Deepfake protection and accounting considerations for TMT companies

Technology, media and telecommunications (TMT) companies that enhance internal controls and invest in safeguarding technology can strengthen how they protect themselves against deepfake scams.

In addition, companies can support the accuracy of their financial statements by understanding the accounting implications of investing in AI-based, fraud-detection software, according to Kurt Shenk, RSM assurance partner and TMT senior analyst, and Aliya Mauch, RSM TMT audit policy leader and assurance senior manager.  

Shenk and Mauch joined RSM’s “The Audit Statement” to discuss how TMT companies can combat deepfake scams and corresponding accounting implications. Specifically, they covered:

• Recent trends in the TMT industry: The rise of deepfake technology.
• Internal controls and safeguards against deepfakes: Companies' varying levels of preparedness, and the importance of AI-based detection and watermarking techniques.
• Impact of deepfake scams on financial statements: Potential losses in the profit and loss (P&L) statement and insurance premium hikes.
• Capitalization of AI development costs: Guidance on following ASC 350-40 for internal use and 985-20 for marketed software.
• Key takeaways: Importance of proper policies to prevent fraud, as well as investment in technology and training.

Below the video is a transcript of their six-minute conversation, which has been edited for clarity and length.

Kurt Shenk: Let's dive into some recent trends for the technology, media and telecom industry. Firstly, we want to talk about deepfake technology. I recently heard that in 2024, the number of deepfake scams has increased by 1400% compared to last year. With the rise in deepfake technology, scams are also becoming more sophisticated and difficult to detect. We find ourselves asking, "What is real?"

I recently saw how this played out for a company, and unfortunately this was a scam where an employee was tricked by a deepfake technology call from what was intended to be the CFO. On this call, this sounded like the CFO, it looked like the CFO, and completely convinced this employee to transfer $25 million to a bad actor, in this case.

Part of me is still stunned every time I hear this story, and I guess this is just the day and age that we find ourselves in.

I’m curious: what are you seeing in terms of internal controls or safeguards that companies are implementing to protect against this type of deepfake technology?

Aliya Mauch: This is a hot topic, for sure. Companies range from having highly sophisticated, AI-based detection tools to not having anything because they think they're too small and they won't be impacted by this. But, like you said, the deepfake technology is becoming easier to manipulate, create the content, so we expect this to continue happening.

At this point, AI-based software that's detecting and authenticating the original content is the best way to protect companies. But there are also watermarking techniques on videos, so you know that it's your company and the people are real. There are also trainings and policies that companies can do to help their employees to not fall for these traps.

KS: And if these scams are not caught, it can have a direct impact on a company's financial statement, right? For example, there could be a loss in the P&L, and there's probably a large insurance claim, and that would result in premium hikes.

You mentioned investing in AI-based technology tools, and I did want to double-click on that a little bit if we could. As AI continues to evolve, how are companies considering the capitalization of AI development costs?

AM: While the AI is very new technology, capitalization of the costs are following the same guidance as any other software costs. If the company is creating software for internal use, they will use ASC 350-40, and if they're using a software to be marketed or sold, it would follow guidance of 985-20. So, nothing new there.

However, companies need to consider certain implications of tracking the software costs and also determining what the useful life is because AI is developing so fast, but also potentially will become more obsolete.

KS: In terms of closing comments before we adjourn, could you quickly summarize a few key takeaways for us, please?

AM: I think at this point, companies need to ensure that they have proper policies to prevent those frauds from happening. We highly recommend companies invest in technology, again, waterproofing techniques or just developing trainings and multifactor authentications—such as asking questions, having safe words—that will help companies to determine whether a video is the original content.

Then, I also recommend companies continue tracking the software costs to ensure proper use of the guidance and capitalization of the costs.

KS: That's right. I think another key takeaway is related to the need, really, to invest in detection tools. There are adoption AI-based detection tools that are relatively inexpensive, and that's making defense affordable and scalable.