## 3 Deepfake Technologies and the Emergence of Deepfake-Driven Social Engineering
### Case Studies and the Implications of Deepfake-Driven Social Engineering  
One of the more prominent cases of the application of deepfake-driven social engineering is the case of Russian President [PERSON]. A deepfake AI-generated avatar of [PERSON] was engaging with the public on sensitive topics, including the perils of AI and neural networks. This deepfake created by a student from St. Petersburg was so realistic that for a moment, it blurred the line between reality and illusion [18]. Another example of deepfake-driven social engineering was a case of [PERSON] declaring mobilization on state TV [19]. This case further demonstrates the potential societal implications of deepfake technology when employed by malicious actors. Both cases became talking points during our set of interviews on deepfake-driven social engineering with various corporations. This could underline how such sophisticated deepfakes may take advantage of trust in leadership and credibility. The interviews highlighted several implications for corporations. These include reputational damage, erosion of trust in official communications, and the rapid dissemination of misinformation via social media. These findings demonstrated how quickly a deepfake incident can go viral, influencing public opinion, corporate stability, or financial markets. Especially in an era where even a few believers can easily spread disinformation as genuine, this impact is magnified. A close analysis of these events underscores the critical importance of robust mechanisms, increased public awareness, and strategic corporate defenses in addressing these emerging technological threats [18]. In addition to political incidents, such as the deepfakes involving Russian President [PERSON], there have been notable real-world cases of corporate deepfake-driven social engineering attacks, which emphasize the immediate risks faced by companies. In addition to these high-profile political examples, there have been other instances targeting corporations. For example, a case reported by [PERSON] [20] in _Forbes_ describes how a voice deepfake was used to trick a CEO out of about USD 243,000. During this incident, the scammer used AI voice-mimicking technology to impersonate the CEO of the German parent company of a UK-based energy firm. The attack chain happened over several phone calls:  
1. **Initial contact:** The scammer first called the CEO, imitating the superior's voice and instructing an immediate transfer of EUR 220,000 (approximately USD 243,000) to a Hungarian supplier. 2. **Follow-up and reimbursement claim:** A second call was made to falsely claim that the payment had been reimbursed. 3. **Suspicion triggered:** On a third call--made from an Austrian phone number--the CEO grew suspicious when the promised reimbursement did not materialize. At this point, the fraudulent chain was interrupted, although the initial transfer had already been executed. Another case reported by CNN [21] highlights an example of deepfake-driven fraud in the corporate world. In this incident, a finance worker at a global company was tricked into approving a financial transfer of about USD 25 million during a video conference call. The worker believed he was participating in a video call with several colleagues, but in reality, all of the participants were deepfakes. According to Hong Kong police, the scammers used deepfake technology to impersonate the company's CFO, among others. Initially, the worker received a message that was supposedly from the UK-based CFO, telling him to carry out an urgent money transfer. The finance worker was convinced by the realistic video feeds and voices on the call and authorized the transfer of HKD 200 million (amounting to about USD 25.6 million). The scam was only discovered when the employee later had the transaction verified with the head office of the company. This case shows how attackers can exploit trusted communication channels using deepfakes to bypass the standard verification processes, exposing critical gaps in current corporate security systems.