A finance employee joins a routine video call, sees the CFO and several colleagues on screen, and approves a string of urgent transfers. Every face on that call was generated by AI. This is not a prediction about the future; it is how fraud already works in 2026, and attackers are no longer aiming only at large corporations. Small and medium businesses now sit squarely in the crosshairs, and the encouraging news is that a practical defense costs far less than most owners expect.
What AI deepfake fraud looks like in 2026
Deepfake fraud is the use of synthetic audio, video, or images to impersonate someone the victim trusts. In 2026 the most common forms hitting businesses are voice clones of a manager asking staff to move money, fake video calls where senior executives appear live on screen, and classic business email compromise supercharged by AI that writes flawless messages and copies a real writing style. According to Vectra AI, one widely reported case saw a finance worker complete 15 transactions worth 25.6 million dollars after a video meeting in which every participant, including the apparent CFO, was a deepfake.
The techniques keep escalating. At a recent seminar hosted by the National Cyber Security Association and Mobifone, covered by congan.com.vn, specialists described how impersonation has moved from simple photo matching, to prerecorded video, and now to video injection attacks that feed a fake stream straight into a verification system. Attackers rarely try to beat your entire defense. They find the weakest link, usually a rushed or trusting employee, and use urgency to push a transaction through before anyone verifies it.
Why small and medium businesses are now the main target
For years, deepfake fraud felt like a big company problem. That has changed. Large enterprises invested in fraud teams and layered verification, so criminals shifted down market to businesses with real cash flow but thin security. A restaurant group, a property agency, a clinic, or an online shop can move tens of thousands of dollars a week, often approved by one or two people over chat and phone. That is exactly the profile attackers want.
Ransomware as a service and cheap voice cloning tools have lowered the bar even further. A convincing voice clone can be built from a short sample of public audio, and your team leaves that audio everywhere: webinars, social videos, voice messages. The State Bank of Vietnam has pushed biometric checks and its SIMO risk monitoring system hard, and reports that early warnings helped more than 831,000 customers pause risky transactions and prevented an estimated 3,060 billion dong in potential losses. That is reassuring at the banking layer, but the gap inside ordinary businesses, where a staff member simply trusts a familiar voice, remains wide open.
The numbers tell the story
The scale is no longer small. Deloitte expects that fraud losses enabled by AI in the United States could reach 40 billion dollars a year by 2027. The FBI Internet Crime Complaint Center logged more than 22,000 complaints tied to AI fraud in its 2025 report, with over 893 million dollars in losses, while business email compromise alone cost American victims more than 3 billion dollars. Keepnet Labs measured deepfake voice phishing rising by more than 1,600 percent in a single quarter.
The damage lands on ordinary companies, not only banks. In the IRONSCALES 2025 survey, more than half of organizations reported financial losses from deepfake or AI voice fraud in the past year, with average losses above 280,000 dollars and nearly one in five losing 500,000 dollars or more. Gartner expects that by 2026 roughly 30 percent of enterprises will no longer trust identity verification on its own. In Vietnam the warning signs are already loud: recent reporting describes a bank chairman deceived by a deepfake into transferring more than 100 million dollars abroad, and a separate deepfake scheme that drained 95 million euros, both surfacing just as the pre Tet fraud season begins.
At Webie we have handled more than 100 cases of hacked sites, unauthorized access, spam traffic, and DDoS pressure, and recovery runs anywhere from 24 hours to 7 days depending on the damage. Our process is always the same: inspect, isolate the affected area, pinpoint the fault, back up, apply the fix, then build a clean backup before we hand the site back to the client. The same discipline applies to deepfake and impersonation risk. We stay wary of strange links from domains with no reputation, of messages that fish for personal or security details, and of urgent requests that arrive outside office hours. For an SME the first move is simple: harden every account, and keep an offline backup of anything critical so you can fall back on it in an emergency. (Duy Tran, Webie)
A defense playbook you can start this week
You do not need an enterprise security budget to cut your risk sharply. Most effective controls are about process and habit, not expensive software. Here is a tiered plan, drawn from guidance compiled by the Forbes Technology Council and echoed by Vietnamese security specialists, that an SME can roll out in days.
Controls that cost nothing
- Agree on a verification codeword for any money or credential request, keep it out of email and chat, and confirm payment changes on a phone number you already know.
- Require second channel confirmation: if a request arrives by email, verify it by phone or in person, and never the reverse on the attacker’s terms.
- Ask your bank to enforce dual approval on outbound payments, set transfer limits, and add debit filters, which are usually free.
- Set clear rules for unusual requests: any demand for secrecy, extreme urgency, out of hours timing, or a sudden change of bank account is treated as suspicious by default.
Low cost technical controls
- Turn on multifactor authentication everywhere, and prefer passkeys over SMS codes for your email, your bank, and your domain registrar.
- Add SPF, DKIM, and DMARC records to your company domain so spoofed email is harder to send in your name.
- Label external emails automatically and audit mailbox forwarding rules every month to catch silent redirects.
- Apply least privilege: remove admin rights nobody needs and separate everyday accounts from privileged ones.
People and response
- Train every employee, not only finance, to recognize deepfake pressure tactics, and reward the person who pauses to verify rather than the one who acts fast.
- Write a one page response plan with your bank’s fraud line and IT contact stored outside company email, and rehearse reporting a mistake without blame.
- Shrink your public exposure: limit how much executive voice and video sits publicly online where it can feed a clone.
Is this request a deepfake? A quick decision table
When a payment or data request feels even slightly off, run it through this table before you act.
| Red flag | What it looks like | Your move |
|---|---|---|
| Extreme urgency | Pay now, the deal closes in minutes, the boss is boarding a flight | Slow down and verify on a known channel |
| Secrecy | Keep this confidential, do not tell the team | Treat secrecy as a reason to escalate, not to comply |
| New account | Same vendor, suddenly a different bank account | Call the vendor on a saved number before paying |
| Odd channel | A request through an app or number never used before | Confirm through your normal, verified channel |
| Off hours | A transfer requested at night or during a holiday | Apply the full verification process, with no exceptions |
What this means for Vietnamese SMEs heading into Tet
Fraud always spikes around Tet, when cash moves fast and teams are stretched thin, and 2026 adds AI powered impersonation to the usual flood of fake invoices and tax notices. The businesses that stay safe are not the ones with the biggest security spend; they are the ones with simple, enforced habits. At Webie we help SMEs harden the practical layer that attackers actually hit: website and WordPress security, hosting and maintenance, and the internal process and tools that keep approvals honest. If you want a calm second opinion on where your business is exposed, that is exactly the kind of digital transformation groundwork our team handles every day. You can see the full picture of what we cover on our services page.
Frequently asked questions
How can a small business spot a deepfake video call?
Look for unnatural pauses, lip movement that lags the audio, flat lighting on the face, and reluctance to do a simple live action such as turning the head or holding up a hand. The most reliable check is not visual at all: end the call and confirm the request through a channel you already trust before you move any money.
Do we need expensive detection software to be protected?
No. The single most effective defense is a verification habit that costs nothing: confirm every sensitive request through a second, known channel. Detection tools can help larger teams, but for most SMEs, a clear process, multifactor authentication, and staff awareness stop the vast majority of attacks.
What should we do first if we suspect we have been targeted?
Stop the transaction and contact your bank’s fraud line immediately, because fast action improves the odds of recovering funds. Then preserve the evidence, such as call records and messages, report the incident to the authorities, and review how the request reached you so you can close that gap.
Want help turning this checklist into a process your team will actually follow? Talk to Webie for a free consultation on securing your website, your systems, and your payment workflow. Call +84 969 838 467 or email huyen.dang@webie.com.vn.
