Deepfakes: The Crisis We Need to Plan For

When we sat down with David Higgerson ahead of his upcoming appearance on PR in the Real World, we expected to talk about the future of local journalism. We did. But the conversation kept coming back to one word: trust.

Higgerson is Chief Content Officer at Reach plc, responsible for content strategy across every title in the UK’s largest commercial news publisher, from the Mirror and the Express to the Lancashire Telegraph and Liverpool Echo. He’s been in newsrooms since 1998, starting as a reporter at the Preston Citizen. He’s lived through every wave of change this industry has thrown at journalists. But what he described to us wasn’t about technology or business models. It was about something more fundamental.

This is what I kept thinking about for days after we’d spoken. For most of his career, when a press release landed on a journalist’s desk, you verified the claims, stress-tested the information and checked the numbers added up or the quotes were fair. What you didn’t have to do was check whether the person quoted in it actually existed!

That’s changed.

And the reason it’s changed should concern every comms professional, every business leader, and every organisation that depends on public trust to operate.

The scale of what we’re facing

On 5 February 2026, the Home Office published what it called a “world-first” deepfake detection evaluation framework, developed in partnership with Microsoft..

The numbers behind that intervention are stark. Eight million deepfakes were shared on content platforms in 2025, that’s a sixteen-fold increase from 500,000 in 2023. Deepfake fraud attempts in the UK nearly doubled last year, up 94% year on year according to the Sumsub Identity Fraud Report. Over a third of UK businesses reported being targeted by AI-related fraud including deepfakes in early 2025, up from less than a quarter the year before.

And the cases are no longer abstract. In 2024, a finance worker at Arup, one of the world’s most respected engineering firms, was tricked into wiring £20 million after joining a video conference call where every other participant was AI-generated. Every single person on that call was a deepfake. The employee thought they were talking to senior management. They were talking to criminals.

The Home Office framework is a detection initiative. But detection is only half the problem. The other half, and one the half that matters most to anyone reading this, is what happens when a deepfake targets your organisation and you have to respond.

The Home Office framework is available at gov.uk/government/news/government-leads-global-fight-against-deepfake-threats and is worth reading in full.

The trust chain is already breaking

This is where David Higgerson’s story matters far beyond journalism.

Press Gazette investigations have uncovered over 1,000 articles in the British press attributed to fake, non-existent, and AI-enhanced experts.

One fictitious psychologist was quoted hundreds of times across national outlets before anyone established she wasn’t real. Reach found over 600 instances linked to a single company. And the problem didn’t stop with obviously suspect PR firms.

As Higgerson told Press Gazette this month, Reach has “recently seen previously trusted and well-established PR agencies sharing fake quotes.” The agencies themselves had been duped.

When we spoke to him, Higgerson explained how the chain works. The reporter trusts their sources. The news editor trusts the reporter. The editor trusts the news editor. The reader trusts the outlet. That chain has always been there. What’s changed is that the chain is now being attacked.

Reach has responded by requiring reporters to verify that quoted experts actually exist and that their qualifications stand up.

They’re creating a directory of trusted PR agencies. They’ve warned they won’t hesitate to block agencies that aren’t taking the issue seriously. And Higgerson was clear about why: local news trust is a precious commodity. It’s the one thing that still gives publishers credibility in a world drowning in AI-generated content. If that goes, everything goes.

For the PR industry, this is a wake-up call. If the UK’s largest news publisher is now building verification infrastructure to check whether your expert is real, the relationship between comms professionals and journalists has fundamentally shifted.

The old assumption that the newsroom trusts the agency, and the agency trusts the client is no longer automatic. It must be earned, maintained, and evidenced.

And if that’s the state of play with press releases, imagine the challenge when the threat escalates from a fake quote on a page to a convincing video of your chief executive saying something they never said.

Listen: David Higgerson, Chief Content Officer at Reach plc — coming soon on PR in the Real World

What every comms team should do now

1 Make sure you build good media relations and that the information you supply can be trusted. If you’re not on the list, you won’t be able to get in the media. Reach is just one group but what they’ve done is certain to be followed by others.

2 Make sure your crisis plans include a scenario where someone deepfakes a member of their leadership team.

The core insight is this: you do not need new crisis communications rules for deepfakes. You need to apply your existing reputation management playbook to a new category of threat.

The detection side is a job for IT, for the Home Office framework, and for the technology companies building identification tools. The response side is crisis communications. That is comms territory, and comms should be leading the conversation internally.

In a world where Reach plc has to check whether the expert in a press release is a real person, the question is not whether deepfakes will affect your organisation. The question is whether you will be ready when they do.

The Crisis Plan

Build early warning capability. Set up monitoring for your organisation name, key leaders, and flagship programmes across social platforms. Establish a clear reporting path so employees, stakeholders, or customers can flag suspicious content quickly. This does not need to be expensive. It needs to exist.

Archive your baseline. Keep authenticated photos and video of senior leaders on file. If a deepfake surfaces, having verified original material for comparison is not a nice-to-have. It is your first line of evidence.

Know who is in the room. When something hits, you need your comms lead, your legal counsel, your IT team, and your senior leadership around the same table within hours, not days. Agree who those people are now. Agree how you convene them. Write it down.

Add deepfakes to your next crisis exercise. Your tabletop scenarios probably cover data breaches, operational failures, maybe reputational issues. Add a deepfake scenario. What happens when a convincing video of your CEO appears online making a statement they never made? Who decides whether to respond publicly? What do you say? How quickly can you say it? Test it.

Own the response window. The first 24 to 48 hours define whether you contain a deepfake incident or spend months repairing the damage. Your response messaging should follow standard crisis principles: fast factual denial, clear statement of what is actually true, warning to stakeholders about verifying information through established channels, and context where it helps.

Push the internal conversation now. Comms teams are often the last people consulted about deepfake preparedness. That is backwards. When a deepfake lands, it is not an IT problem first. It is a reputation problem. IT handles detection and containment. Legal handles reporting and evidence preservation. But the response — the thing that determines whether your stakeholders, your customers, your staff, and the public believe you — is a communications challenge. If you are not pushing IT and legal to think about this now, you are waiting to react to a crisis that punishes reaction.

Listen: Amanda Coleman on crisis communications and resilience — PR in the Real World

Further reading:

Home Office deepfake detection framework: gov.uk/government/news/government-leads-global-fight-against-deepfake-threats

Sumsub Identity Fraud Report 2025–2026: sumsub.com/fraud-report-2025

Press Gazette investigation into fake experts: pressgazette.co.uk

Listen to Dave’s episode now!