Deepfake Scams: Cyberpark Session and UPSC Analysis

Deepfake scams were a focus of a cybersecurity awareness session at Government Cyberpark, Kozhikode. The event offers a case study for science and technology current affairs, especially the human side of digital security.

Quick answer: Wattlecorp Cybersecurity Labs and Government Cyberpark organised an awareness session for park employees in Kozhikode during Cybersecurity Awareness Month. Experts demonstrated how attackers access systems and obtain sensitive information. They also explained how video and voice impersonation can trick employees into transferring money or disclosing confidential information.

What are deepfake scams?

Deepfake scams use digitally manipulated or generated media to deceive people, often by impersonating someone they trust. For example, a fraudster may imitate an executive’s voice or appearance to seek an urgent payment.

A deepfake is not necessarily fraudulent: its purpose and use matter. However, when an attacker combines impersonation with a payment or disclosure request, it becomes a tool of social engineering. Social engineering manipulates people into taking actions that compromise security.

Why was the Cyberpark session held?

The session aimed to build security awareness among employees of companies at Government Cyberpark. Wattlecorp Cybersecurity Labs organised it with the park as part of Cybersecurity Awareness Month.

Wattlecorp’s experts used live demonstrations to show how attackers can enter organisational systems and obtain sensitive information. In addition, they showed how video and voice impersonation can persuade employees to transfer money or reveal confidential information. The session covered practical identification and prevention measures.

The event connected minor everyday lapses with organisational risk. Therefore, awareness must extend beyond information technology teams. For related precautions, see CBL’s guide to cyber hygiene and digital arrest scams.

How does executive impersonation exploit trust?

Executive impersonation exploits an employee’s tendency to treat an apparent senior’s instructions as authoritative. In a typical scenario, an attacker seeks a transfer or confidential information by presenting a convincing voice or video.

First, the apparent identity creates trust. Next, a request for a sensitive action turns that trust into a security risk. Consequently, verification must cover both the requester’s identity and the authority to approve the transaction.

These risks concern finance, human resources and administration as well as technical teams. Moreover, an organisation may face both financial loss and exposure of confidential information. The incident pattern also illustrates why cybersecurity in critical infrastructure requires attention to people and processes alongside technology.

Which legal provisions are relevant?

The Information Technology Act, 2000 contains provisions relevant to identity misuse and online impersonation. However, their application depends on the facts and the ingredients of each offence.

Thus, impersonation, unauthorised identity use and privacy raise distinct legal questions. A deepfake label alone does not establish every element of an offence.

What are the main governance challenges?

The central challenge is to verify requests without treating realistic audio or video as proof of identity. Several organisational weaknesses can make that task harder:

• Authority pressure: Employees may act quickly when a request seems to come from a senior executive.
• Uneven awareness: Staff outside technical teams may not recognise impersonation; consequently, training limited to specialists leaves gaps.
• Weak processes: A single approval channel can make an incorrect transfer or disclosure easier.
• Privacy trade-off: Organisations need evidence for investigations; however, they must also limit unnecessary collection and access.

Detection tools can support scrutiny, but they should not replace transaction controls. In addition, employees need a way to question suspicious requests without fearing criticism for delay.

What should organisations do next?

Organisations should combine staff awareness with independent verification and clear incident procedures. The following measures are policy suggestions, not claims about the specific instructions given at the session:

• Verify independently: Confirm unusual payment or disclosure requests through a previously established contact channel.
• Separate approvals: Require a second authorised person to approve sensitive transfers; thus, one deceptive call need not determine the outcome.
• Limit access: Give staff access to sensitive data according to their roles; consequently, one compromised account has a narrower reach.
• Practise reporting: Train all teams to flag suspicious requests promptly and preserve relevant records for investigation.
• Review controls: Test procedures periodically and improve them after exercises or incidents.

Overall, cybersecurity awareness is most effective when institutions make verification routine and share responsibility across departments. The Kozhikode session illustrates this preventive approach through demonstrations rather than relying on technical teams alone.

Source: The Hindu, 30 October 2026

Prelims Practice Corner

Mains Practice Questions

Frequently Asked Questions