A deepfake can be a cloned voice, a manipulated photograph or a full video of a person saying and doing things they never did. The term covers any of these, as long as the output is meant to pass as the real person.
The costliest public case so far is Arup, whose Hong Kong employee made 15 transfers worth about US$25.6 million after a video call in which the other attendees were synthetic. Nothing was hacked. A person was persuaded by faces and voices they recognised.
For organisations, the lesson is that seeing and hearing someone is no longer enough to authorise a payment or a change of bank details. Controls need to rest on something an attacker cannot copy, such as a call-back to a known number or a held device.