Newsroom · Eterna-owned guide
How AI Impersonation Can Damage Personal and Business Reputation
A cloned face and voice were enough to move $25.6 million in one real case. Here's how AI impersonation damages both individuals and organizations, and what actually helps.
Impersonation network
A founder starts getting messages from people he's never met, asking why he's promoting a cryptocurrency investment scheme. He isn't. Somewhere online, there's a video of his face and his voice, cloned convincingly enough that people who follow his actual work believed it was really him, and some of them sent money before anyone figured out what was happening.
This specific pattern, a cloned face and voice used to lend credibility to a scam, has become common enough that it's no longer a hypothetical. Public figures, executives and creators have all had their likeness used this way, and the damage doesn't stop with the people who were defrauded. It extends to everyone who now associates that person's face with a scam they had nothing to do with.
Two different kinds of damage, from the same underlying problem
AI impersonation causes harm in two distinct ways, and understanding which one applies to a given situation shapes how it should be handled.
Direct fraud, where the impersonation is the mechanism of the crime itself. In one of the most thoroughly documented cases, a finance employee at Arup, the global engineering firm, joined what appeared to be a video call with the company's CFO and several other colleagues, all discussing a confidential transaction. Every person on that call except the employee was a deepfake, generated from publicly available conference footage and video calls. Believing the instructions were genuine, the employee authorized 15 wire transfers totaling roughly $25.6 million before anyone realized what had happened. No single element of the scam was especially exotic, it worked because the video and audio were convincing enough, and the social pressure of a multi-person call was enough, to make normal verification feel unnecessary.
Reputational contamination, where the impersonated person did nothing wrong but is now associated with something harmful by proxy, a fake endorsement, a fabricated statement, a scheme they were never part of. This is the founder-and-crypto-scam pattern, and it's just as damaging to the actual person even though they were never the one being defrauded. Their name and face become attached to something they'd never approve of, and that association can persist in search results and social discussion long after the specific scam has been shut down.
Both patterns are growing for the same underlying reason: the material needed to generate a convincing impersonation, public photos, conference talks, earnings calls, interview clips, is exactly the kind of content that visible professionals and organizations are expected to produce as part of doing business.
Why executives specifically are increasingly targeted
Executives make efficient targets for a few compounding reasons. They typically have substantial public video and audio available, earnings calls, conference keynotes, media interviews, which is ideal training material for voice and face cloning. Their communications carry organizational authority, so a convincing impersonation doesn't need to persuade a stranger; it needs to persuade an employee who already takes instructions from that person as a matter of course. And the financial upside for an attacker scales with the size of the organization, which makes larger companies proportionally more attractive targets despite typically having more security resources.
How this spreads past the initial incident
A fraud attempt that fails, or a fake endorsement that gets caught early, doesn't necessarily stay contained. Screenshots and video clips get reshared as warnings, as news coverage, or simply as viral content, which means the same footage used in the original scam can keep circulating, sometimes stripped of the context that it was fraudulent in the first place. Someone encountering a reshared clip months later, without the original correction attached, may have no way of knowing it was ever debunked.
What people commonly get wrong
The most common mistake in the fraud scenario is treating a video call, on its own, as sufficient verification for a high-stakes request. Video and voice used to be reliable proof of identity precisely because they were hard to fake convincingly; that assumption no longer holds, and processes built around it, particularly for financial transactions, need an independent verification step that doesn't rely on video or voice alone.
The most common mistake in the reputational-contamination scenario is assuming that a quick correction fully resolves the problem. It reduces the damage, but copies, screenshots and reposts of the original fake content can persist independently of any correction, especially once it's spread beyond the platform where it first appeared.
What to do about it
On the fraud-prevention side, the most effective single change organizations can make is requiring a second, independent verification channel for any high-value request, a callback to a known number, a pre-agreed code phrase, or an in-person confirmation , before video or voice alone is treated as sufficient authorization, regardless of how senior the person on the call appears to be.
On the reputational side, the approach mirrors what Someone Made a Deepfake of Me, What Should I Do? covers: preserve evidence, report through the platform's specific impersonation or synthetic-media policy, and correct the record clearly and factually rather than reactively.
When professional help may be needed
Organizational fraud attempts involving impersonation typically warrant immediate involvement of security and legal teams, given the financial and evidentiary stakes. Reputational-contamination cases tend to need outside help once the content is circulating across multiple platforms, being actively used in ongoing scams targeting other people, or requires the kind of sustained monitoring and evidence preservation that a one-time internal response doesn't cover.
How long-term protection actually works
For organizations, this means building verification steps into financial and operational processes that don't rely solely on video or voice, a process change, not just a technology purchase. For individuals and public-facing professionals, it means combining response readiness (knowing what to do if impersonation happens) with ongoing monitoring, so an impersonation attempt is caught while it's still limited rather than after it's already reached a wide audience. Eterna's own approach to this pairs continuous monitoring with a verification standard applied before anything is treated as confirmed, which matters particularly here, since acting on an unverified report of impersonation can itself cause reputational harm if the report turns out to be mistaken.
FAQ
How common is deepfake-based fraud against businesses? Documented cases like the Arup incident show it's a real and growing threat, though comprehensive industry-wide figures are still developing as reporting standards mature. Organizations should treat it as a realistic risk to plan for, not a rare edge case.
Can video calls still be trusted for business decisions? Video calls remain useful, but for high-stakes decisions, particularly financial transactions, they should be paired with an independent verification step that doesn't rely on the video or audio itself.
What should I do if I find a fake endorsement using my face or voice? Treat it the same as any deepfake impersonation: preserve evidence, report through the platform's specific policy, and correct the record.
Is this only a risk for large companies and famous people? No. Smaller organizations and less-famous professionals are targeted too, sometimes precisely because they have fewer resources dedicated to catching it early.
Sources
- CNN Business, "Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee" (cnn.com, May 2024).
- FBI Internet Crime Complaint Center, PSA on generative AI and financial fraud (ic3.gov, PSA241203).
Related reading
Someone Made a Deepfake of Me, What Should I Do?
The ordered first steps for correcting the record.
Deepfake Reuploads: Why Harmful Content Can Return After Removal
Why a correction or takedown rarely ends a contamination case.
The Impersonation Response Guide
The fuller sequence once evidence is preserved and reported.
AI Impersonation Protection
Eterna's evidence-led approach to fake profiles, cloned voices and identity misuse.