Cybersecurity

Nearly 3 in 10 Small Businesses Hit by Deepfake Scams in 2026

NeuralWired Cybersecurity Desk · Published July 23, 2026

In February 2024, a finance employee at UK engineering firm Arup joined what looked like a routine video call with the CFO and several colleagues. He wired $25.6 million across 15 transactions before anyone realized every face on that call except his own was AI generated. Two years later, that trick has trickled all the way down to businesses with a dozen employees and no IT department: 29% of small businesses now say they’ve experienced a deepfake scam in the past year, according to a new survey from cybersecurity firm VikingCloud.

That number, buried inside VikingCloud’s 2026 SMB Threat Landscape Report, is the clearest signal yet that deepfake fraud stopped being an enterprise problem sometime in the last eighteen months. It’s now a Tuesday-afternoon problem for a plumbing company in Ohio or a marketing agency in Manchester. And the FBI, for the first time in its Internet Crime Complaint Center’s roughly 25-year history, agrees the threat is big enough to track on its own.

1. What the New Numbers Actually Show2. The FBI Just Made It Official3. The Case That Changed Everything: Arup’s $25.6 Million Call4. When the Defense Works: WPP’s Near Miss5. Why Small Businesses Are the Easier Target6. Can You Trust Your Own Eyes?7. The Regulatory Clock Is Ticking8. Reader Beware: Not Every Stat Holds Up9. The One Habit That Beats the Software10. Frequently Asked Questions

What the New Numbers Actually Show

VikingCloud surveyed small business owners and operators for its 2026 threat report, and the results reorder what SMBs are worried about. More than a quarter said they’d experienced a deepfake scheme (29%), a customer data breach (27%), a ransomware attack (26%), or a denial of service attack (26%) in the past year. Taken together, 75% of SMB owners now rank cyberattacks as their number one operational threat for 2026, the first time in this survey series that cybersecurity has outranked economic pressure. Forty percent said a cyberattack costing $100,000 or less could put them out of business entirely.

A note on the source VikingCloud hasn’t published full survey methodology, sample size, or margin of error in its public summary; the underlying data sits behind a lead-gen form. That doesn’t make the 29% figure false, but it means it should be read as “according to a vendor survey of small business owners,” not as census-grade data. Compare it against the FBI figure below, which is independently audited.

The FBI Just Made It Official

For 2025, the FBI’s Internet Crime Complaint Center broke out AI-enabled fraud as its own standalone category for the first time. IC3 logged 22,364 complaints with a reported AI nexus, totaling $893,346,472 in adjusted losses, according to the FBI IC3 2025 Annual Report published in April 2026. That figure is the closest thing this space has to a government-audited number, and it’s worth breaking down by category.

Business email compromise is the line that should matter most to a small business owner. It’s the category built entirely around impersonating someone the victim already trusts, a vendor, a boss, a bank contact, and it’s exactly the mechanism behind the Arup case.

The Case That Changed Everything: Arup’s $25.6 Million Call

Arup’s Hong Kong finance team received what appeared to be a standard request from the company’s UK-based CFO: move funds for a confidential transaction. The employee had doubts, so he did what security training tells you to do. He joined a video call to verify. Every other participant on that call, including the person who looked and sounded like the CFO, was an AI-generated deepfake. He made the transfers. Reporting from the Financial Times and CNN in May 2024 confirmed the total loss at $25.6 million across 15 wire transactions, and the case has become the reference point every security vendor cites when explaining why video verification alone is no longer enough.

Arup is a global engineering firm with sophisticated finance operations, not a small business. That distinction matters, and we’ll come back to it. But the mechanics of the attack, real-time video and voice synthesis convincing enough to fool someone who was actively trying to verify, work exactly the same way against a five-person accounting team as they did against Arup’s.

When the Defense Works: WPP’s Near Miss

Not every attempt succeeds, and the counter-example is worth knowing. Scammers targeted WPP CEO Mark Read using a cloned voice and a spoofed Microsoft Teams meeting invite, built around a fake WhatsApp account using his public photo, according to an entry in the OECD.AI Incident Database and reporting from Marketing-Interactive. Staff escalated before any money moved. WPP confirmed zero losses.

What stopped it wasn’t detection software. It was a human asking a question the scammer couldn’t answer and refusing to proceed until someone verified through a separate channel. That’s a cheap lesson, and it’s the same one at the center of the advice section below.

Why Small Businesses Are the Easier Target

Here’s the uncomfortable part for small business owners: being small isn’t protection. It’s the opposite. VikingCloud’s data shows 84% of SMB owners self-manage their own cybersecurity, with no dedicated IT or security staff. That means the same person approving a vendor invoice is also the last line of defense against a fraudulent one, with no gatekeeper, no second sign-off, no layered approval chain to slow things down.

An enterprise like Arup still has structural weaknesses attackers can exploit, but it also has finance controls, compliance teams, and escalation paths. A twelve-person business usually has one bookkeeper and a Slack channel. Attackers know which door is easier to walk through.

“We only have like one really good example in the news right now of that organization in Hong Kong that ended up falling for and sending $25 million based on a deepfake audio and video scam, and I think we’re going to see a lot more business email compromise style events because of AI.”Rachel Tobac, CEO, SocialProof Security · 8th Layer Insights podcast, The Cyber Wire, April 9, 2024

Tobac’s prediction has aged into the current data. The FBI’s BEC-with-AI-nexus figure alone hit $30.3 million in 2025, and that’s before counting the cases that never get formally reported, which fraud researchers generally assume is the majority of them.

“AI-generated media is not just a future risk, it’s a real business threat. We’re seeing executives impersonated, hiring processes compromised, and financial safeguards bypassed with alarming ease.”Tony Lee, Head of Consulting, Hong Kong & Macau, Trend Micro · Media OutReach Newswire, July 10, 2025

Worth flagging: Lee’s employer, Trend Micro, sells deepfake detection tools, so treat the quote as an informed but interested voice rather than a neutral one.

Can You Trust Your Own Eyes?

Most SMB owners assume they’d notice if something felt off on a call. The data says otherwise. Controlled lab studies compiled by security research firm DeepStrike found human accuracy at spotting high-quality deepfake video sits at just 24.5%, even though roughly 60% of people believe they could identify one. That gap between confidence and competence is arguably the more dangerous number in this whole story.

The technical barrier to producing convincing fakes keeps dropping too. McAfee’s consumer research found a voice clone with about 85% similarity to the original can now be generated from just three seconds of audio, easily pulled from a podcast clip, a local news interview, or a company’s own marketing video.

The Regulatory Clock Is Ticking

Two regulatory shifts land right around this article’s publish date. The EU AI Act’s Article 50 transparency rules, requiring disclosure and labeling of AI-generated content, take effect in August 2026, with penalties reaching €35 million or 7% of global turnover for noncompliance. Meanwhile, roughly 46 to 47 US states have now passed some form of deepfake-specific legislation, spanning election-related disclosure rules, non-consensual imagery protections, and fraud statutes, according to MultiState’s legislative tracking.

None of this stops a scam call from reaching a small business tomorrow morning. But it does signal that lawmakers on both sides of the Atlantic have stopped treating deepfakes as a novelty problem.

Reader Beware: Not Every Stat Holds Up

Scroll through enough 2026 deepfake coverage and you’ll hit percentage increases that sound apocalyptic: 2,137%, 3,892%, four-digit growth claims stacked one after another. A research team at Digital Applied spent its July 2026 audit picking these apart, arguing that the field is crowded with numbers nobody actually verifies, loss figures with no traceable primary source, surge percentages that contradict each other depending on which vendor published them, and forecasts that get recycled as if they were measurements.

Our read: most of those huge percentage jumps are real in direction but misleading in scale. A fraud category that goes from 0.1% to 6.5% of total fraud attempts, which is roughly what’s happened according to fraud-detection firm Signicat, produces an enormous percentage increase almost automatically, simply because it started near zero. That’s still a genuine and fast-growing threat. It’s just not the same thing as the flat “up 3,892% this year” headline that gets repeated without context.

It’s also worth being honest about scale. Most of the largest documented deepfake losses, Arup’s $25.6 million among them, hit large enterprises with the kind of finance operations that can move eight figures in a single transfer. A small business physically can’t lose that much in one incident. The realistic SMB exposure looks more like tens of thousands of dollars per event, which is still enough to close a business operating on thin margins, but the “small businesses are next in line for a $25 million loss” framing overstates the individual stakes even while understating how often SMBs get hit.

The One Habit That Beats the Software

Security researchers keep landing on the same conclusion, and it isn’t a product pitch. Verizon’s Data Breach Investigations Report, cited across multiple 2026 industry analyses, consistently finds the human element involved in more than 60% of breaches. A basic callback-verification habit defeats a deepfake exactly as well as it defeats a decades-old phone scam, because the fake voice or face is only dangerous if the person on the other end skips the second check.

• Set a callback rule. Any request to move money, change banking details, or reset credentials gets verified by calling a number pulled from your own records, never one supplied in the suspicious message or call.
• Agree on a code word. A pre-shared phrase for high-stakes requests costs nothing and a real-time deepfake can’t guess it.
• Slow down on urgency. Scammers manufacture time pressure because it stops people from verifying. Treat “this has to happen right now” as the red flag it is.
• Train the one person who approves payments. If your business doesn’t have a finance team, whoever signs off on transfers is your entire defense layer. Make sure they know this playbook exists.

Gartner had already predicted where this was heading: by 2026, the firm projected that 40% of enterprises would stop trusting standalone identity verification because of deepfakes. That prediction is landing now, and the fix it points to isn’t more software, it’s a second channel that a synthetic voice or face can’t fake its way through.

Frequently Asked Questions

What percentage of small businesses have experienced a deepfake scam?

According to VikingCloud’s 2026 SMB Threat Landscape Report, 29% of small businesses reported experiencing a deepfake scheme in the past 12 months, making it one of the most common cyber incidents SMB owners now report, alongside data breaches and ransomware.

How much money has been lost to deepfake and AI-enabled fraud in 2025?

The FBI’s Internet Crime Complaint Center logged $893,346,472 in adjusted losses from 22,364 US complaints referencing AI in 2025, the first year the FBI tracked AI-enabled fraud as its own standalone category.

How can a small business protect itself from deepfake scams?

Require a second-channel verification, a callback to an internally stored phone number or a pre-agreed code word, for any request involving wire transfers, banking-detail changes, or credential resets, even ones that arrive by video call. It consistently ranks above detection software as the lowest-cost, most effective defense.

Why are small businesses targeted by deepfake scammers more than large companies?

Small businesses often rely on informal, trust-based approval processes with no dedicated IT or security staff. Eighty-four percent of SMB owners self-manage their own cybersecurity, per VikingCloud’s 2026 report, which removes the layered sign-off chain that would otherwise catch a fraudulent request.

Can humans reliably spot a deepfake video?

No. Controlled studies find human accuracy at identifying high-quality deepfake videos is only about 24.5%, even though roughly 60% of people believe they could spot one, a gap that itself increases risk by creating false confidence.

Where This Goes Next

Two things are converging right now that weren’t true even a year ago. The FBI has an audited number to point to for the first time, and small business owners are, for the first time in this survey series, ranking cyberattacks above the economy as their biggest worry. Neither of those happens without the other. Watch three things over the next six to eighteen months: whether EU AI Act enforcement actually produces fines large enough to change vendor behavior, whether cyber insurers start pricing deepfake-specific BEC into small business premiums, and whether the “29%” figure gets replicated by a source willing to publish full methodology.

The takeaway for anyone running a small business isn’t to panic about AI. It’s to put a five-minute verification habit in place before you need it. The businesses in the Arup and WPP stories both had smart people on the call. Only one of them had a process that didn’t depend on trusting what they saw.

Want more coverage like this before it hits the mainstream feeds? Subscribe to The Neural Loop at neuralwired.com/newsletter.

More cybersecurity coverage: NeuralWired’s Cybersecurity hub. For related coverage on how deepfakes intersect with crypto fraud, see NeuralWired’s Crypto Regulation by Country 2026.

Nearly 3 in 10 Small Businesses Hit by Deepfake Scams in 2026

NeuralWired Cybersecurity Desk · Published July 23, 2026

In February 2024, a finance employee at UK engineering firm Arup joined what looked like a routine video call with the CFO and several colleagues. He wired $25.6 million across 15 transactions before anyone realized every face on that call except his own was AI generated. Two years later, that trick has trickled all the way down to businesses with a dozen employees and no IT department: 29% of small businesses now say they’ve experienced a deepfake scam in the past year, according to a new survey from cybersecurity firm VikingCloud.

That number, buried inside VikingCloud’s 2026 SMB Threat Landscape Report, is the clearest signal yet that deepfake fraud stopped being an enterprise problem sometime in the last eighteen months. It’s now a Tuesday-afternoon problem for a plumbing company in Ohio or a marketing agency in Manchester. And the FBI, for the first time in its Internet Crime Complaint Center’s roughly 25-year history, agrees the threat is big enough to track on its own.

What the New Numbers Actually Show

VikingCloud surveyed small business owners and operators for its 2026 threat report, and the results reorder what SMBs are worried about. More than a quarter said they’d experienced a deepfake scheme (29%), a customer data breach (27%), a ransomware attack (26%), or a denial of service attack (26%) in the past year. Taken together, 75% of SMB owners now rank cyberattacks as their number one operational threat for 2026, the first time in this survey series that cybersecurity has outranked economic pressure. Forty percent said a cyberattack costing $100,000 or less could put them out of business entirely.

The FBI Just Made It Official

For 2025, the FBI’s Internet Crime Complaint Center broke out AI-enabled fraud as its own standalone category for the first time. IC3 logged 22,364 complaints with a reported AI nexus, totaling $893,346,472 in adjusted losses, according to the FBI IC3 2025 Annual Report published in April 2026. That figure is the closest thing this space has to a government-audited number, and it’s worth breaking down by category.

Business email compromise is the line that should matter most to a small business owner. It’s the category built entirely around impersonating someone the victim already trusts, a vendor, a boss, a bank contact, and it’s exactly the mechanism behind the Arup case.

The Case That Changed Everything: Arup’s $25.6 Million Call

Arup’s Hong Kong finance team received what appeared to be a standard request from the company’s UK-based CFO: move funds for a confidential transaction. The employee had doubts, so he did what security training tells you to do. He joined a video call to verify. Every other participant on that call, including the person who looked and sounded like the CFO, was an AI-generated deepfake. He made the transfers. Reporting from the Financial Times and CNN in May 2024 confirmed the total loss at $25.6 million across 15 wire transactions, and the case has become the reference point every security vendor cites when explaining why video verification alone is no longer enough.

Arup is a global engineering firm with sophisticated finance operations, not a small business. That distinction matters, and we’ll come back to it. But the mechanics of the attack, real-time video and voice synthesis convincing enough to fool someone who was actively trying to verify, work exactly the same way against a five-person accounting team as they did against Arup’s.

When the Defense Works: WPP’s Near Miss

Not every attempt succeeds, and the counter-example is worth knowing. Scammers targeted WPP CEO Mark Read using a cloned voice and a spoofed Microsoft Teams meeting invite, built around a fake WhatsApp account using his public photo, according to an entry in the OECD.AI Incident Database and reporting from Marketing-Interactive. Staff escalated before any money moved. WPP confirmed zero losses.

What stopped it wasn’t detection software. It was a human asking a question the scammer couldn’t answer and refusing to proceed until someone verified through a separate channel. That’s a cheap lesson, and it’s the same one at the center of the advice section below.

Why Small Businesses Are the Easier Target

Here’s the uncomfortable part for small business owners: being small isn’t protection. It’s the opposite. VikingCloud’s data shows 84% of SMB owners self-manage their own cybersecurity, with no dedicated IT or security staff. That means the same person approving a vendor invoice is also the last line of defense against a fraudulent one, with no gatekeeper, no second sign-off, no layered approval chain to slow things down.

An enterprise like Arup still has structural weaknesses attackers can exploit, but it also has finance controls, compliance teams, and escalation paths. A twelve-person business usually has one bookkeeper and a Slack channel. Attackers know which door is easier to walk through.

“We only have like one really good example in the news right now of that organization in Hong Kong that ended up falling for and sending $25 million based on a deepfake audio and video scam, and I think we’re going to see a lot more business email compromise style events because of AI.” Rachel Tobac, CEO, SocialProof Security · 8th Layer Insights podcast, The Cyber Wire, April 9, 2024

Tobac’s prediction has aged into the current data. The FBI’s BEC-with-AI-nexus figure alone hit $30.3 million in 2025, and that’s before counting the cases that never get formally reported, which fraud researchers generally assume is the majority of them.

“AI-generated media is not just a future risk, it’s a real business threat. We’re seeing executives impersonated, hiring processes compromised, and financial safeguards bypassed with alarming ease.” Tony Lee, Head of Consulting, Hong Kong & Macau, Trend Micro · Media OutReach Newswire, July 10, 2025

Worth flagging: Lee’s employer, Trend Micro, sells deepfake detection tools, so treat the quote as an informed but interested voice rather than a neutral one.

Can You Trust Your Own Eyes?

Most SMB owners assume they’d notice if something felt off on a call. The data says otherwise. Controlled lab studies compiled by security research firm DeepStrike found human accuracy at spotting high-quality deepfake video sits at just 24.5%, even though roughly 60% of people believe they could identify one. That gap between confidence and competence is arguably the more dangerous number in this whole story.

The technical barrier to producing convincing fakes keeps dropping too. McAfee’s consumer research found a voice clone with about 85% similarity to the original can now be generated from just three seconds of audio, easily pulled from a podcast clip, a local news interview, or a company’s own marketing video.

The Regulatory Clock Is Ticking

Two regulatory shifts land right around this article’s publish date. The EU AI Act’s Article 50 transparency rules, requiring disclosure and labeling of AI-generated content, take effect in August 2026, with penalties reaching €35 million or 7% of global turnover for noncompliance. Meanwhile, roughly 46 to 47 US states have now passed some form of deepfake-specific legislation, spanning election-related disclosure rules, non-consensual imagery protections, and fraud statutes, according to MultiState’s legislative tracking.

None of this stops a scam call from reaching a small business tomorrow morning. But it does signal that lawmakers on both sides of the Atlantic have stopped treating deepfakes as a novelty problem.

Reader Beware: Not Every Stat Holds Up

Scroll through enough 2026 deepfake coverage and you’ll hit percentage increases that sound apocalyptic: 2,137%, 3,892%, four-digit growth claims stacked one after another. A research team at Digital Applied spent its July 2026 audit picking these apart, arguing that the field is crowded with numbers nobody actually verifies, loss figures with no traceable primary source, surge percentages that contradict each other depending on which vendor published them, and forecasts that get recycled as if they were measurements.

Our read: most of those huge percentage jumps are real in direction but misleading in scale. A fraud category that goes from 0.1% to 6.5% of total fraud attempts, which is roughly what’s happened according to fraud-detection firm Signicat, produces an enormous percentage increase almost automatically, simply because it started near zero. That’s still a genuine and fast-growing threat. It’s just not the same thing as the flat “up 3,892% this year” headline that gets repeated without context.

It’s also worth being honest about scale. Most of the largest documented deepfake losses, Arup’s $25.6 million among them, hit large enterprises with the kind of finance operations that can move eight figures in a single transfer. A small business physically can’t lose that much in one incident. The realistic SMB exposure looks more like tens of thousands of dollars per event, which is still enough to close a business operating on thin margins, but the “small businesses are next in line for a $25 million loss” framing overstates the individual stakes even while understating how often SMBs get hit.

The One Habit That Beats the Software

Security researchers keep landing on the same conclusion, and it isn’t a product pitch. Verizon’s Data Breach Investigations Report, cited across multiple 2026 industry analyses, consistently finds the human element involved in more than 60% of breaches. A basic callback-verification habit defeats a deepfake exactly as well as it defeats a decades-old phone scam, because the fake voice or face is only dangerous if the person on the other end skips the second check.

• Set a callback rule. Any request to move money, change banking details, or reset credentials gets verified by calling a number pulled from your own records, never one supplied in the suspicious message or call.
• Agree on a code word. A pre-shared phrase for high-stakes requests costs nothing and a real-time deepfake can’t guess it.
• Slow down on urgency. Scammers manufacture time pressure because it stops people from verifying. Treat “this has to happen right now” as the red flag it is.
• Train the one person who approves payments. If your business doesn’t have a finance team, whoever signs off on transfers is your entire defense layer. Make sure they know this playbook exists.

Gartner had already predicted where this was heading: by 2026, the firm projected that 40% of enterprises would stop trusting standalone identity verification because of deepfakes. That prediction is landing now, and the fix it points to isn’t more software, it’s a second channel that a synthetic voice or face can’t fake its way through.

Frequently Asked Questions

What percentage of small businesses have experienced a deepfake scam?

According to VikingCloud’s 2026 SMB Threat Landscape Report, 29% of small businesses reported experiencing a deepfake scheme in the past 12 months, making it one of the most common cyber incidents SMB owners now report, alongside data breaches and ransomware.

How much money has been lost to deepfake and AI-enabled fraud in 2025?

The FBI’s Internet Crime Complaint Center logged $893,346,472 in adjusted losses from 22,364 US complaints referencing AI in 2025, the first year the FBI tracked AI-enabled fraud as its own standalone category.

How can a small business protect itself from deepfake scams?

Require a second-channel verification, a callback to an internally stored phone number or a pre-agreed code word, for any request involving wire transfers, banking-detail changes, or credential resets, even ones that arrive by video call. It consistently ranks above detection software as the lowest-cost, most effective defense.

Why are small businesses targeted by deepfake scammers more than large companies?

Small businesses often rely on informal, trust-based approval processes with no dedicated IT or security staff. Eighty-four percent of SMB owners self-manage their own cybersecurity, per VikingCloud’s 2026 report, which removes the layered sign-off chain that would otherwise catch a fraudulent request.

Can humans reliably spot a deepfake video?

No. Controlled studies find human accuracy at identifying high-quality deepfake videos is only about 24.5%, even though roughly 60% of people believe they could spot one, a gap that itself increases risk by creating false confidence.

Where This Goes Next

Two things are converging right now that weren’t true even a year ago. The FBI has an audited number to point to for the first time, and small business owners are, for the first time in this survey series, ranking cyberattacks above the economy as their biggest worry. Neither of those happens without the other. Watch three things over the next six to eighteen months: whether EU AI Act enforcement actually produces fines large enough to change vendor behavior, whether cyber insurers start pricing deepfake-specific BEC into small business premiums, and whether the “29%” figure gets replicated by a source willing to publish full methodology.

The takeaway for anyone running a small business isn’t to panic about AI. It’s to put a five-minute verification habit in place before you need it. The businesses in the Arup and WPP stories both had smart people on the call. Only one of them had a process that didn’t depend on trusting what they saw.

Want more coverage like this before it hits the mainstream feeds? Subscribe to The Neural Loop at neuralwired.com/newsletter.

More cybersecurity coverage: NeuralWired’s Cybersecurity hub. For related coverage on how deepfakes intersect with crypto fraud, see NeuralWired’s Crypto Regulation by Country 2026.