Executive Deepfake and CEO Fraud Guide: Verification Controls That Work

A cloned executive voice or a live deepfake on a video call can now instruct a finance team to move money, and recognising the face or voice proves nothing. This guide is about the narrow but expensive case of executive impersonation: fraudsters posing as the CEO, CFO, a board member or a senior official to authorise payments, extract confidential information or open a door for a wider intrusion. It concentrates on the verification and finance controls that stop the money leaving, how to design them so executives cannot override them under pressure. It is written for finance controllers, treasury, executive assistants, security and fraud teams. General deepfake techniques are covered in the Deepfake and AI Impersonation Guide and email-led fraud in the Email Identity and BEC Guide; this page does not repeat them.

Key takeaways

• Authority is the attack surface. CEO fraud works because staff are trained to act quickly for senior people, so controls must be written so that seniority never shortens the process.
• Verify the request, not the person on the screen. A call-back to a number held in a system of record, or an approval inside a workflow tool with strong authentication, beats any attempt to judge whether a face or voice is real.
• Payment controls are the last line. Dual approval, payee verification (Confirmation of Payee in the UK, Verification of Payee in SEPA), cooling-off periods for new beneficiaries and hard limits stop losses even when a person is fooled.
• Executives are part of the control. They must publicly commit that they will never ask for secret, urgent payments outside process, and they must accept being challenged with a code phrase or call-back.
• Speed after the event recovers money. A rehearsed playbook that calls the bank's fraud line and law enforcement within hours gives the best chance of freezing funds.

How the attack works

Executive impersonation follows a predictable chain. The fraudster researches the organisation, builds a pretext, opens contact on a channel the target trusts, applies urgency and secrecy, then steers the victim to a payment or disclosure. Public keynote, earnings call and social media recordings supply the raw material for voice clones and face swaps. The NSA, FBI and CISA joint information sheet on deepfake threats lists executive impersonation for financial gain, including business email compromise, as one of the main organisational threats, alongside brand manipulation and fake job candidates.

Typical pretexts are a confidential acquisition needing an immediate deposit, a lawyer or regulator to be paid today, or gift cards and cryptocurrency. FBI public service announcement I-120324-PSA (December 2024) notes criminals generating video for real-time video chats with supposed company executives, and I-121925-PSA (December 2025) describes impersonators asking victims to wire funds to overseas institutions, hand over authentication codes that sync a device with the victim's contacts, and introduce them to associates.

Where it shows up

• Finance and treasury: payment release, new beneficiary set-up, urgent supplier settlements and intercompany transfers. These are the targets with the most direct path to cash.
• Executive assistants and chiefs of staff: they hold calendars, contact details and delegated authority, and they are used to acting on short instructions.
• Help desk and IT: a "CEO travelling and locked out" call asking for an MFA reset or new device. See the Account Recovery and Help Desk Security Guide.
• Executives themselves: FBI warnings I-051525-PSA (May 2025) and I-121925-PSA describe senior officials approached with AI voice messages, moved to encrypted apps and robbed of credentials or codes.
• Banks and payment providers: FinCEN alert FIN-2024-Alert004 (13 November 2024) reports rising suspicious activity reports describing deepfake media used against financial institutions, mainly synthetic identity documents to beat customer verification. Customer-facing verification is covered in the Deepfake-Resistant Identity Verification Guide.

Impact

Direct losses can be large and fast. In the case reported in early 2024, an Arup finance employee in Hong Kong made 15 transfers totalling HK$200 million (about US$25.6 million) after a video call in which the people he believed were the CFO and colleagues were deepfakes. Arup said that none of its internal systems were compromised, which is the point: no malware and no stolen password were needed. Business email compromise as a whole, of which executive impersonation is one form, accounted for an exposed dollar loss of USD 55.5 billion in reports to the FBI between October 2013 and December 2023 (I-091124-PSA). Secondary costs include regulatory reporting, audit findings on payment controls, insurance disputes over voluntary transfers and reputational damage.

Detection

MITRE ATLAS lists deepfake detection (AML.M0034) as a mitigation, but generation is improving faster than detection, so detect the pattern of the fraud instead.

Metrics that show the controls work

• Call-back compliance: percentage of beneficiary changes and above-threshold payments with a recorded independent verification (target 100 per cent, sampled monthly).
• Simulation pass rate: share of finance and assistant staff who verify and report in an authorised executive impersonation exercise.
• Payee verification outcomes: number of close match and no match results, and how many were overridden without independent verification (target zero).
• Control overrides: number of payments released outside dual approval or cooling-off rules, with named approver.
• Time to bank recall: minutes from discovery of a fraudulent transfer to the recall request reaching the bank.

Prevention and hardening

Verification controls

• Call-back to a system of record: for any request to pay, change bank details, share deal documents or reset an executive's credentials, hang up and call a number taken from the HR system, corporate directory or supplier master file, never one given in the request. All three FBI notices cited here make the same recommendation.
• Approval inside the workflow, not on the call: move payment authorisation into the ERP, treasury or e-banking platform, protected with phishing-resistant authentication, so that a request on a call or chat is only ever a prompt to raise a ticket. See the Phishing-Resistant MFA Guide.
• Code phrases and challenge questions: agree a rotating phrase between executives, assistants and treasury, or ask a question only the real person would know. In a July 2024 attempt against Ferrari, reported by MIT Sloan Management Review, an executive stopped a cloned CEO voice by asking the title of a book the CEO had recommended days earlier. Do not use facts an attacker can research, and change the phrase if it is ever used on an unverified channel.
• Video is not verification: the NSA, FBI and CISA sheet notes that identity verification for real-time communications now needs liveness testing; in practice, ask the requester to approve on their registered device instead of trusting the call.

Finance and payment controls

For payment fraud controls beyond executive impersonation, see the Payment Fraud Guide and the APP Fraud Guide.

Reduce the raw material and the trust

• Executive commitment: the CEO and CFO state in writing, and repeat at town halls, that they will never ask for a secret or urgent payment outside process and will thank anyone who challenges them.
• Training for the targets: finance, assistants, help desk and executives get role-specific sessions with realistic voice and video examples, not generic phishing modules (NIST SP 800-53 AT-2(3), CSF 2.0 PR.AT-02). See the Vishing and Smishing Guide.
• Protect executive accounts: phishing-resistant MFA on executives' email and messaging, and a rule that authentication codes are never shared, which defeats the device-sync trick in the FBI warning.

How to implement

1. Map the money paths (weeks 1 to 2): list every way a payment, beneficiary change or confidential disclosure can be authorised, including by phone, chat and "urgent" email exceptions.
2. Write the policy (weeks 2 to 4): call-back rules, code phrase scheme, known channels, dual approval thresholds and the no-exception clause; get board or audit committee approval so executives are bound.
3. Configure the systems (weeks 4 to 8): enforce dual approval and cooling-off in the ERP and banking portal, switch on payee verification results as blocking, and log call-back evidence in the payment record. Run new rules in a report-only period first to measure how many legitimate payments they would delay.
4. Pilot with treasury (weeks 6 to 10): start with the highest-value payment team, collect friction feedback, adjust thresholds. Keep the previous approval matrix documented so you can roll back a threshold that blocks business, without removing the call-back rule.
5. Exercise (quarterly): run authorised impersonation simulations and a tabletop with executives and the bank relationship manager. See the Tabletop Exercise Guide.
6. Prepare the response: keep bank fraud line numbers, the law enforcement reporting route (IC3 in the US, Report Fraud in the UK) and evidence preservation steps in the Deepfake CEO Fraud Response Playbook.

Decision guidance

• Small organisations: rely on simple, absolute rules: two people for every new payee, a call-back to a stored number, and a code phrase between owner and bookkeeper.
• Large organisations: centralise payments in a treasury platform with workflow approvals, add payee verification and analytics on beneficiary changes, and integrate staff reports with the security operations queue.
• Code phrase or device approval: code phrases are cheap and work on any channel but can leak; device-based approval is stronger and auditable but needs the executive's managed device. Use device approval for payments and code phrases as a quick check on calls.

Lessons from incidents

• Escalating from email to video: in the Arup deepfake fraud, the employee was initially suspicious of an email asking for a secret transaction, and the video call overcame that doubt. Lesson: a meeting is not verification; the doubt should have triggered a call-back to a known number.
• A personal question beat a clone: the Ferrari attempt (July 2024) used WhatsApp from an unknown number and a voice imitating the CEO's accent, claiming a confidential acquisition. One challenge question ended it.

Common failure patterns

• Executive override: controls exist but a senior person can waive them by phone, which is precisely what the fraudster asks for.
• Call-back to the number in the message: verifying through contact details the requester supplied verifies nothing.
• Countersigning without checking: the second approver approves on trust because the first approver "already spoke to the CFO".
• Slow escalation: staff wait until the next day to report, losing the window for a bank recall.
• Help desk bypass: an "executive" locked out abroad gets a password and MFA reset by voice alone. See the Callback Phishing (TOAD) Guide for related phone-led pretexts.

Framework mapping

Practitioner checklist

• Publish a board-approved rule that no executive can waive payment or verification controls, and have the CEO and CFO announce it.
• Require a call-back to a number from a system of record for every beneficiary change, above-threshold payment and executive credential reset.
• Move payment authorisation into a workflow or banking platform with phishing-resistant authentication.
• Enforce dual approval with independent verification by the second approver.
• Turn on Confirmation of Payee or Verification of Payee and treat close match, no match and not possible as stops.
• Apply a cooling-off period and aggregate limits to new beneficiaries.
• Run role-specific training and quarterly impersonation simulations for finance, assistants and help desk.
• Keep bank fraud lines and law enforcement routes in a tested response playbook, and measure time to bank recall.

Standards and references

• NSA, FBI and CISA: Contextualizing Deepfake Threats to Organizations
• FinCEN: FIN-2024-Alert004, Fraud Schemes Involving Deepfake Media Targeting Financial Institutions
• FBI IC3: Senior U.S. Officials Continue to be Impersonated in Malicious Messaging Campaign
• FBI IC3: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
• FBI IC3: Business Email Compromise: The $55 Billion Scam
• European Payments Council: Verification Of Payee scheme
• Pay.UK: Confirmation of Payee
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Deepfake and AI Impersonation Guide · Email Identity and BEC Guide · Deepfake CEO Fraud Response Playbook · Payment Fraud Guide