At 8:17 a.m., a video appears on a workplace messaging platform. In it, the chief executive announces a site closure. The setting looks familiar, as does the voice. By 8:25 a.m., employees are questioning their managers; a few minutes later, a journalist calls. This scenario is fictional, but the risk no longer is. Looking ahead to September 2026, the question is becoming less “will we be able to spot the fake?” than “will we be able to establish the truth quickly enough?” For communications professionals, preparation begins long before the first alert.
The boss’s face is no longer proof
Companies have long built their communications around signs of authority: a familiar face, a recognizable voice, an official account. Generative AI undermines the first two; hacking can compromise the third. A public interview, a webinar or an earnings presentation can provide material for an impersonation. The fake need not be perfect: a short clip, watched on a phone and accompanied by an alarming message, can be enough to sow doubt.
A case made public in Hong Kong in February 2024 demonstrated the operational reach of this threat. According to local police, an employee had made transfers totaling about US$25 million after a video conference featuring impersonations of senior figures at his company. Engineering group Arup later confirmed that it was the company involved. This was a case of financial fraud, but its lesson extends beyond treasury operations: audiovisual presence no longer guarantees identity.
For communications teams, the damage can begin without any money changing hands. A fake announcement of layoffs, discriminatory remarks attributed to the chair or a purported acknowledgment of an accident can reach employees, customers and investors. The fake exploits an existing expectation, concern or controversy. The outlook for September 2026 is therefore one of hybrid risk: technical in its creation, social in its spread and organizational in its handling.
Authenticate a statement, not just examine a video
The instinct is often to look for an anomaly: out-of-sync lips, an odd intonation, an inconsistent movement. These clues can help, but they are an unreliable defense. Tools are improving, while compression and reposting obscure the evidence. An automated detector provides a signal, not an indisputable verdict. Crisis communications should never depend on a single score presented as a certainty.
A robust approach involves verifying the origin and context of the statement. Was this appearance scheduled? Is there an original recording? Does the executive’s team confirm their participation through an independent channel? Is the account distributing the content actually controlled by the company? For sensitive requests, any callback must use a known number from the internal directory, never one supplied in the suspicious message.
Provenance mechanisms, particularly those developed around the C2PA standard, can document a piece of content’s origin and subsequent modifications. They offer a useful avenue for official productions. But their scope must remain clear: documented provenance does not prove the truth of every claim; missing metadata does not demonstrate manipulation. Screenshots and re-encoding can also break this documentary chain.
Build the alert process before an emergency
The first person to notice may be an assistant, a salesperson or an employee contacted by someone close to them. They need a simple instruction: do not share it further, save the link and report the content to a designated contact. Requiring them to diagnose a deepfake themselves would be counterproductive. The system must accommodate uncertainty without blaming anyone who believed the impersonation.
A small response team should then bring together communications, IT security, legal and an authorized representative of senior management. Human resources should be involved when employees are targeted; investor relations when information could affect the market. The aim is not to multiply approval stages, but to establish who assesses the situation, who decides and who publishes, including on weekends.
- Communications: assess the spread, prepare the message and coordinate channels.
- Security: investigate any compromise, preserve technical evidence and examine the content.
- Legal: assess the risks, coordinate reporting and oversee the steps taken.
- Management: confirm the facts and authorize decisions under a pre-established delegation of authority.
This arrangement must account for the impersonated executive being unavailable. If they are on a plane, should the company wait until they land before challenging a fabricated announcement? No, when the facts can be established by other means. Explicit delegated authority and message templates prevent a procedure designed to protect official communications from paralyzing them.
Issue a swift rebuttal without amplifying the impersonation
The initial response does not need to explain every detail of how the fake was made. It must state what has been verified, what remains uncertain and where to find updates. One possible draft statement: “This video does not reflect any company announcement. We are verifying its origin. Confirmed information is published on our dedicated page.” If impersonation has been established, it should be clearly identified as such, without prematurely attributing it to a particular tool or perpetrator.
A verifiable rebuttal rests first on a familiar reference point: a page on the corporate website that is accessible without logging in, dated and kept up to date. Social media accounts, internal emails and press responses should all point to this same source. Access must be secured, and a backup channel provided in case the website or an official account is compromised. A new video of the boss is not enough: its authenticity could also be challenged.
Distribution must follow the audiences affected. A rumor confined to a group of employees calls first for an internal response; a clip picked up by the media requires a broader approach. Reposting the fake in full can increase its audience. It is better to provide the details needed to identify it without turning the rebuttal into a vehicle for its spread.
Rehearse the crisis to expose blind spots
A tabletop exercise is often enough to expose weaknesses. A false statement is simulated, followed by inquiries from journalists, concerns from employees and the unavailability of a decision-maker. Participants work with their usual tools. Who can find the relevant contact details? Who can publish on the website? Who responds to managers? The exercise must remain controlled, without deceiving staff or publicly distributing an impersonation.
Useful metrics focus on reporting time, independent verification, access to official channels and consistency of responses. Counting only views of the rebuttal does not reveal whether those exposed to the fake have been reassured. After an alert, whether real or simulated, secondary effects must also be checked: fraudulent requests, harassment of the executive or misleading copies that remain in search results.
What next? For September 2026 and beyond, the prudent assumption is that impersonations will become easier to produce and doubts about authentic content more frequent. The answer will therefore not simply be a better detector. It will depend on a collective habit: verifying sensitive announcements outside the channel through which they arrive, recognizing official sources and accepting transparent communication about uncertainty. Trust must be built before the fake speaks.
