Most digital banks and KYC (Know Your Customer) platforms rely on something called liveness detection to verify identity remotely. You’ve used it: the system asks you to blink, turn your head, or hold up a piece of paper in front of your webcam. It’s designed to confirm there’s a real, live person behind the camera rather than a photo or a pre-recorded video.

In 2024, security researchers at Sensity AI demonstrated that deepfake injection tools could spoof this process by intercepting the camera feed at the software level and replacing it with a real-time AI-generated face. The platform sees a “live” person blinking and turning on cue. The actual camera is showing a deepfake. By early 2025, this capability had moved from research demonstrations into active fraud: fraudsters were using it to open business bank accounts and credit lines in other people’s names without ever touching a physical document.

This is a fundamentally different threat than someone cloning your voice to call your bookkeeper. It’s identity-level fraud that can affect your business credit, your regulatory standing, and your ability to work with certain clients. It’s also almost entirely invisible until damage is done.

The combination attack that became dominant in H2 2025 works like this: before the voice clone call, attackers send an email written in your exact tone. Same sentence structure. Same sign-off. Same habit of starting paragraphs with “Just wanted to” or whatever your particular pattern is. That email primes the target to expect the call, removes their natural scepticism, and makes the voice clone feel like confirmation of something already established.

The writing clone is trained on publicly available material: your website copy, your newsletter, your LinkedIn posts, your company’s case studies. If you’ve put more than a few hundred words of your own writing online, there’s enough to build a stylistic fingerprint. This is not theoretical. The US dental practice case from 2025 (where a $28,000 ACH transfer was authorised) used exactly this method. The office manager later told investigators she’d assumed the email was real because “it sounded exactly like how [the owner] writes.”

Cyber insurance has been a growth product for insurers since 2020. Most small business owners who have it assume it covers fraud losses from digital attacks. Many do. The gap is in how “social engineering” is defined in your specific policy, and when that policy was last written.

Pre-2024 cyber insurance policies were written before AI-assisted social engineering was a documented, widespread fraud category. The specific exclusions vary by insurer, but the pattern is consistent: policies that cover “computer fraud” or “funds transfer fraud” often require that the fraud involve unauthorised access to a computer system. A deepfake voice call that convinces your employee to authorise a transfer doesn’t involve unauthorised system access. The employee authorised it. Voluntarily. Which means the standard claim route doesn’t apply.

• Look for the phrase “social engineering coverage” explicitly in your policy. If it’s not there, you’re not covered for voice fraud.
• Check whether your policy has a “voluntary parting” exclusion. This is the clause that voids coverage when an employee willingly initiated the transfer, even under false pretences.
• Ask your broker specifically: “Does this policy cover losses from AI voice impersonation fraud?” Get the answer in writing.
• Policies issued or renewed after mid-2024 are more likely to include explicit AI fraud coverage. If yours is older, push for a rider or renewal.

The detection advice that circulated heavily in 2023 and 2024 — look for blurry edges, unnatural blinking, mismatched lighting, choppy audio — was accurate for the generation of tools available then. The tools available in 2026 have largely closed those gaps. Blinking is now modelled accurately. Hair edges render cleanly in most commercial deepfake apps. Voice clones from ElevenLabs or RVC pass casual listening tests consistently.

This doesn’t mean detection is impossible. It means the tells you can actually rely on have shifted from technical artefacts to behavioural patterns. And behavioural patterns are more reliable anyway, because they don’t improve with the technology.

What still works for detection in 2026

• Room acoustics test: Real phone calls have background noise, subtle room echo, slight compression artefacts. A cloned voice on a standard consumer setup often sounds acoustically too clean — like it was recorded in a studio. If a call sounds unusually pristine, that’s worth noting.
• Proper noun stumbles: Voice clones are trained on general audio, not on your specific business context. Unusual supplier names, niche industry terms, your street address, the name of a specific employee — a clone will often mispronounce or hesitate on these. Ask a question that requires the caller to use a specific name or term and listen carefully.
• The pause test: Real-time voice synthesis has latency. If you ask an unexpected question and there’s an unusual pause before the answer — longer than normal thinking time, slightly mechanical — it may indicate the system is processing. Try interrupting mid-sentence and see how naturally they recover.
• Off-script questions: Ask something deeply specific that only the real person would know. Not “what’s our bank account number” but “what did we decide about the Manchester project last Tuesday?” A clone has no context for your actual business history.

A finance employee joined a multi-person video call with colleagues and a senior executive he recognised. Everyone behaved normally. He was walked through a series of transfers totalling $25 million USD across 15 transactions. Every participant on screen was a real-time deepfake. The case was confirmed by Hong Kong police in February 2024 and remains the largest single-incident deepfake fraud on record.

What makes this case significant beyond the number: the employee was not naive or careless. He checked faces. He heard familiar voices. The attack worked because it correctly identified that humans trust visual and audio confirmation — and then fabricated both simultaneously.

• Defence: a mandatory callback rule requiring any payment authorisation from a video call to be confirmed via a separately-initiated phone call to a stored number

A UK marketing agency’s finance manager received a call from what sounded like her boss asking for an urgent supplier payment. Same voice. Same casual tone. Reference to a real client. The founder was on a flight. The voice was cloned from his LinkedIn videos and a podcast episode. £43,000 was wired to an overseas account and emptied within hours. No safe word existed. The money was not recovered. The cyber insurer declined the claim on the grounds that the employee had voluntarily authorised the transfer.

The attack required: one LinkedIn video (publicly accessible), one podcast clip (publicly accessible), and knowledge of one real client name (publicly accessible on the agency website). Total cost to the attacker: roughly £25 in ElevenLabs subscription fees.

• Defence: safe word protocol. One pre-agreed word the real founder could have said. The clone couldn’t.

An email arrived in the owner’s writing style warning the office manager to expect a call from their accountant. The call arrived an hour later — the accountant’s voice, cloned from a YouTube video — confirming a tax payment needed same-day processing. The email had pre-loaded credibility. The voice had authenticity. Together they produced a $28,000 authorised transfer. Neither would have worked alone.

This combination format — written primer followed by voice confirmation — became the most reported attack pattern in FBI IC3 data for H2 2025 specifically because it’s designed to defeat the single-channel scepticism that stops most simpler attempts.

• Defence: dual-channel verification. Call the accountant back on a stored number before processing anything. The real accountant picks up and confirms they made no such call. The attack collapses.