In early 2024, a finance employee in the Hong Kong office of engineering firm Arup joined a video conference that appeared to include the company's chief financial officer and several colleagues. After receiving instructions during the call, the employee authorized multiple transfers totaling roughly $25 million. The other apparent participants were synthetic representations. Seeing is no longer believing.

Many organizations have not yet translated that shift into their payment, personnel and incident response procedures. The hard problem with deepfakes is managing what happens in the minutes after someone believes one. 

What Deepfakes Changed

Synthetic media compresses the time between fabrication and harm. A convincing fake can now trigger a wire transfer, an employee suspension, a market moving rumor, or a viral political clip faster than any verification process can catch up. Three characteristics drive the risk. Ease: Synthetic content is inexpensive, rapid, and increasingly available as a service. Attackers can adapt voices, images, documents, and narratives during a live interaction rather than relying on a single prerecorded fake. Plausibility: Voice and video clones can satisfy the visual and auditory cues people have historically trusted. A convincing fake can override intuition. Attribution: Once a fake circulates, establishing its origin, determining how it was manipulated, and identifying who is responsible can be slow, expensive, and incomplete. Analysts have called this a growing threat to a shared baseline of truth.

The fakes are out there. The organization's exposure turns less on the existence of the fake than on the decisions made in response to it. That reframing moves deepfakes out of the security team’s inbox and into enterprise risk. The exposure lies in payment approvals, personnel investigations, public statements, access decisions, crisis communications, and, where the risk is material, established board-reporting and oversight structures.

Four Ways Deepfake Harms Reach the Enterprise

The same technology creates different legal problems depending on who gets fooled and what happens next.

1. Executive impersonation fraud. Cloned voices and video can induce employees to authorize payments or change account and access information. The same tools can support synthetic applicants, fabricated customer identities, and documents designed to defeat onboarding or authentication controls. The Treasury’s Financial Crimes Enforcement Network issued an alert in November 2024 warning that criminals use generative tools to impersonate executives, instruct employees to move funds, and defeat identity checks with synthetic documents. The Arup loss illustrates that playbook at scale.
2. Nonconsensual intimate imagery. Under the TAKE IT DOWN Act and certain state laws, these images can trigger criminal exposure for those who create or share them and removal obligations for the platforms that host them.
3. Election and political manipulation. Synthetic clips of candidates or officials can mislead voters or manufacture a scandal in the window before the truth catches up, a risk that has attracted sustained attention from law enforcement, election officials, platforms, and legislators.
4. Institutional overreaction. An HR team disciplines an employee, a security team disables critical access, or a communications team issues a public statement based on a recording that later proves synthetic. A fake may need to convince only one person with authority. Once that happens, the resulting disciplinary, operational, and reputational consequences may be hard to reverse. (The same authenticity problem follows a dispute into the courtroom, where synthetic media raises evidentiary questions that we have examined separately.)

The Legal Toolkit, and Its Seams

No single body of law governs synthetic media. Depending on the conduct and the resulting injury, a deepfake dispute may implicate state publicity and privacy rights, defamation, fraud, employment law, platform obligations, criminal prohibitions, and sector-specific regulation. Each addresses only part of the problem.

• Right of publicity and likeness. State publicity and related privacy laws — a familiar doctrine now being applied to new facts — may protect a person's name, image, likeness, or voice from unauthorized synthetic use, though scope and exceptions vary considerably by state. Tennessee's ELVIS Act, effective July 2024, added “voice” as a protected personal right and extends specified liability to technologies whose primary purpose or function is producing an individual’s voice without authorization. California enacted companion statutes restricting AI digital replicas of performers, though those statutes are tailored to performers and entertainment contexts rather than the general public.
• Defamation, false light, and fraud. Synthetic content that communicates a false and defamatory factual assertion or implication may support a defamation claim, subject to the ordinary requirements and constitutional defenses. Some jurisdictions also recognize false-light claims. Synthetic content used knowingly to obtain money or property may support fraud and related claims.
• Intimate image takedown duties. The TAKE IT DOWN Act, signed in May 2025, criminalizes nonconsensual intimate images, including AI "digital forgeries," and requires covered platforms to remove them within 48 hours of a valid request, with the FTC enforcing the platform provisions as of May 2026.
• Election statutes meeting the First Amendment. Several states passed deepfake-related elections laws, but they face real constitutional friction. In Kohls v. Bonta, a federal court held California's AB 2839 unconstitutional and permanently enjoined its enforcement, finding it imposed content, viewpoint and speaker-based restrictions on protected speech and failed strict scrutiny. The First Amendment materially constrains government regulation of political, satirical, and parodic synthetic media. Separately, Section 230 may limit efforts to treat an online service as the publisher or speaker of third-party content, though its application depends on the defendant’s role and the theory asserted. The NO FAKES Act of 2026, reported by the Senate Judiciary Committee in June 2026, would establish a federal right governing unauthorized digital replicas of an individual’s voice or visual likeness. It has not been enacted.

Why Organizations Keep Getting Caught

Deepfake losses often expose process gaps as much as technology gaps. The recurring failures:

• No out-of-band verification. High-risk requests, especially funds transfers, payment-detail changes, credential resets, and sensitive disclosures, are too often approved through the same channel in which the request arrives. A callback or other verification using independently maintained contact information, rather than contact information supplied with the request, materially reduces impersonation risk.
• No AI use policy for the functions that need it. Finance, marketing, HR, communications, executive support, and IT service desks may create or encounter synthetic media without clear rules governing likeness, disclosure, verification, or escalation.
• Limited provenance and evidence procedures. Organizations often lack a defined process for preserving the original file, associated metadata, communications, platform information, and internal decision history. That slows authentication and investigation, although provenance information alone may not conclusively establish whether content is genuine.
• Incident response plans that are too narrowly designed. Playbooks designed primarily for network intrusions and data breaches may not fit a fabricated video spreading on a Friday afternoon, particularly where no system compromise or personal-data breach has occurred. Many plans also fail to integrate legal, HR, finance, law enforcement, platform escalation, and crisis communications.

The through line is that deepfakes exploit weak identity verification and weak decision hygiene, not just weak firewalls. The essential control is independently verifying identity and authenticity before making a consequential decision based on a request, recording, or other digital content.

What Counsel Should Do Now

Treat synthetic media as an enterprise control problem and help structure the cross-functional response:

• Require independent, out-of-band verification for high-risk requests, using contact information and procedures established before the request arrives.
• Control when and how employee and executive voices, images, and digital replicas may be recorded, created, licensed, or used by vendors, and reflect those limits in contracts and internal policies.
• Update incident response plans to cover synthetic media, with named owners across finance, HR, legal, security, and communications, together with defined executive decision authority.
• Distinguish statutory takedown duties from response planning. Covered platforms should operationalize the TAKE IT DOWN Act's 48-hour process. Other organizations should build procedures for reporting content, preserving evidence, assisting affected individuals, and escalating to platforms and law enforcement.
• Train personnel authorized to move funds, change account or access information, disclose sensitive information, discipline employees, or speak publicly. Suspicious requests should route to verification and escalation, not immediate action.
• Review potentially implicated cyber, crime, social-engineering, media, E&O, EPLI, D&O, and other coverage, together with vendor indemnities, liability caps, notice requirements, and response-service rights. As we have discussed previously, deepfake-induced transfers and synthetic-media incidents may expose important gaps among crime, cyber, social-engineering, and emerging specialized coverage.

The Bottom Line

Detection is not the control. Verification is. Assume some synthetic content will evade initial detection. The goal is that no single message can trigger a consequential decision without independent verification.

The legal exposure is already here. Right-of-publicity, fraud, defamation, and the federal takedown regime apply now, even as election deepfake doctrine and proposed federal likeness rights keep developing.

For questions about deepfake risk, synthetic media incident response, and building an AI governance program, please contact the Jones Walker Privacy, Data Strategy and Artificial Intelligence team. Stay tuned and subscribe for continued insights from the AI Law and Policy Navigator.