The Deepfake
The person on the video call looks like your CFO. Sounds like your CFO. It is not your CFO.
25 minutes. Branching decisions. A safety score with feedback on every decision.
Before you start
- One real incident, played as decisions - no slides, no lectures.
- About 25 minutes, one sitting - leave early and you start over.
- You make timed choices; your score changes with your decisions.
- You get a safety score with feedback on every decision - never a leaderboard, never your name.
- Your firm sees completion evidence - never your answers. Teammates never see your score.
- Finish and you get a certificate with a unique ID anyone can verify.
Free for everyone. All 18 drills are free - finish and you get a verifiable certificate.
Everyone else on the call was fake.
A finance employee at the global engineering firm Arup got an email that looked like a phishing attempt, claiming to be from the UK-based CFO about a confidential transaction.
He was suspicious. Then a video call invite arrived. On the call: the CFO. People he believed were colleagues. They looked right. They sounded right.
He thought he had checked - but the checking happened inside the attacker's channel. Looking and sounding right is no longer evidence.
Friday, 4:40 PM.
Northbeam Logistics.
You are Jordan, finance manager. Quarter-end. You're clearing your inbox when this lands:
FROM: M. OSEI (CFO) <[email protected]>
"Confidential acquisition deposit. Need it today. I'll explain on a quick video call in 10 minutes. Keep this between us for now."
The invite arrives. What do you do?
M. Osei (CFO)
R. Kapoor (Controller)
L. Tran (Treasury)He looks right. He sounds right. Ravi and Linh are nodding along.
You have 30 seconds. Pressure is part of the attack.
You call the real CFO's saved number.
He answers from his car. He has no idea what you're talking about. There is no acquisition. Your heart rate is somewhere in the hundreds.
Now what?
Select each card to sort it.
First tap = RED FLAG. Second tap = GREEN CONTROL. Third tap resets. Grade when all 10 are sorted.
Write the rule you'll actually follow.
Pick the verification steps you'll take for any payment or sensitive-data request, no matter who appears to ask. This saves to your completion record.
SAFETY
101
This certifies that
has completed Module 5 - The Deepfake: AI-enabled fraud and impersonation on with a safety score of /100 in of active time.
Safety score: how your decisions held up, graded 0-100.
Objective: Verify urgent requests out-of-band, no matter how real the channel looks.
Seat time ~10-25 minutes. Verify this certificate at aisafety101.com/verify.
Evidence on record: module completion, seat time, final score, and certificate ID. This certificate ID verifies in your firm's admin report. A team certificate issues when every enrolled employee completes the full curriculum.
Your one rule to keep: For high-risk payment or sensitive-data requests, don't rely on the requester's channel alone. Verify through an independently trusted channel or approved control. High-risk request? Verify outside the requester's channel.
Next: Shadow AI. You just learned to verify the channel, not the face. Next: the AI tools your team is already using that nobody approved - and nobody is checking.