Your CEO's Voice Is Not Your CEO: Deepfake Fraud Is Here
December 1st, 2026
Your CEO is on the phone. The voice is right. The rhythm, the accent, the way they say your name. They need a wire transfer approved in the next twenty minutes, and they are not happy about being questioned.
That call may not be from your CEO. Voice cloning tools can produce a convincing copy from a few seconds of clear audio. A public earnings call, a podcast, a conference talk, a voicemail greeting, or a social media video is enough source material. Video is no longer a reliable check either. Real-time face swapping is accessible, and a video call full of familiar faces can be fabricated.
For a business, the danger is not that every deepfake is perfect. The danger is that urgency, authority, and a familiar voice combine to override a process that should have caught the fraud anyway.
The Call That Cost $25 Million
In February 2024, an employee at the engineering firm Arup joined a video conference with what appeared to be the company's chief financial officer and several colleagues. The employee was told about a confidential transaction and instructed to transfer HK$200 million, about US$25 million. Every other participant on the call was a deepfake. The employee eventually transferred the money. Police said only the employee was real.
Voice-only attacks follow the same pattern at smaller amounts. A criminal clones an executive, a supplier, or a family member, creates urgency, and asks for a payment, gift cards, credentials, or help bypassing a password reset. Some attacks skip money entirely and target access. A convincing call to the help desk can reset multi-factor authentication for an account the attacker then takes over.
The FBI's Internet Crime Complaint Center has reported billions of dollars in losses from business email compromise, and voice and video impersonation are now part of the same playbook. The common thread is not technical sophistication at the victim's end. It is a request that arrives through a channel the employee trusts, with no independent verification.
Why the Usual Defenses Miss It
Email security does not screen a phone call. Caller ID is a display name, not proof of identity. It can be spoofed, and a call from the CEO's number is exactly what the attacker wants you to see. A video call feels more trustworthy, but seeing a face is not authentication either.
The attack also exploits normal human behavior. Employees are trained to respond to executives, to move quickly on urgent requests, and to avoid embarrassing a senior leader with too many questions. A live conversation makes the pressure feel personal in a way an email does not.
AI detection tools can help at the margins, but they are not a control you should rely on. Detectors produce false positives, the technology changes quickly, and a short voice call may not provide enough material to analyze. The useful question is not whether the voice sounds fake. It is how the request can be verified without trusting the channel it arrived on.
Voice and Video Are Not Authentication
Authentication requires something an attacker cannot reproduce from public information. A voice is public. A face is public. A job title is public. None of them proves that the person on the call has the authority to move money or change a bank account.
Treat every voice or video request as a claim, not a credential. The claim may be true. It still needs verification through a channel the attacker does not control.
Verify the Request, Not the Voice
The core control is simple: confirm the request out of band, using contact information your business already has. Call the executive back on the number in your directory or on their known mobile number. Do not use the number the caller supplies, the number in the email signature, or the caller ID on the call.
For payments and bank-detail changes, one callback is not enough. Use two people, and make sure the second person independently verifies the request with the vendor or executive through a known contact. The person who initiates the payment should not be the only person who approves the verification.
This feels slow in the moment. It is much faster than recovering a wire transfer, explaining the loss to your insurer, and rebuilding trust with a client whose invoice was diverted.
The Controls That Actually Work
- A written payment-verification policy. Define which requests need a callback, who can approve them, and what happens after hours. The policy applies to executives too. Especially to executives.
- Dual authorization. Require two approvers for wires, ACH changes, vendor bank-detail updates, payroll changes, and any request above a set threshold.
- Known-contact verification. Use a phone number from your vendor master file or employee directory, not one supplied in the request. If a vendor says its bank account changed, call the vendor's published main line and confirm with a person you know.
- Help-desk identity proofing. Do not reset MFA or hand out temporary credentials on the strength of an inbound call. Verify with a manager, a callback, or an in-person process, and log the exception.
- Least privilege and separation of duties. The person who can create a vendor should not be the person who can approve a payment to it. Finance systems need MFA, individual accounts, and a review of who can change banking information.
- Email authentication and lookalike-domain monitoring. Publish DMARC, DKIM, and SPF records. Watch for domains that imitate yours. Warn users on external email, and block automatic forwarding to outside addresses.
- Training with drills. Teach employees to stop, verify, and escalate. Run a test in which someone plays the role of an executive asking for an urgent payment. Praise the employee who challenges it. Never punish someone for following the callback policy.
- Incident response for fraud. Know the bank's fraud line, your insurer's notification requirements, and who calls legal. A wire recall has a short window. Practice the first hour before you need it.
What to Do in the First Hour
If you suspect a fraudulent transfer, act in parallel:
- Call your bank's fraud or wire-recall line immediately. Give the transaction details and ask for a recall.
- Notify your insurer and legal counsel according to your incident-response plan.
- Preserve the call records, emails, messages, and any account numbers the attacker supplied.
- Report the incident to the FBI's IC3 at ic3.gov and to local law enforcement.
- If credentials or MFA were exposed, reset them, revoke sessions, and check for forwarding rules or new mail-flow rules.
- Tell affected clients or vendors if their information or money was involved, and follow any legal notification requirements.
Speed matters, but so does evidence. Do not delete the messages or clean up the mailbox before someone preserves them.
Make the Policy Stick
A policy that exists only in a binder does not stop a wire. Make the callback part of the finance workflow, not an optional step. Put the verification requirement in the payment system. Require a second approver in the banking portal. Give the help desk a script and the authority to say no.
Review the policy after every near miss. Ask the person who received the call what made them hesitate, and fix that part of the process. Attackers adapt. The verification habit has to be boring, repeatable, and expected at every level of the company.
At BTS Technologies, our cyber security services help Alabama businesses build layered defenses around identity, email, endpoints, and response. For related reading, our post on how generative AI is making phishing scams more realistic covers the email side, and your biggest security risk may be a well-meaning employee explains why training and process matter as much as technology.
Want to test whether your payment and help-desk controls would survive a deepfake call? Contact our team to schedule a fraud-readiness review.
Posted in: Cyber Security