Deepfake-Enabled Social Engineering Attacks in Higher Education: Emerging Risks and Defense Strategies

To say that the advent of generative AI has reshaped the threats of social engineering is an understatement, as it allows hackers to create more believable synthetic content, such as deepfake audio, video, and text, than ever before. Additional vulnerabilities of Higher Education Institutions (HEIs) arise from their architecture based on openness, being made of users with different backgrounds and academic traditions, funding limitations, and emphasis on accessibility. Using the systematic literature review (SLR) method and following the PRISMA 2020 protocol, the study identifies four themes: (1) deepfake attack evolution from single-channel phishing to multi-channel scams, (2) limitations of human recognition of deepfakes and technology under real-life conditions, (3) vulnerabilities of academic institutions, and (4) fragmentation of existing defenses: technology, human-centered, and governance. A systematic review and meta-analysis of 56 studies involving 86,155 participants reported an overall human deepfake-detection accuracy of 55.54%; however, the confidence interval included chance-level performance. This estimate reflects evidence aggregated across the populations and experimental tasks represented in the meta-analysis and should not be interpreted as an operational detection rate for higher education institutions (HEIs). Separately, Barnekow et al. reported that participants correctly detected approximately 37% of synthetic voice samples imitating a university professor in a specific German-language online-teaching scenario. This result illustrates a potential vulnerability in academic voice impersonation but cannot be generalized to all HEI populations or settings. On another hand, the accuracy of the transformer-based detectors is quite good at 94-98% in controlled conditions. However, none of the reviewed frameworks discuss the issue of multimodal deepfake coverage, HEI-specific vulnerabilities, and governance-related issues, including the occupational safety of educators simultaneously. The paper utilizes this synthesized information to propose Integrated HEI Deepfake Defense Architecture (IHDDA), a six-layer framework designed specifically for HEI restrictions and governance practices. The results have immediate implications for university cybersecurity policy, faculty digital safety, students' identity protection, and AI governance in educational institutions, especially within resource-strained environments in developing countries.