UAE Businesses Are Losing Money to Deepfake Scams — Could Your Website Be the Weak Link?
UAE businesses are being warned to prepare for a new generation of AI-powered cyber threats, according to Khaleej Times, with attackers increasingly using deepfake impersonation and highly personalised phishing scams that can breach systems within hours — sometimes minutes. Rob Standing, Regional Vice President, Middle East at cybersecurity company Rubrik, told Khaleej Times that the most common AI-enabled methods today include "highly personalised phishing, deepfake-style impersonation, automated reconnaissance, and ransomware campaigns that can adapt faster than a human operator."
One case cited as a standard reference point in UAE financial services risk briefings, according to a UAE-focused brand defence guide, is the Hong Kong deepfake fraud incident in which $25 million USD was lost through a fake video call featuring AI-generated executives. The case is now widely used as a worst-case illustration of exactly how convincing this kind of fraud has become.
What This Has to Do With Your Website
It's easy to assume deepfake fraud is purely an internal communications problem — a fake voice note, a fake video call — and has nothing to do with a company's public-facing website. That assumption misses an important detail: deepfakes don't get made from nothing. They require source material — real photos, real video, real audio of the person being impersonated — and a surprising amount of that material often comes directly from a company's own website and social channels.
A leadership team page with high-resolution photos, an "About Us" video featuring the founder speaking on camera, recorded webinars or interviews embedded on the site, even voice clips from podcast appearances linked from a press page — all of this is exactly the kind of raw material that makes a convincing deepfake easier to produce. The more public video and audio of your leadership exists, the lower the technical bar for someone attempting to impersonate them.
How the UAE Is Responding
This isn't a hypothetical risk the UAE is ignoring. According to Gulf News, the country's Cybersecurity Council issued a public warning in April 2026 specifically about AI-generated images and videos that can look real and be used to mislead people online, with the warning reinforced by a Dubai Police post urging residents to verify the original source before sharing or acting on content. Separately, a UAE-focused report on AI misinformation notes that the country arrested 10 individuals in March 2026 specifically for creating and distributing AI-generated deepfake videos — confirming that enforcement is real and active, not just theoretical.
Rafal Hyps, Chief Executive Officer of Sicuro Group, told Gulf News that "deepfake-enabled fraud has already been used to impersonate executives on video calls and authorise payments," adding that most organisations haven't updated their verification processes to account for this. That gap between the threat and most companies' actual readiness is the real issue worth addressing.
The Specific Things to Watch For
According to the Gulf News report, there are a few practical, low-tech ways to catch a deepfake in the moment, even without specialised tools. Real-time AI struggles to render two complex objects interacting believably — asking someone on a video call to wave a hand slowly in front of their face often reveals a glitch or blur where the digital mask detaches. Lighting is another tell: deepfakes often have "baked-in" lighting, so if the room's actual light changes but the shadows on a person's face stay exactly the same, that's a strong signal something isn't real.
These are useful tactics for a moment of suspicion, but they shouldn't be the primary defence. The better defence is structural — verification processes that don't depend on someone correctly noticing a lighting glitch under pressure, especially during a high-stress moment when a request sounds urgent and the caller appears to be a senior leader.
A Realistic Scenario Worth Picturing
Imagine a finance manager at a mid-sized UAE trading company receives a video call that appears to be from the company's CFO, who is travelling. The voice sounds right, the face on screen looks right, and the request — an urgent supplier payment, framed as time-sensitive — sounds entirely plausible given the company's actual operations. Without a clear, mandatory rule requiring a second verification step through a separate channel, an employee under time pressure has very little to fall back on except trusting what they saw and heard. This is precisely the gap that the Hong Kong case and the UAE's own warnings are describing — not a failure of an individual employee's judgement, but a failure of the process they were operating within.
What Actually Reduces This Risk
- A mandatory secondary verification channel for any request involving money, credentials, or sensitive data — a callback to a known number, a message through a separate verified channel, regardless of how convincing the original request sounded or looked
- Being deliberate about public video and audio content — not eliminating it, since genuine leadership visibility builds real trust, but being aware that every public clip is potential source material and limiting unnecessary excess
- Staff awareness training that specifically covers deepfakes, not just traditional phishing — most existing security training in many companies still focuses entirely on spotting suspicious emails, not video or voice impersonation
- A clear internal policy for high-stakes requests — a written rule that no transfer above a certain threshold happens based on a single voice or video instruction alone, no matter who it appears to be from
- Working with a development team that thinks about this when building your digital presence — not publishing more raw video/audio than is genuinely useful for the business, and building proper authentication into anything that touches sensitive actions on your website or app
Why This Matters Even More for Growing Businesses
Businesses actively building their public profile — appearing in press coverage, posting founder interviews, growing a LinkedIn presence — are, somewhat counterintuitively, accumulating more deepfake source material the more successful that visibility effort becomes. This isn't a reason to avoid building a public profile; visibility is genuinely valuable for credibility and growth. It's a reason to pair that growing visibility with proportionally stronger internal verification habits, rather than treating the two as unrelated.
This Is a Process Problem, Not Just a Technology Problem
It's worth being direct about this: no website security feature alone prevents deepfake fraud, because the fraud typically targets people and processes, not a website's code directly. What a well-built website and sound internal processes together can do is reduce the amount of unnecessary raw material available to an attacker, and ensure that any request touching money or sensitive data — however convincing it sounds — runs through a verification step that doesn't rely on trusting appearances alone.
Frequently Asked Questions
Should I take down all video and audio content from my website to reduce deepfake risk?
Not necessarily — that content provides genuine value for trust and marketing. The better approach is being thoughtful about what's published and pairing it with strong internal verification processes, rather than removing it entirely.
How quickly can UAE authorities act on a deepfake scam once it's reported?
According to industry reporting, criminal investigations can take weeks to months, while platform takedown requests for verified deepfake content can move faster — typically 24 to 72 hours through official channels. Both routes are usually pursued simultaneously.
Is this really a risk for small and medium businesses, or only large corporations?
Any business with public-facing leadership and a way to authorise payments or share sensitive information is a potential target. Smaller businesses often have less rigorous verification processes in place, which can make them more, not less, exposed.
Can a website actually be built to help reduce this risk, or is it purely a staff training issue?
Both matter. On the website side, careful decisions about what video and audio content gets published, plus strong authentication on anything sensitive, reduce the raw material and entry points available. On the staff side, clear verification policies for high-stakes requests close the remaining gap.