AI Phishing and Deepfakes: Stop CEO Fraud

Criminals now use AI to write flawless phishing emails, clone an executive's voice and even impersonate several people at once on a video call. The goal is almost always the same: get someone in your company to wire money or hand over credentials. The good news is that the most effective controls are not technical but procedural: verify through an independent channel and require dual approval for payments.

What changed: AI phishing, voice cloning and deepfakes

Business email compromise (BEC), often called CEO fraud, is a scam in which the attacker impersonates an executive, vendor or attorney to obtain a wire transfer or sensitive data. It is not new; what AI changes is quality and scale:

AI-written phishing: personalized messages in your company's tone, without the typos that used to give scams away.
Voice cloning: a call or voicemail in your CFO's voice, generated from public recordings such as podcasts, webinars or earnings calls.
Deepfake video: a fake face and voice of a real person on a live video call or recorded clip.

The FBI warned in December 2024 that criminals use generative AI to commit fraud at greater scale and with more believability, including generating video for real-time chats with supposed company executives. The IC3 2025 Internet Crime Report recorded 24,768 BEC complaints with more than USD 3 billion in reported losses, and over 22,000 complaints referencing AI. FinCEN issued a separate alert in November 2024 on fraud schemes using deepfake media against financial institutions.

The Arup case: a USD 25 million fake video call

The most cited case happened in January 2024 at the Hong Kong office of Arup, the UK engineering firm. A finance employee received a message that appeared to come from the company's UK-based CFO about a confidential transaction. He was suspicious, but then joined a video call where he saw and heard the CFO and other colleagues. All of them were deepfakes. Convinced, he made 15 transfers to five bank accounts totaling HK$200 million (about USD 25 million). He only discovered the fraud after checking with headquarters.

Arup confirmed in May 2024 that fake voices and images were used and that none of its internal systems were compromised. That is the key lesson: there was no technical hack. The attack exploited trust and the absence of independent verification before paying.

Red flags

Urgency plus secrecy: "This must go out today" combined with "keep this between us" is the classic fraud signature.
Changed bank details: a vendor "updates" its payment instructions by email or text.
Unusual channel: the executive writes from a new number, a personal email or a lookalike domain.
Bypassing process: a request to skip the usual approval "just this once".
Video calls without real interaction: participants who dodge unexpected questions, unnatural movement, lip-sync lag, or an excuse to keep cameras off.
Emotional or hierarchical pressure: veiled threats, flattery or rank used to shut down questions.

Visual tells will keep getting less reliable as the technology improves. Do not build your defense on employees "spotting" the deepfake; build it on a process that forces verification.

Process controls: what actually stops the fraud

Situation	Control
Urgent wire request from an executive	Call back on a known number on file, never the one in the message
Vendor bank detail change	Independent-channel confirmation and a hold period before the first payment to the new account
Payments above a set threshold	Dual approval by two different people in the banking platform
Video or voice request for money	Pre-agreed code word or challenge question, plus confirmation outside the call
Any exception to the process	Written policy: nobody, including the CEO, can waive verification

This is exactly what the FBI recommends: hang up, look up the official contact for the person or organization, and call them directly. Verification must be out-of-band, through a channel the attacker does not control. Replying to the same email thread or text proves nothing.

Culture matters as much as policy. Your CEO should say publicly that they will never be annoyed by someone verifying their request. Without that backing, employees give in to pressure.

Technical controls that support the process

SPF, DKIM and DMARC: SPF lists which servers may send mail for your domain, DKIM signs messages, and DMARC tells receivers what to do with failures (ideally reject them). They stop exact-domain spoofing, not lookalike domains.
Phishing-resistant MFA: FIDO2 security keys or passkeys. CISA warns that SMS codes, authenticator app codes and push notifications can be phished or bypassed, while FIDO will not release credentials to a fake site. Prioritize finance, executives and admins.
Email filtering: impersonation detection, malicious link and attachment scanning, and a visible "external sender" banner.
Lookalike domain monitoring to catch suspicious registrations early.
Banking controls: transfer limits, approved payee lists and alerts in your commercial banking platform.
Reduced public exposure: fewer unnecessary executive audio and video clips online, the raw material for voice cloning.

Our cybersecurity services review email authentication, MFA and access configuration as part of a security assessment. If you want these controls formalized in a management system, see our guide to ISO 27001 for SMBs and startups.

Training your people

Training works when it is specific and practical. Prioritize the people who can move money or data: finance, treasury, executive assistants, procurement and HR.

Show real examples of fake emails, voice messages and videos, including the Arup case.
Run periodic phishing simulations and also vishing (voice) simulations, framed as learning, not punishment.
Drill the procedure, not just detection: "for any unusual payment request, I verify on the number on file".
Make reporting easy: one simple channel to flag a suspicious attempt, and recognition for people who use it.

What to do if it already happened

Call your bank immediately and request a recall of the wire. The FBI stresses that time is of the essence; in 2025 its Recovery Asset Team helped freeze funds in 58% of the Financial Fraud Kill Chain incidents it initiated.
File a complaint at ic3.gov regardless of the amount, with full transaction details.
Preserve evidence: emails with full headers, voicemails, screenshots, phone numbers and payment records.
Reset credentials and review access if passwords were stolen or a mailbox was compromised, including attacker-created forwarding rules.
Assess legal obligations: if personal data was exposed, state breach notification laws may apply; involve counsel and your cyber insurer early.
Find the root cause and fix the process that allowed the payment.

Ideally, all of this is written down before you need it. Our guide to building a cybersecurity incident response plan walks you through it.

Frequently asked questions

Can you detect a deepfake on a video call?

Sometimes there are tells: lip-sync lag, stiff movement, inconsistent lighting or odd reactions to unexpected questions. But quality is improving fast and visual detection should not be your defense. The reliable control is process: any request for money or sensitive data is confirmed through an independent channel, such as a call to a number already on file, no matter how convincing the video call looks.

What is business email compromise (BEC)?

BEC is a scam in which a criminal impersonates or takes over the email of an executive, vendor or advisor to trick an employee into wiring money or sharing information. The FBI's definition also covers compromised phone numbers and virtual meeting applications. With AI, BEC now includes flawless emails, cloned executive voices and even video calls with fake participants.

Does DMARC stop phishing?

DMARC, together with SPF and DKIM, stops attackers from sending email as your exact domain, provided the policy is set to quarantine or reject. It does not stop lookalike domains, free webmail accounts or a vendor's real but compromised mailbox. It is necessary but not sufficient, and must be combined with payment verification and training.

How fast do we need to act after a fraudulent wire?

Immediately. Contact your bank to request a recall and file an IC3 complaint the same day. The IC3 Recovery Asset Team works with banks through the Financial Fraud Kill Chain to freeze funds, and it can follow money to second-hop accounts when you provide the details. Every hour of delay makes it more likely the funds have already moved.

Does cyber insurance cover CEO fraud losses?

It depends on the policy. Some cyber or crime policies cover social engineering fraud, but many exclude it or apply low sublimits, and they often require controls such as dual approval and call-back verification to have been in place. Review the terms with your broker before an incident, not after.

Conclusion

AI made impersonation fraud cheaper, more convincing and more scalable, but it did not change its weak point: it needs someone to act without verifying. Call-backs to known numbers, dual payment approval, code words, phishing-resistant MFA and properly enforced DMARC close most of the doors without major investment.

If you want to review your company's processes and controls against this kind of fraud, our cybersecurity services team, working in UTC-5 alongside US business hours, can help. Book a free consultation.

AI Phishing, Voice Cloning and Deepfakes: How to Protect Your Business from CEO Fraud