A deepfake can trigger financial fraud, damage a leader’s image and cast doubt on everything a company communicates. When voice and image stop serving as proof, protecting reputation requires more than detecting false content. It requires preparing the organization to verify, decide and respond under pressure.
The risk is already real. In Hong Kong, a company lost around US$25 million after an employee joined a video conference with fake representations of company executives created using deepfake technology. In Brazil, Itaú Unibanco CEO Milton Maluhy Filho’s image was used in a fake video promoting a fraudulent investment platform. Celebrities and brands have also been associated with nonexistent advertisements and offers.
These incidents show that a digital identity crisis is not solely an information security issue. It involves compliance, legal teams, communications, leadership and everyone who may receive a question, report or attempted contact made in the organization’s name.
When image and voice stop being proof
For a long time, seeing a leader on video or hearing their voice seemed enough to confirm a message’s authenticity. Artificial intelligence has weakened that confidence. Synthetic content is more accessible, convincing and easy to distribute, while verification still requires context, reliable sources and time.
The reputational problem is not just making a forgery look real. It also makes audiences more willing to doubt what is real. The World Economic Forum’s Global Risks Report 2026 addresses disinformation as part of a wider erosion of trust. In this environment, an organization may need to prove quickly that a message is false, or that a genuine communication really is its own.
Crises do not begin when they reach the press or social media
They emerge when an operational, institutional or human risk starts threatening trust, legitimacy or business continuity. A deepfake may circulate externally, but the ability to respond depends on decisions made long before.
Preparation begins with strategically engaging and developing the internal participants in a crisis, from board members to the company’s reception team. Everyone needs to understand their role: who identifies the alert, who verifies, who decides, who communicates and who tracks developments.
Next, identify vulnerabilities, scenarios and critical audiences. This includes mapping where videos, voices and images of leaders are published; which channels are officially recognized; who can confirm the authenticity of content; and which decisions require senior leadership’s immediate involvement.
The response protocol
A manual stored in a folder does not prepare an organization to act. The response must be embedded in tested protocols, decision flows, messages, spokesperson arrangements and processes. When a deepfake is suspected, five actions must work together:
- Detect: quickly identify the content, its apparent origin and how fast it is circulating.
- Verify: involve information security, legal teams and internal sources able to confirm or challenge authenticity.
- Decide: assess risks, affected audiences and the appropriate level of response.
- Communicate: use recognized channels, direct language and verifiable evidence, adapting the message for employees, customers, the press, partners and authorities.
- Monitor: track reactions, questions and new versions of the content to adjust the response.
Speed matters, but speed without governance can create a second crisis. The organization must be able to act early without communicating before it understands what happened.
Official channels and trusted relationships
In an uncertain environment, audiences and journalists need to know where to find an official account. The website, newsroom, verified profiles and internal channels should function as a coherent network. Contradictory or outdated information weakens the ability to challenge a forgery.
Relationships built before the crisis are also decisive. A journalist who knows the organization and whom to contact is better placed to verify content before publishing it. Accumulated trust cannot prevent an attack, but it can reduce its ability to gain legitimacy.
Technology helps, but metadata cannot give an interview
Content credentials and provenance standards, such as those developed by C2PA, can record information about a file’s origin and modifications. They are relevant tools for improving traceability, but should not be treated as a single or infallible solution.
Technology can support verification. It cannot answer shareholders, reassure worried employees or demonstrate empathy toward affected consumers. Rebuilding trust remains a human task.
Preparation must be practiced
Training and simulations reveal weaknesses a document cannot show: outdated contacts, ambiguous responsibilities, slow approvals, uncertain spokespeople and teams that cannot recognize when to escalate an incident.
A digital identity crisis simulation should involve leadership, communications, legal, compliance, technology, customer service and operational teams. The aim is not to rehearse a perfect response. It is to develop the collective ability to interpret signals, make decisions and communicate under pressure.
Deepfakes make reputational preparedness more urgent, but do not change its central principle: trust is protected before a crisis through consistent relationships, clear responsibilities and a real capacity to respond.
If your crisis preparation amounts to nothing more than a manual, talk to us.
← Back to Think Smart
