Deepfakes only cost $2 now

Tl;dr: I’m mentoring a team that is building a business securing executives and individuals online. If you feel vulnerable in real life from your online activity, they want you to be a customer. Reply to this email, and I’ll connect you to them!

—

OK, so on to the story of how this came together:

A finance worker in Hong Kong joined a video call with his CFO and several colleagues. They discussed a funds transfer. He sent $25 million.

Every single person on that call, except him, was AI-generated.

Here’s the CNN article about it. 

But the thing that got to me: that was 2024. How much easier would that be to pull off today?

So today, I’m wondering: how do you protect yourself?

Here’s why personal security is on my mind lately.

About a month ago, I woke up at 5 am to prep for a big work thing. Then Google hit me with a notification: "Suspicious activity on your account." Password reset required. Locked out of everything.

It's dark. It's winter. I have a stressful day ahead. And I’m sitting in the dark, alone, trying to figure out if someone's inside my accounts and what they might have access to.

I don't even know if anything actually happened, which is almost worse. Because the uncertainty sits with you.

Since then, I’ve done some reading. 

Here's what most people haven't updated on: the economics of these attacks have completely flipped in the last 18 months.

The average deepfake costs less than $2 to make. The average loss per “incident” is around $600,000.

And cheap means plentiful. 

One study found that the number of deepfake scams went from 487 in Q2 2025 to 2,031 just one quarter later.

Or here’s a chart from Time Magazine. The trend is clear:

The thing is, as scams like this get cheaper to pull off, it won’t be just A-list targets.

If it only costs a few bucks, the bad guys will go after smaller and smaller fish. 

And somewhere down the line, that gets to you and me. 

Now, I’m nowhere near as high-profile as, say, the CEO of a healthcare company. But I’m a known business owner with an internet presence. 

I have something to lose. You probably do too.

—

My companies have security measures. Work email, corporate devices — there are people whose job it is to keep track of that stuff.

But if someone's targeting you specifically—not your company—they're going after your personal email, your home network, your family's devices, your phone. 

That's the actual attack surface for a high-profile person.

Corporate IT doesn't touch any of it. And most executives have zero coverage there.

So I’m trying to figure this stuff out for myself. 

—

But…

I’m also a business nerd. And if I have a need for something, I figure other people like me do too. 

So I’m incubating a business with a team called Lockdown, focused specifically on this gap of cybersecurity for high-profile individuals, not just their companies. Personal devices, home networks, family exposure, the whole surface area that corporate security ignores.

They're early and looking for beta customers. If you're someone with visibility who's felt that vulnerability—or you’ve had your own 5am moment—reach out and I'll connect you. 

Just reply to this email!

—

—

Have you ever been deepfaked or hacked? What did you do? How did you change your setup? 

Thanks for reading. And looking forward to hearing from you.

Stay safe!

Michael

P.S. Don’t forget your HoldCo Conference tickets!