh withdrawal was permitted to deepen confidence. The third is a verification step that has quietly been removed. In each case the fraud would have been stopped by a callback to a known number, and in each case that step was skipped because the request felt urgent.

How do deepfakes defeat biometric and KYC checks?

The I4C's June 2026 advisory was explicit: deepfake videos and synthetic identities are being used to defeat facial authentication, liveness detection and video-based KYC, with contact typically beginning on social media, messaging apps, job portals, dating sites and phone calls. The technique is not exotic: recorded blinking, head turns and focus changes are captured and replayed, and the pre-recorded footage is fed into a video call. The honest conclusion for a risk owner is that video KYC is one factor, not two, and that any control whose only job is to prove a face is proving much less than it did two years ago.

What controls actually stop executive impersonation fraud?

Four, and they are all procedural rather than technical. Out-of-band verification: any request to change payment details is confirmed by a separate channel against a number already on file, never the one in the request. Dual authorisation: no single person can release a transfer above a threshold. A cooling-off period: a new beneficiary or a changed bank account is held for a fixed interval, which alone defeats the majority of these cases. And a callback discipline: SEBI's 17 July 2026 caution on the Boss Scam noted that attackers with device access save their own number in the victim's contacts under the CEO's name, so a verification call reaches the scammer. This is why the callback number must come from a directory, not from a contact card.

How should an organisation respond to a deepfake incident?

Treat it as a payment fraud incident first and an identity incident second. Freeze the beneficiary account through your bank's fraud desk immediately, report on the National Cyber Crime Reporting Portal at cybercrime.gov.in and call the 1930 helpline, and file on the Money Restoration Portal if money moved. Then preserve the evidence: the call recording, the WhatsApp chat, the video file, the device, and the deepfake itself, because in a Delhi case the deepfake video was the exhibit. India's amended IT Rules 2026 require AI-generated content to be removed within 3 hours once reported, which gives an organisation a fast route to a takedown if the material was published rather than sent privately.

What are the common questions about D?