Deepfake CEO Fraud: Is Your Payment Control Ready?

In early 2024, a finance employee in the Hong Kong office of the engineering firm Arup joined a video call with the company's chief financial officer and several colleagues. The request was urgent and confidential. Over the following days the employee made fifteen transfers totalling around HK$200 million, roughly US$25 million. Every other person on that call had been generated by criminals using deepfake technology.

The employee had been suspicious of the original email. The video call removed the doubt. That is the point: deepfakes are not designed to fool systems. They are designed to defeat the human checks we have relied on for decades, such as recognising a voice or seeing a face.

What has changed

Business email compromise is not new. Criminals have impersonated executives by email for years, and finance teams learned to be wary of an unusual request in the inbox. What has changed is the cost of impersonation. A few minutes of audio from an earnings call, a conference talk or a social media video is enough to clone a voice. Convincing video of a known face is now within reach of ordinary criminal groups.

So the advice many organisations still give, "if in doubt, call the person", is no longer enough on its own. If the call itself can be faked, the check has to be something the criminal cannot control.

A familiar voice or face is no longer proof of who you are talking to.

The controls that still work

1. Call back on a number you already hold

Never verify a request using contact details supplied in the request. Hang up and call the executive on the number in the company directory, or reach them through a separate channel such as their assistant. This simple step defeats almost every impersonation, deepfake or not.

2. Dual approval that cannot be talked around

Payments above a threshold should need a second approver in the system, and that rule must apply even when the request appears to come from the chief executive. If one convincing call can bypass the control, it is not a control.

3. Treat changes to bank details as high risk

Many frauds do not ask for a new payment. They ask to change where an existing supplier is paid. Any change to supplier bank details should be verified independently with the supplier, using details already on file, before it takes effect.

4. Make it safe to say no

Fraudsters rely on urgency, secrecy and seniority. Staff need explicit permission from leadership to pause any payment request that bypasses normal process, without fear of blame. Leaders should say publicly that they will never ask for a secret urgent transfer.

5. Agree a verification phrase for the rare exception

For genuinely urgent, out of process payments, some organisations use a pre agreed code word or challenge question known only to the small group involved, changed regularly and never shared by email or chat.

6. Rehearse it

Include deepfake scenarios in awareness training and run realistic exercises with the finance team. People who have heard a cloned voice in a safe setting are far more likely to pause in a real one.

What auditors should test

Payment approval rules. Confirm that thresholds and dual approval are enforced by the system, and check whether any user, including senior management, can override them.
Supplier bank changes. Sample recent changes and look for evidence of independent call back verification.
Urgent payments. Review payments processed outside the normal cycle and ask how each request was verified.
Policy and training. Check that the payment policy explicitly covers voice and video requests, and that finance staff have been trained on them.
Executive exposure. Ask whether the organisation has considered how much executive audio and video is publicly available.

Four questions for leadership

Could a single convincing call from "the CEO" move money out of our accounts today?
How do we verify a change to a supplier's bank details?
Have we told our finance team, in writing, that they will never be blamed for pausing an urgent request?
When did we last test our payment process against an impersonation attempt?

Deepfakes make impersonation cheap, but they do not change what stops it. Verification through a channel the criminal does not control, approvals that nobody can talk around, and a culture where pausing is praised rather than punished. Those controls worked against fake emails, and they still work against fake faces.