In this episode of Sphere of Success, Aarti Samani, a global AI strategist and fraud prevention expert, uncovers the hidden threats posed by AI-powered fraud. Aarti shares real-world cases, including how a small bank executive was manipulated through deep fake emails and how AI-driven impersonation scams are leaving lasting psychological scars on victims. She reveals the invisible risks companies face daily and the urgent need for stronger security measures.
Beyond just identifying threats, Aarti provides actionable solutions for businesses of all sizes. Through her “Defending Against Deepfakes” masterclass, she equips organisations with practical strategies to recognise fraudulent AI-generated content, protect employees from manipulation, and build robust incident response plans. Her expertise has supported organisations like Mastercard, the UK Home Office, and the US Department of Homeland Security, proving that proactive defence is the best strategy.
Aarti discusses the growing risks of deepfake fraud for women CEOs, HR departments, and remote teams, and how cybercriminals are expanding their targets beyond large enterprises. Tune in to learn how to protect your business, safeguard your employees, and stay ahead of AI-driven fraud before it’s too late.
0:00 Introduction: The Rise of Deepfake Fraud
0:35 Deepfakes and CEO Fraud: A Growing Threat
3:05 Future-Proofing Your Business: Education and Assessments
5:39 Employee Training: Raising Awareness
7:23 Human Vulnerability: The Weakest Link
9:29 Psychological Impact: Beyond Financial Loss
14:47 Context is Key: Recognizing AI Manipulation
18:54 Balancing Trust and Curiosity in the Digital Age
23:36 Collaborative Approach: Protecting Your Organization
25:36 Certification and Ongoing Vigilance
29:30 Final Thoughts
Transcript
SPEAKERS
Aarti Samani, Speaker 1
Speaker 1 00:03
Hello everyone, and welcome to sphere of success, which is the podcast where we look at challenging adversity in business, and we look at that as opportunities to grow, for personal development, for opportunities to take on new ways of working and new methodologies to make sure that we don’t carry on with the behaviors that we’ve adopted before, to get the same results again, that we can move forward. And this is a very good topic to actually now segue into our amazing guest today, Aarti Samani. She is one of the leading voices within the generative AI and threat market, especially deepfake CEO fraud. She also is an expert in facial biometrics and has helped a number of organizations to help within that financial crime and fraud element, to make sure that they have a very robust, amazing system, but also from a personal human being perspective that everybody is aware of their part to play in combating potential AI deepfake CEO fraud, Aarti has worked with organizations such As Namira. She has worked with MasterCard. She’s been involved with the UK Home Office, the US Department of Homeland Security, many other well known, reputable government organizations, as well as commercial she is an absolutely amazing keynote speaker, highly sought after commentator within the media. She’s been interviewed by the BBC, and she is a thought leader in her work. She absolutely is there to help people to future proof the businesses to this ever growing threat that we see emerging within our markets. And of course, it changes and morphs very quickly. So it’s, how do we keep a pace of something that is moving so quickly? So Aarti, thank you for being on the show. It’s an absolute pleasure to have you here. Thank
Aarti Samani 02:13
you, Deborah, thank you for inviting me. I’m I’m really grateful that we are working so hard to drive this conversation forward, which is an very emerging threat vector that will impact everyone. So thank you for inviting me. I’m looking forward to our conversation.
Speaker 1 02:28
Me too. And as this is all about how we combat challenge and adversity, let’s dive in straight away, into a scenario where an organization has unfortunately been duped by one of these deepfake frauds. And I’d like you to if you can go through, obviously, from mentioning no names, a case study as to perhaps how you’ve helped an organization come from the ashes and rise to then take forward and move forward with their business in a positive and trustworthy way for all Yeah,
Aarti Samani 03:12
that’s great question. So firstly, the way the emerging AI threat are working is based on human manipulation. So where generative AI has really excelled over the past two years is in making the output AI generated output very much human like so suddenly we’ve been able to write copies, generate images, make videos, etc. And we are very proud that as humans, we have advanced the technology to the extent that it has human level ability of creation, reasoning, writing, etc. All very positive until it starts to be used for negative purposes, which is what happens in the context of AI deepfake fraud. So here the deepfake clone voice or a video doesn’t just appear randomly in your inbox. Mostly, it doesn’t just appear randomly in your inbox on a on a one fine day. It is done over a period of time. So there is a social engineering piece where you will receive emails which look very convincing, etc, then it the trust is further established with voice, with video or that. So it’s very much focuses on human manipulation. Now one of my clients, unfortunately had been a target of it, a small bank based in they have operations in Middle East, in Asia and in Europe, and they CEO was impersonated, and that deepfake video was then sent to one of the executives in the business and asked to follow certain instructions. Unfortunate incident for them. And then when they started. Working with me, we kind of went through and we unpicked what actually happened. So as I said, over a period of time, and it’s not a very long period, maybe over a week, they received these emails which look very real. There were red flags, but they never kind of executed or followed their gut instinct because of time zone differences, and that’s the other thing, they target organizations which have global operations so that they can be in different time zones. The impersonated executive and the executing victim are in different time zones, so they don’t often have the opportunity to cross check in real time, which is exactly what happened here. So we went through all that, and we unpicked, and we actually made a case study out of it, and we used that as a case study to then run the education program that I would normally run. So it brings home in a very real way, that, Oh, wow. So this is where our executive fell over. This is these are the telltale signs that they could have picked up on, but for whatever reasons, didn’t, and it’s not to blame them. It’s not their fault, but it’s so hyper realistic, it’s impossible to to be kind of forensic investigator and pick up on every piece. So when you run that as a case study, that then translates into protocol documents, which means that here is what we will never do. Okay? So, hey, team, we will never contact you on platform XYZ. We will never ask you for ABC. We will never use this kind of vocabulary, etc. So you kind of start to build almost a repository or a playbook and indicators that your people can look out for, which tells them that this is definitely you or this is almost definitely not you. So we did that exercise, and this is how I help organization post incident of course, then we tighten up the incidence response plan and make sure that, should this happen in the future, we hope it would never again happen. But should it happen that we would respond differently, and therefore, at least the damages more contained than than it was the first time. And
Speaker 1 07:16
you’ve mentioned the human element of it, and as human beings, we have feelings putting myself into the person’s shoes that for fell foul of the scan and actually then made the transaction psychologically. What does it feel like? What feedback do you get from the people that have been unfortunately unwittingly taken advantage of.
Aarti Samani 07:45
Yeah, awful. So first in the first instance, it’s paramount to protect the identity of that individual and allow them time and give them support to come to terms with what has just happened to them, because although the organization was targeted, an individual has been used as a pawn to execute the attack, right? That’s how it works. And so you have to make sure that they understand that they are not blamed for whatever has happened. It is unfortunate, but it is not their fault. They followed all the instructions, etc, make sure they have the support they need in terms of counseling or conversations or whatever is required, time off, and then their identity is protected so they are not worried about other employees pointing a finger at them and sort of, you know, feeling a bit embarrassed, belittled, etc. So that’s the first thing. But on a on a more wider basis, the implication on their mental health is really much deeper than anyone realizes. And I call it the invisible scars of deepfake fraud. Because you feel you feel so stupid. You feel like, oh my goodness, why did I not recognize that this is not a real human and reality you can’t recognize because, by design, it is so hyper realistic. But you feel stupid. You feel betrayed that somebody betrayed your trust like you trusted this video, and you don’t know who betrayed your trust, because it is a deepfake video. It is not an individual, right? It’s a gang of people behind there. You don’t even know where in the world they are operating from, but you feel that very human emotion of betrayal, of yeah, it’s just, it just scars you for a long time. So the mental health implications are deep. And I always, when I work with organizations, I always work with the people, the Human Resources team, to make sure that even that is part of the incident response plan. So incident response is not just about external. Response. It is about internal response as well. And then the rest of the staff are spooked out, because now suddenly they think, Oh no, what if I’m one of these people who falls into this trap? And so suddenly you’ve got this culture of everything is being questioned, and it goes to the other end of the spectrum, right? And then you have to dial it back and bring it to a more balanced security posture, rather than sort of always at a very heightened red alert level, right? You You have to create tiers and levels. So yeah, the implications go run far deeper than people realize and
Speaker 1 10:41
with the fact that you perhaps are the CEO or the person that has been targeted to have their identity stolen, how does that come across for them? What feelings do they have that then affect the way that they perhaps are going to use their judgment in your future,
Aarti Samani 11:04
high paranoia, paranoia because you imagine if you have been impersonated once. That means someone out in the wild has your video, your voice, some personal information about you, they have a level of information about you that you didn’t want them to have. You also feel like you’ve lost agency over where and how your face and your voice is depicted and utilized, right? And you start to worry about your loved ones and your family, because it’s not just even though, in this instance, your impersonation was used to target your organization or your employees. Very easily, that impersonation could be targeting your wife and your children, right, or your elderly parents. So you start to worry about these implications. And now we there is the boundary between our personal and professional environment is so blurred, you kind of, you’re almost easily sort of, going from one to the other, right? So it’s not that okay, this box and this attack is only in my business environment, and my personal life is protected and safe. It’s so is not so you suddenly, you worry about that too. You all now the new emerging vector is to do the extortion threat, so using an executive’s deepfake showing them in very compromising situation to extract money by threatening them of reputation damage. Now imagine if you’re a woman executive, if you’re a woman CEO, the implication of that is just so high, like I can’t even imagine how it must feel if that would happen to me. It just it’s terrible because your professional life is impacted so much. There was actually a case recently in the Midlands in UK where a woman who was canvassing during the election, she was caught on the video doorbells when she was canvassing, somebody manipulated the video that was captured from the doorbell showed her in a compromising position, and she was actually a school teacher by profession, and it implicated her job as a school teacher. So she was then removed from teaching. She had to go into hiding. She was receiving threats from parents of the students she was teaching, etc. So it it is just like, I can’t even begin to tell you just how far these implications go. If you have been a target as an executive, because you are an individual, you’re not just an executive, you’re also an individual.
Speaker 1 13:59
Thank you. And thinking about how we can then move from that challenge, as difficult as it is, what can your business do to help people get back onto the right footing and move forward in a robust, trusting and eager way, as swiftly as is appropriate, to be able to help them on their journey.
Aarti Samani 14:35
Yeah, sure. So my business works with businesses only. I don’t work with individuals directly in their personal capacity, but in the business to business capacity, we we do what I described earlier, which is create a case study, protocols, response plans, etc, and we. Help that executive to kind of create a brand. So we work with their marketing teams to create a very specific brand about them. We work with again, with their team to check their digital footprint, make sure that it’s taken down. If they deploy investigators, fraud investigators, then we work with them to help them with the forensic analysis, etc, but it is I always encourage them to seek professional help in their personal capacity, either through sort of mental wellness programs or through counselors or advisors.
Speaker 1 15:42
And with that in mind, you’re helping organizations, could you unpack that as to how you help them then to get back onto the right footing?
Aarti Samani 15:54
So we were by working with their marketing team, specifically, we kind of clear up their digital footprints or remove all the rogue information, data, videos, etc, there may be lying around on internet about them. So there’s kind of the hygiene piece. Then we work to say, Okay, what kind of a brand do we want to create around this individual which is recognizable and very much ties in with their with their personalities, so the authenticity, etc. We can also work with their PR agencies to put out statements which are very much kind of look, I’m coming forward in a very authentic manner in a bid to make sure this doesn’t happen to other people, to watch out. So it’s kind of, you know, putting yourself, it’s almost counterintuitive. You want to recede from limelight, but sometimes you have to put yourself out there in order to own the story and own the narrative. So in their own time, whenever they’re comfortable, we do that, and that gradually kind of brings the confidence in them back, but also raises the confidence of the whole organization in their executive and
Speaker 1 17:08
with the people who have been the and they’ve executed this. So they’ve been well, they haven’t been targeted. But it was then that was, unfortunately in the firing line. How can you help the team and the individual, not from a, you know, from a counseling perspective, but to be able to work with that organization to make sure that that is less likely to happen in the future?
Aarti Samani 17:35
Yeah, so in that instance, we we do a lot of work with the HR team or the people team in the culture aspect of it. So we work directly with that individual, if and when they feel comfortable and their immediate team members to say, Okay, what about the business culture would have allowed them to question the instructions, or to stop and think about it, or to not feel pressured to go and execute it. What about the business environment would help them feel psychologically safe, to have these conversations openly, to treat each other’s digital interactions with curiosity and with caution. So it’s a lot of kind of culture related work that we have to do with them, which is, again, it’s not directly technology, but more kind of processes and people related work.
Speaker 1 18:30
And when you’re working with a business, how visible Are you within the business with regards to the work that you do?
Aarti Samani 18:40
So that varies by the business itself. So sometimes very visible, I would be the individual who’s facilitating these conversations, who is very much in in all the gatherings where we are opening these dialogs, etc. In some cases, they want it to be they wanted to feel safe and have an internal conversation, in which case I’m working behind the scenes, where I’m preparing a playbook, almost like a script, on how they should open these dialogs and conversations with their team, what they should do with the feedback, how they synthesize and process The feedback, and therefore, more importantly, what actions, visible actions they need to be taking in order to make the team feel confident and build build that confidence and trust in the team. And would you
Speaker 1 19:32
say that there is a particular sector, a type of company, that is more likely to be targeted than another, or are we talking a broad brush?
Aarti Samani 19:44
Yeah, interesting. You should ask that just last night, I was putting a spreadsheet together of all the deepfake, publicly known deepfake fraud attacks that have taken place in the past 18 months, and they range from a 10. 10 people organization, to 30,000 40,000 people organization, and the prediction is that this year 2025, we’ll see a higher rate of SMEs, small and medium sized businesses being targeted. And the reason is because they are naive in the sense that they are not aware of these emerging threats, and that they don’t always have the budget or the time to put very robust security defenses in place. So it is really broad brush. And then the type of sectors we’ve seen financial services, we’ve seen engineering firms, we’ve seen infrastructure, we’ve seen consulting firms. It’s literally like solopreneurs. It feels like it’s merciless. It targets everyone. It’s unstoppable. And it’s also important to understand that it’s not they are not always after money. They are often using an individual or the organization as a gateway to get to something else. Now in the case of this remote worker, that remote worker deepfake remote worker, was not after money. They were after information. So once they were on the payroll, they were able to access security systems and get information which was then passed on to someone else, someone else in order to execute some other type of fraud. In some cases, we have seen that perpetrators want to get into your client database, because through your client database, they can then target those organizations, especially if you’re serving public sector agencies, or if you’re serving some large organizations. So it’s really the motivation, contrary to popular belief, is not always money. A lot of the times, it is much bigger motivation and you, they don’t even care about you. They just care about who you’re working with and how, through you, they can get to those people or those companies.
Speaker 1 22:07
And so would you say, then, with that in mind, that some of these fraud attempts go through unnoticed?
Aarti Samani 22:15
Yeah, yeah, absolutely. So there is a report that says that $7 million or a figure somewhere close to that, was lost to remote worker fraud in United States last year because they did not know for a long time that a perpetrator was unknowingly employed in the organization, and they were then passing a lot of the information out to other gangs in different parts of the world, because, again, they were not there for money. So they and they always they been shown to be working very hard and very diligently and deliver results. So when they become part of your, part of your fabric, part of your organizational fabric, you don’t know they exist until it’s quite late. Sometimes industrial
Speaker 1 23:11
espionage. I mean, it’s, it’s, I think we’re just talking the tip of the iceberg, to be fair, because, as you say, very it’s happening more and more that with people like yourself and the job that you do, and the work that you do, the valuable work that you do is helping people to pinpoint these but a lot of times you’ve got somebody in your organization that you would never know was data mining for information, because they’re going across Different platforms, etc, and getting data
Aarti Samani 23:40
exactly? Yeah, it’s now a whole emerging conversation in security circles around insider threats and how these insider threats are changing from what they were in the past. So, yeah, it’s just, it’s just relentless right now,
Speaker 1 23:59
and with regards to people not necessarily being based in the office as they were pre COVID, how does that dynamic, the working from home dynamic? How does that change the way in which you’re assisting your clients to keep abreast of this potential threat and involving the human beings within the company, even if they’re working from home, how do you make sure that that all works together?
Aarti Samani 24:31
It’s so tricky that is really, really tricky, because if you, if you’ve already been with the business a number of years, they know you. They’ve met you in person. You’re clearly a real human being. There is less I don’t say there is no threat. There is less problem. And the reason I say less, but not no problem, is because I’m working from home. I have a personal. Five. I’m interacting on other channels and other platforms with unknown people, potentially, right? I’m I’m interacting with people on LinkedIn whom I may have never met in person. You and I have never met in person, right? So, but I feel like I know you. I’ve known you for I feel like I’ve known you for a long time, but you just never know. So inevitably, every employee who is working remotely, even if they’re not working remotely, they are becoming a liability for the company, just because our footprint, our digital footprint, is expanding, and every platform we interact with becomes a potential attack surface. What can you do about it? And what I what I do about it is, again, drive home this awareness, the education piece that, hey, look, you are all good people. There is no reason to not trust people, because at heart, every human being is a good human being, mostly, but they unknowingly fall into the trap and become a liability for other people around them. It’s like my friends WhatsApp account was hacked and I started receiving messages from the scammer to say, Hey, I’m struggling. Can you transfer 200 pounds and help me out? I promise I will return it. And I’m thinking, It’s my friend, right? And it’s not. It’s the hacker who’s doing this. You are literally vulnerable on every surface that you go. And again, I use that as an example to say, look, if in the morning, I was on a school run, getting late to get to work, answering emails like when I’m multitasking, I would have just given my code that they’re asking me on WhatsApp. I wouldn’t have stopped to think. But I have to follow my own advice and say, okay, just take a 32nd break, take a deep breath and figure out, should I be responding to this or not? So I keep I keep drumming that same message. I keep bringing home that same message about just take a pause. Take contextual and critical thinking. Be aware of the context in which you’re operating, whether you’re remote or in person or professional or personal, like whatever matrix you’re operating in, just don’t rush. And for leaders, I always advise, like, let’s we have to move away from that expectation of nail real time response. You know, with the onset of messaging apps, you know, Slack and others, you type a message and you expect someone to come back to you in almost real time. And that’s a problem, because if there is the expectation of a fast response, of a 24/7, response time, you are not allowing them time to think properly. You’re not allowing them time to rest their brains. And it’s that like hyper alert the whole time doesn’t serve anyone.
Speaker 1 28:06
Aarti, you’ve you’ve spoken very eloquently and given us so much value here today. I thank you for your insight. And what I would say to people is, please do have a chat with Aarti, whether you’re an owner manager, solopreneur, whether you have a large organization with global footprint, Aarti can help at whatever level of business that you are in. And she’s a very, very expert and very well read within her own sector, and she’s keeping ahead of the latest challenges. So you can always rest assured that even if you don’t have the department yourself that can keep track of all this art is somebody who can actually give you information which is current, up to date, so that you can future proof your business. Aarti, how can people get hold of you? I’m
Aarti Samani 28:59
very findable on LinkedIn. Just search for Aarti Samani, and my LinkedIn alias is also Aarti Samani, that has my email address, my website and all the contact information. So please reach out to me, email me, send me a note on LinkedIn. I’d be very happy to have a conversation and help wherever I can.
Speaker 1 29:20
That’s wonderful. So yes, and all the details as well, just in case you need them, are going to be on the show, notes on the description when we when we post that as well. Aarti, thank you. It’s been an absolute privilege to have you on the show. Thank
Aarti Samani 29:33
you, Deborah, for inviting me. Thank you for helping me to drive this very important message to as many people as we can get to. I really appreciate
Speaker 1 29:41
it absolutely. Thank you so much. And for everybody listening, this is such an important message. Let’s enjoy this wonderful technology that’s coming out to help us, but let’s also have this cautionary element of being professionally curious about what’s going on. How that sits. If we think that we are open to threat, let’s get that circle closed. Have a chat with Aarti. Also, if we feel that we have vulnerabilities and that people themselves within our organization can do with some very, very up to the minute training. Again, Aarti is definitely your person. So until next time, thanks as always, like, comment, subscribe and share this as well, because I’m sure there will be people in your network that would really benefit from having a listen to this wonderful episode of the podcast. Thanks, everybody. See you all going very, very soon. Bye. Bye. Now you.