DeepExpose
Impersonation threat research
What recent fraud data says about people posing as executives, and how each part of a DeepExpose scan maps to a real attack. Reviewed October 2026.
These are reported losses. The FBI tied more than $30 million of 2025 BEC losses to a confirmed AI element. The true share is unknown, because victims often can't tell whether AI was involved.
How the attacks work
Without enforced SPF and DMARC, anyone can send mail that appears to come from your CEO. DeepExpose reads your records and scores how easily a forged message would be delivered.
Attackers register names one typo away from yours and write to staff and suppliers from them. DeepExpose generates typo variants and shows which appear to be unregistered.
Interviews, webinars and conference talks give attackers clean audio and video. The Arup deepfakes were built from public footage of its executives. DeepExpose finds a leader's public recordings and rates how usable they are.
In both of the large cases above, payments went out on the strength of a voice or a face on a call. Urgency, secrecy and a request to skip the usual steps are the common signs.
What stops them
- Enforce DMARC at reject and end your SPF record with -all.
- Call back on a number from your own records before acting on any new or changed payment instruction.
- Require two approvers for large transfers, so no single call can release funds.
- Never treat a voice or a video call as proof of identity on its own.
- Register obvious lookalike domains and watch for new ones.
- Limit clean public audio and video of finance and executive staff where you can.