Deepfake CEO Fraud Response Playbook: Stopping Impersonation Payments

A cloned voice or a live deepfake video of a senior executive can talk a trusted employee into moving money in a single afternoon, and every hour of delay lowers the chance of getting it back. This template gives [Organisation] a ready-to-adopt playbook for suspected and confirmed deepfake CEO fraud: a synthetic voice note, call or video meeting that impersonates an executive to authorise a payment, change bank details or release sensitive data. It is written for security operations, finance, treasury, legal and executive assistants, and it assumes the fraud may already have succeeded. Replace every [bracketed] placeholder, agree the decision owners in advance and rehearse it before you need it. For the threat itself, see the Executive Deepfake and CEO Fraud Guide.

How to use this template

• Adopt, then tailor: copy sections 1 to 8 into your incident response plan, replace [Organisation], [Finance Director] and other placeholders, and delete steps that do not apply to your payment rails.
• Link, do not duplicate: where the fraud started with a compromised mailbox, run this playbook alongside the Business Email Compromise Response Playbook; deepfake fraud often combines a spoofed or hijacked email thread with a voice or video "confirmation".
• Time matters more than certainty: sections 3 and 4 are designed to run in parallel. Start the bank recall before the investigation is complete.
• Evidence first, deletion never: instruct staff not to delete voice notes, chat threads or meeting recordings, even if embarrassed.
• Review annually and after every exercise or incident. Owner: [Head of Security Operations].

1. Scope and triggers

1.1 This playbook applies to any request, received by any channel, that appears to come from an executive, board member, adviser or business partner and uses synthetic or manipulated audio, video or imagery to authorise or accelerate a financial or data action.

1.2 Triggers. Invoke the playbook when any of the following occurs:

1. An employee reports a call, voice note or video meeting with an executive that felt wrong: unusual urgency, secrecy, a new account, odd latency, flat tone or an inability to answer a simple personal question.
2. A payment, payee creation or bank detail change was approved on the strength of a voice or video instruction that the named executive denies.
3. Treasury or the bank flags an unusual outbound transfer, particularly several transfers to new beneficiaries in a short period.
4. An executive reports that their voice or likeness is being used, or that contacts received messages "from" them on WhatsApp, Signal, Teams or a personal number.
5. Threat intelligence or law enforcement warns of a campaign targeting [Organisation] or its sector. The FBI has warned since April 2025 of AI voice messages impersonating senior US officials to build rapport and steal account access.

1.3 Out of scope: customer-facing identity verification fraud (see the Deepfake-Resistant Identity Verification Guide) and hiring fraud.

2. Roles and contacts

2.1 Keep an out-of-band contact sheet, printed and stored offline, with bank fraud desk numbers for every account, the cyber insurer's breach line, the local police cyber unit and, for US entities, the FBI field office and IC3. Never take a callback number from the suspect request itself.

3. Detection and triage

3.1 The first person to suspect fraud stops the action and calls the security hotline [number]. They must not reply to the suspect thread or join a follow-up call.

3.2 The Incident Lead answers three questions within [15] minutes:

1. Has money or data moved? Ask Treasury for every payment, payee creation and bank detail change touched by the requester in the last [10] business days.
2. Is the executive genuine? The Executive Verifier calls the executive on the number in the corporate directory or meets them in person. A reply on the same chat, email thread or video link proves nothing.
3. Is an account compromised? IT checks whether the request came from a real internal mailbox or Teams account (compromise) or an external lookalike (impersonation only).

3.3 Severity.

3.4 Decision point A: if the executive cannot be reached within [30] minutes, treat the request as fraudulent and proceed. Nobody is penalised for delaying a genuine payment under this rule.

3.5 Evidence to preserve: voice notes and call recordings in their original format, phone numbers and caller ID, chat exports with timestamps, meeting invites, join links and the platform's participant and sign-in logs, email headers, payment instructions, beneficiary names, account numbers, IBAN or SWIFT/BIC codes, and the names of everyone on the call. Record who touched each item.

4. Containment

1. Stop outgoing money. Treasury holds every pending payment to the beneficiaries named, freezes new payee creation for the affected entity for [24] hours and alerts other finance staff by phone.
2. Request a recall at once. The FBI advises victims to contact their financial institution immediately, request a recall of the funds and ask for any indemnification documents. Give the bank the transaction references, amounts, receiving bank and account details. For international wires, ask the bank to send a recall request through its correspondent network the same day.
3. Report to law enforcement. In the US, file at ic3.gov as soon as possible, whatever the amount; the FBI notes IC3 may help financial institutions and law enforcement freeze funds. Elsewhere, report to [national fraud reporting service] and quote the crime reference to the bank.
4. Contain accounts. If a real account sent the request, reset its password, revoke sessions and refresh tokens, remove unknown MFA methods, mailbox forwarding and inbox rules, and check OAuth consents. See the Account Takeover Prevention Guide.
5. Cut the attacker's channel. Block the sender numbers, domains and external collaboration tenants, and report impersonating accounts to the platform.
6. Warn likely next targets. Finance, payroll, executive assistants and subsidiary finance teams receive a short alert: the executive's name, the channel used and the rule "verify on a known number".

Decision point B: whether to publicly confirm the incident or approach the receiving bank directly is decided by Legal Counsel and the Executive Sponsor, not the Incident Lead.

5. Eradication

5.1 Identify how the attacker prepared: public video and audio of the executive (keynotes, podcasts, earnings calls), leaked org charts, and which employees were named. Map the attack against MITRE ATT&CK, typically T1598.004 Spearphishing Voice for reconnaissance, T1566.004 Spearphishing Voice for initial access and T1585.001 Social Media Accounts where fake profiles were created.

5.2 Remove any persistence found in section 4: inbox rules, forwarding, rogue OAuth apps, added MFA devices, new payees and altered vendor master records.

5.3 Close the process gap that was exploited. Typical causes: a single approver for high-value payments, a callback that used the number in the request, or a "confidential deal" exemption that bypassed controls.

6. Recovery

1. Track recovery daily with the bank: amounts frozen, returned and lost. Keep the indemnity paperwork the bank asks for.
2. Notify the cyber or crime insurer within the policy's notice period [days] and record the claim reference. Check whether social engineering fraud is covered or sub-limited.
3. Re-enable payee creation only after the dual approval control in the Implementation guidance is live.
4. Verify the vendor master file against independently sourced bank details for any supplier the attacker referenced.
5. Support the employee who was deceived. Blame drives under-reporting, and the next report may be the one that stops a loss.

7. Communication and notification

7.1 IC3 asks for identifying details of the individuals (names, numbers, emails), transaction details (dates, payment types, amounts, account numbers, receiving institution, any cryptocurrency addresses) and a description of how contact started and what was requested. Collect these in section 3.5 so the report takes minutes.

7.2 If personal data was released, Legal Counsel assesses data protection notification duties, for example the 72-hour supervisory authority deadline under UK and EU GDPR Article 33.

8. Post-incident review

8.1 Hold a blameless review within [10] business days. Record the timeline from first contact to detection, to bank recall, to recovery.

8.2 Answer: which control should have stopped it, why it did not, how long the recall took, what the employee saw that felt wrong, and whether the executive's public media gave attackers enough material to clone them.

8.3 Lesson from the Arup deepfake fraud: a finance worker who first suspected phishing was reassured by a multi-person video call in which, Hong Kong police said, every other participant was a deepfake. He made 15 transfers to five accounts, about HK$200 million, before contacting head office directly. The single control that worked, an independent call to a known contact, came after the money had gone. Move that call to before the first payment.

8.4 Feed findings into awareness training, the payment policy and the next tabletop, using the Tabletop Exercise Scenario Pack.

Implementation guidance

Controls that make this playbook work. Response is far easier when prevention controls are already in place:

Rollout.

1. Week 1 to 2: name the role owners, build the offline contact sheet and confirm each bank's fraud desk process and recall cut-off times.
2. Week 3 to 4: agree the payment threshold and callback rule with the CFO; publish it as policy so employees can refuse executives without fear.
3. Month 2: run a tabletop with a simulated cloned-voice call to the finance team; time the path from report to recall request.
4. Month 3: add detection, such as treasury alerts for multiple transfers to new beneficiaries in one day.
5. Rollback: if the callback rule blocks legitimate urgent payments, lower friction by pre-registering trusted beneficiaries, not by removing the callback.

Small vs large organisations. A small business may have one finance person: the callback rule then goes to the owner's personal known number, and the bank's own payment confirmation features become critical. Large groups should centralise payee creation and apply the same rule to every subsidiary, where attackers often aim.

Metrics. Time from report to bank recall request (target under [1] hour); percentage of high-value payments with a recorded callback; payee changes verified independently; staff reporting rate in simulations; funds recovered as a share of funds lost; days since the contact sheet was last tested.

Where identity fits. Deepfakes attack the human verification layer, so the fix is a verification channel the attacker cannot clone: known numbers, strong authentication on the executive's real accounts and signed approvals in the payment system. See the Deepfake and AI Impersonation Guide.

Standards and references

• FBI IC3: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
• FBI IC3: Public Service Announcement on AI Voice Messages Impersonating Senior US Officials
• FBI IC3: Business Email Compromise: The $55 Billion Scam
• NIST: SP 800-61 Rev. 3 Incident Response Recommendations
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• MITRE ATT&CK: T1566.004 Spearphishing Voice

Related NHI Mgmt Group resources: Executive Deepfake and CEO Fraud Guide · Business Email Compromise Response Playbook · Authorised Push Payment (APP) Fraud Guide · Incident Response Guide