Deepfake and Payment Fraud: Executive Briefing

A convincing voice or face on a call is no longer evidence that a senior executive is really asking for money, and payment controls built on that assumption now fail against cheap, widely available tools. This briefing is for board members, chief executives, finance directors and audit and risk committees who oversee how the organisation moves money. It covers chief executive impersonation using cloned voices and video, business email compromise (BEC) losses, the verification controls that stop fraudulent payments, how the UK's authorised push payment (APP) reimbursement rules do and do not protect businesses, and the questions and red flags that tell directors whether the controls are real. It stays at board level. The step-by-step response is in the Deepfake CEO Fraud Response Playbook, and the practitioner detail on detection and impersonation is in the Executive Deepfake and CEO Fraud Guide.

The risk in one paragraph

Criminals impersonate executives, suppliers and advisers to persuade staff to send money, change bank details or bypass approval steps. The impersonation used to be an email; now it can be a cloned voice on the phone or a live video call populated by synthetic colleagues. The FBI warned in December 2024 that criminals use AI-generated video in live chats to pose as company executives and use short audio clips to clone voices. The money usually leaves through a legitimate, authorised bank transfer, which means the bank may treat it as the customer's decision and the organisation may carry the whole loss. The board's job is to make sure no single person, however senior the voice on the line, can move significant money without an independent check through a channel the attacker does not control.

Why this is a board-level issue now

The losses are large and rising: the FBI's Internet Crime Complaint Center (IC3) 2025 Internet Crime Report records 24,768 BEC complaints with adjusted losses of just over $3.04 billion in 2025, out of $20.877 billion in total reported losses.
AI is now visible in the statistics: the same report counts 22,364 AI-related complaints with about $893 million in losses, including more than $30 million linked to AI-enabled BEC. Reported figures understate the problem because many victims do not report.
A single call can cost millions: in January 2024 a finance employee at engineering firm Arup made 15 transfers totalling HK$200 million after a video call in which the chief financial officer and colleagues were deepfakes. See the Arup Deepfake Fraud 2024 analysis.
Business victims are mostly outside reimbursement schemes: UK Finance's Annual Fraud Report 2026 shows £576.4 million of APP fraud losses in 2025, £75.6 million of them non-personal (business) losses, and the UK reimbursement rules cover individuals, microenterprises and charities, not larger companies.
It tests governance, not technology: the attack exploits authority, urgency and secrecy. Only the board can make it safe for a junior employee to delay a payment the chief executive appears to have ordered.

How the attacks work

Scheme	What staff see	Why it works	Control that breaks it
Chief executive or CFO impersonation	Urgent, confidential request for a transfer, often linked to an acquisition or legal matter, by email, messaging app, voice call or video	Authority and secrecy discourage checking	Call-back to a number held on file, second approver, no exceptions for seniority
Supplier bank detail change (invoice redirection)	A known supplier announces new bank details, sometimes from its real but compromised mailbox	The relationship and the invoice are genuine; only the account changes	Independent verification of any bank detail change, payee name checks, holding period on new details
Adviser or lawyer impersonation	Instructions to pay completion funds, settlements or deposits to a new account	High value, deadline pressure, external party	Pre-agreed verification with advisers at engagement, call-back on known numbers
Help desk and account takeover	A caller posing as an executive resets credentials, then approves payments from the real account	The payment then comes from a legitimate login	Strong help desk identity checks, phishing-resistant MFA, payment approval tied to authenticated systems

For the supplier route in depth, see the Invoice Redirection and Supplier Bank Detail Fraud Guide. For help desk attacks, see the Vishing and Help Desk Social Engineering Awareness Guide.

Verification controls that stop the money

Deepfake detection tools can help, but they are not the primary control. The controls that work assume the voice or face may be fake and verify the request through something the attacker cannot reach.

Control	What it means in practice	Board-level evidence to ask for
Out-of-band call-back	Any payment request or bank detail change is confirmed by calling a number already held on file, never one in the request. The FBI advises hanging up and calling back on an independently found number.	The written procedure and a sample of call-back records
Dual approval	Two independent people approve payments above a threshold and every new or changed beneficiary. See the Dual control and four-eyes approval guide.	Thresholds, system enforcement (not just policy) and override reports
Payee name checks	Use Confirmation of Payee in the UK, or equivalent payee verification elsewhere, and treat a mismatch as a stop. See the Confirmation of Payee and Payee Verification Guide.	Mismatch rate and what happened on each mismatch
No-exceptions rule for seniority	A published rule that the chief executive and directors will never ask anyone to skip verification, and that delaying a payment to verify is always acceptable	A board-approved statement communicated to finance and treasury staff
Payments only through authenticated systems	Approvals happen in the banking or ERP platform with phishing-resistant MFA, not by email, chat or phone	Coverage of phishing-resistant MFA for payment approvers
Code words or challenge questions	Pre-agreed verification phrases for the small group who can instruct urgent payments. The FBI recommends secret words for families; the same idea works for executive teams.	Who holds them, how they are rotated
Limit public material	Review how much executive audio and video is public, accepting that much cannot be removed	A view from communications and security on exposure

Our view at NHI Mgmt Group is that the same principle should apply to machines. Where AI agents or automated workflows can initiate or approve payments, they need their own scoped identity, approval limits and a human or independent check for new beneficiaries; an agent that acts on any instruction arriving in its inbox is a new route for the same fraud.

APP reimbursement: what it does and does not cover

In the UK, the Payment Systems Regulator's APP fraud reimbursement requirement applies to payments made on or after 7 October 2024 over Faster Payments or CHAPS. According to the PSR's consumer guidance:

Who is covered: individuals, microenterprises and charities. Larger businesses are not listed as covered, so most corporate victims must rely on their own controls, recovery efforts and insurance.
How much: up to £85,000 per claim, with an optional excess of up to £100.
Time limits: claims must be made within 13 months of the payment, and firms should reimburse within five business days, extendable to 35 business days while they gather information.
Exceptions: no reimbursement where the victim was complicit or grossly negligent; the gross negligence exception does not apply to vulnerable consumers.
Who pays: the sending and receiving firms share the cost equally.

UK Finance reports that banks reimbursed £354.3 million, 61% of APP losses, in 2025, while the PSR reports that firms now reimburse 97% of claims in scope of its policy; the figures cover different scopes. For a board, the practical point is simple: if your organisation is larger than a microenterprise, assume a fraudulent authorised payment is your loss unless funds are recovered quickly. See the Authorised Push Payment (APP) Fraud Guide.

Speed matters for recovery. The IC3 report says its Recovery Asset Team handled 3,900 incidents in 2025 and froze about $679 million of $1.16 billion in attempted theft, a 58% success rate. In the UK, fraud and cyber crime are reported to Report Fraud (reportfraud.police.uk, 0300 123 2040), which replaced Action Fraud on 4 December 2025; in Scotland, report to Police Scotland on 101. In the US, contact the bank immediately to request a recall and file at ic3.gov.

Five questions for the board to ask

Can any single person move significant money? Ask for the payment threshold above which two independent approvers are required, and whether the banking system enforces it or only policy does.
How do we verify a bank detail change or an urgent request from an executive? The answer should name a call-back to a number on file and a holding period, not "we know their voice".
Have we told staff, in writing from the top, that they will never be penalised for delaying a payment to verify it? If not, the authority of a cloned voice will beat the procedure.
What would happen in the first hour after a fraudulent transfer? Who calls the bank, who reports to the police, who preserves evidence? Ask when it was last rehearsed.
Are our insurance and reimbursement assumptions accurate? Ask whether the cyber or crime policy covers social engineering transfers, at what sub-limit, and whether management has confirmed the organisation falls outside APP reimbursement.

Red flags in management answers

"Our finance team knows the executives well enough to spot a fake." Recognition is exactly what deepfakes defeat.
Dual approval exists in policy but can be overridden by one senior person, or the override log is never reviewed.
Bank detail changes are accepted by email with a call to the number in the same email.
No figure for near misses. Organisations that measure attempted fraud almost always find some.
Reliance on a deepfake detection tool as the main defence, with no change to payment procedures.
No one can say whether the crime or cyber insurance policy covers voluntary, authorised transfers.

What good looks like

Verified, not trusted: every new beneficiary and bank change is independently confirmed, and the evidence is kept.
System-enforced approvals: dual control lives in the banking platform and ERP, with phishing-resistant MFA for approvers.
Clear tone from the top: the chief executive has told staff in writing that verification delays are always acceptable.
Rehearsed response: finance, treasury, security and legal have exercised a deepfake call scenario, including the bank recall call.
Measured: near misses, verification failures and overrides are reported to the audit or risk committee.

Where to invest first

Payment procedure and system enforcement: call-back, dual approval and holding periods enforced in the platforms. This is cheap and removes most of the risk.
Identity for approvers: phishing-resistant MFA for anyone who can approve payments or change supplier records, and stronger help desk checks for those accounts.
Training for finance, treasury and executive assistants: short, scenario-based sessions using realistic voice and video examples. See the Business Email Compromise Awareness for Finance Teams Guide.
Response readiness: bank fraud contacts, police reporting routes and an evidence checklist ready before they are needed.
Detection tooling: only after the above, and evaluated carefully. See the Deepfake Detection Buyer's Guide.

Metrics to track

Metric	What it shows	Suggested target (ours)
Payments above threshold with two independent approvals	Whether dual control is real	100%
Bank detail changes verified by call-back to a number on file	Whether the main invoice fraud control works	100%, with evidence
Approval overrides per quarter	Pressure on the control and who applies it	Each one reviewed by the audit committee chair or delegate
Reported attempted frauds and near misses	Detection culture and threat level	Trend reported quarterly; zero usually means under-reporting
Payment approvers on phishing-resistant MFA	Account takeover resistance	100%
Time from suspected fraud to bank recall request	Recovery readiness	Under one hour in exercises

A 90-day plan

Days 1 to 30: confirm payment thresholds and dual approval enforcement in each banking platform; issue the chief executive's written no-exceptions statement; list everyone who can approve payments or change supplier bank details.
Days 31 to 60: introduce call-back verification and holding periods for all bank detail changes; move payment approvers to phishing-resistant MFA; brief finance, treasury and executive assistants with realistic examples.
Days 61 to 90: run a deepfake call exercise including the bank recall; confirm insurance cover for social engineering transfers; agree the metrics above and add them to the audit or risk committee pack.

Common failure patterns

Treating the video call as verification: in the Arup case, the employee's initial suspicion was overcome by seeing familiar faces on a call.
Verification through the attacker's channel: calling back on the number in the email, or replying to the same thread.
Seniority exceptions: controls that the chief executive's office can waive are the ones attackers target.
Policy without enforcement: dual approval written down but not configured in the payment system.
Slow reporting: hours lost before the bank is called reduce the chance of freezing funds.
Assuming someone else pays: larger organisations outside APP reimbursement, with insurance sub-limits nobody has checked.

Lessons from incidents

The Arup deepfake fraud is the clearest example of the board-level lesson. A finance worker in Hong Kong received a request that appeared to come from the UK-based chief financial officer for a confidential transaction. He was suspicious until a video conference with what looked like familiar colleagues reassured him; police later said the other participants were deepfakes built from public video and audio. He made 15 transfers to five bank accounts before checking with head office. Arup said no internal systems were compromised. Nothing technical was breached: the fraud succeeded because a recognised face and voice were treated as authorisation. An independent call-back to a number on file and a second approver for an unusual, high-value transfer would each have stopped it.

Practitioner checklist

Enforce dual approval above a set threshold in every banking and ERP platform.
Require call-back to a number on file for every bank detail change and urgent executive request.
Apply a holding period to new or changed beneficiaries.
Issue a written no-exceptions statement from the chief executive.
Put all payment approvers on phishing-resistant MFA.
Give AI agents and payment automations their own scoped identities and approval limits.
Prepare bank recall contacts and police reporting routes (Report Fraud in England, Wales and Northern Ireland, Police Scotland, IC3 in the US).
Exercise a deepfake call scenario at least once a year.
Report near misses, overrides and verification metrics to the audit or risk committee.

Standards and references

How NHI Mgmt Group can help

We provide independent identity risk assessments and board briefings, including how payment approvers, help desk processes and AI agents are authenticated and authorised. Our NHI Foundation Level Training Course covers governing the non-human identities, including AI agents, that increasingly sit inside finance workflows. Contact us to arrange a briefing.

Deepfake and Payment Fraud Executive Briefing: What Boards Need to Know and Ask