Strategy
Deepfake CEO Fraud: How to Stop a Fake Video Call Emptying Your Bank Account
14 min read
Criminals can now put your CEO's face and voice on a video call. This guide explains how deepfake CEO fraud works, why staff can't be expected to spot a fake, the seven payment controls that stop it, and what to do in the first hour if money has already gone.
✦Key Takeaways
- Deepfake CEO fraud is an old scam in a new disguise: the request is still an urgent, confidential payment to a new account, but now it arrives with the boss's face and voice.
- It is rare but costly. UK Finance recorded 197 CEO fraud cases in 2025 with the highest average loss of any scam type, just over £28,000, and only 20% of losses were returned to victims.
- People cannot reliably spot deepfakes. In iProov's 2025 study, only 0.1% of 2,000 people correctly identified every real and fake image and video they were shown.
- Verify the request, not the face: hang up and call back on a number you already hold, never one supplied with the request.
- Two-person approval, challenge questions and a hold on new payees mean a deepfake has to fool several people through several channels.
- Make it a promise from the top. When the CEO commits in writing never to ask anyone to skip the checks, a request to skip them becomes the red flag.
- If money goes, call your bank within the hour. Mandatory refunds only cover individuals, micro-enterprises and small charities, so most SMEs must rely on speed.
In January 2024, a finance worker in Arup's Hong Kong office received a message from the company's UK office about a confidential transaction. The worker suspected phishing at first. Then came a video call with the chief financial officer and several colleagues, who looked and sounded exactly right. The employee went on to make 15 transfers to five bank accounts, totalling HK$200m, about £20m. Every other person on that call was a deepfake. It remains the best-known case of deepfake CEO fraud.
Nothing was hacked. Arup said that "none of our internal systems were compromised"; the criminals simply persuaded a person. Its global chief information officer, Rob Greig, told CNN that the number and sophistication of these attacks "has been rising sharply in recent months".
In the UK, CEO fraud is still rare, but each case hurts. UK Finance's Annual Fraud Report 2026 recorded 197 cases in 2025 with losses of £5.6m. That is the highest average loss of any scam type it tracks, at just over £28,000 per case, and only 20% of the money was returned to victims. This guide explains how deepfake CEO fraud works, why your team can't be expected to spot it, the seven controls that stop it and what to do in the first hour if money has gone.
How Deepfake CEO Fraud Works
CEO fraud is an old trick. A message that seems to come from the boss asks the finance team to make an urgent payment to a new account. UK Finance still describes it mainly as an email crime, in which criminals break into or spoof the CEO's email. What deepfakes add is a face and a voice, which removes the most natural defence of all: "I'll just check with them."
Step 1: Research
The raw material is public. Your website names your directors, Companies House lists your officers, LinkedIn shows who works in finance, and a conference talk, podcast or company video gives criminals the face and voice they need. Nobody has to break into anything to collect it.
Step 2: First contact
The approach usually starts with a message, not a call. In July 2024, a Ferrari executive received WhatsApp messages that appeared to come from chief executive Benedetto Vigna: "Hey, did you hear about the big acquisition we're planning? I could need your help." Bloomberg reported that the messages did not come from Vigna's usual business number, and the caller who followed had an excuse ready for the new one. A confidential deal is the classic cover story, because it gives the target a reason to tell nobody else.
Step 3: The call
Then comes the call that makes the request feel safe. When criminals targeted WPP in 2024, they used a WhatsApp account with a public photo of chief executive Mark Read to set up a Microsoft Teams meeting. According to the Guardian, they used a voice clone and YouTube footage of another senior executive, and impersonated Read off-camera through the meeting's chat window. The attempt failed, but the method is now cheap: tools that change a face or a voice in real time are easy to find.
Step 4: The payment and the cash-out
The request is urgent, confidential and nearly always to an account the business has never paid before. Large sums may be split, as in the Arup case, where the money went out in 15 transfers to five accounts. Once paid, it is moved on through other accounts, which is why the first hour after a payment matters so much.
Why You Can't Rely on Spotting the Fake
Most advice on deepfakes tells people to watch for odd blinking, blurred edges or lips out of sync. The evidence says people are bad at it. In a 2025 study by identity verification firm iProov, 2,000 UK and US consumers were shown a mix of real and deepfake images and videos. Only 0.1% identified every one correctly, even though they knew they were looking for fakes. Videos were harder to spot than images, and over 60% of participants were confident in their answers anyway.
A live call is harder still. The video tiles are small, the connection may be poor and the person on screen is your boss asking for help. Any glitch can be blamed on a bad line. Detection software is improving, but it is an arms race, and the criminals get to choose their tools.
Many attempts skip video altogether. A cloned voice on a phone call or a WhatsApp voice note is cheaper to produce and harder to judge, because there is no picture to study. The Ferrari attempt was a phone call, and the voice was convincing enough to copy Vigna's southern Italian accent.
Watermarks will not save you either. Responsible AI companies are starting to mark what their tools generate, as we explained in our guide to Claude's invisible watermark, but criminals use tools that add no mark at all.
So stop asking staff to judge faces and voices, and ask them to verify requests instead. At Ferrari, the executive's suspicion began with "the slightest of mechanical intonations", but what ended the call was a simple question: the title of a book Vigna had recommended a few days earlier. The line went dead.
Seven Controls That Stop Deepfake CEO Fraud
None of these needs new technology. Most cost nothing but a written rule and visible backing from the top.
1. Call back on a number you already hold
Any request to pay a new account, change bank details or move money urgently is verified by calling the person back on a number from your own records: the staff directory, the supplier file or the contacts in your phone. Never use the number, link or meeting invite that came with the request. A deepfake can join a call it invited you to. It is far harder for a criminal to intercept a call you place to the real person.
Make the rule easy to follow. Keep a short list of verified numbers for everyone who requests or approves payments, somewhere the finance team can reach in seconds. A check that takes ten minutes will be skipped on a busy Friday afternoon.
2. Agree a challenge question
For the few people who can authorise large payments, agree a code word or a short list of challenge questions, and change them after any suspected attempt. Ferrari's executive improvised one under pressure; you can set yours up in advance. Keep them out of email and chat, where anyone who has broken into an account could read them.
3. Require two people for large payments
Set a threshold above which no single person can release a payment, and build it into your banking platform so the rule is enforced rather than merely written down. The second approver must check the request independently, not just confirm what the first person tells them. A deepfake then has to fool two people separately, through two channels.
4. Treat new payees and changed bank details as the riskiest payments
Redirection fraud ends with money going to an account you have never paid before. In 2025, invoice and mandate scams, where criminals pose as a supplier with "new" bank details, cost UK victims £41.3m, and 68% of those losses were on business accounts. Check the account name with Confirmation of Payee, send a small test payment and confirm it arrived by phone, then hold the full amount for a set period.
5. Make "no exceptions" a promise from the top
Fraudsters rely on a junior person not wanting to slow down the boss. Remove that fear. Have the CEO and directors state in writing that they will never ask anyone to skip these checks, and that anyone who checks will be thanked, not blamed. A request to skip the checks then becomes a red flag in its own right.
6. Use your bank's controls
Business banking platforms typically offer payment limits, approval workflows, alerts when a new payee is added and approval inside the banking app rather than on the strength of an email or call. Switch them on, and review who holds which permissions at least twice a year.
7. Rehearse it
Run a short session for everyone who can move money, including assistants, junior finance staff and regional or remote offices; Arup's loss happened in a regional office. Then test the process with a simulated request, agreed in advance with the leadership team. It is the same principle as testing an AI system before launch: find the gap in a rehearsal, not with real money.
The same rules apply to software. If you are giving AI agents permission to pay invoices or update supplier details, they need verified channels, payment limits and a human approval above a threshold, just like your staff. Our blueprint for agentic governance covers how to set those permissions.
| Red flag | Why criminals use it | What to do |
|---|---|---|
| Urgent and confidential | Stops you checking or asking anyone else | Slow down and verify |
| A new number, account or meeting link | It is a channel the criminal controls | Call back on a number you already hold |
| Camera off, a "bad line" or chat only | Hides the weak points of a fake | Hang up and call back |
| A new payee or changed bank details | Sends money where it is hard to recover | Confirmation of Payee, test payment, hold |
| A request to split the payment | Keeps each transfer under limits and alerts | Second approver, then call your bank |
If Money Has Already Gone: The First Hour
Speed matters more than anything else. Banks can sometimes freeze money at the receiving account, but only if it has not already been moved on.
- Call your bank straight away, using the number on your card or banking app, or dial 159 to reach the fraud team at many UK banks. Ask them to contact the receiving bank.
- Report it to Report Fraud, which replaced Action Fraud in England, Wales and Northern Ireland, at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
- Keep every piece of evidence: messages, call logs, phone numbers, meeting links, invoices and bank details.
- Tell your insurer or broker, and check whether anyone else in the business was contacted.
Don't count on getting the money back. Since October 2024, mandatory reimbursement for authorised push payment scams has covered individuals, the smallest businesses (micro-enterprises) and charities with annual income under £1 million, up to £85,000 per claim. Most SMEs with ten or more staff fall outside it, so recovery depends on how quickly the money is traced and what your bank and insurer agree to. For CEO fraud in 2025, only 20% of losses were returned to victims.
Ask your broker now, before anything happens, whether your policy covers social engineering fraud and up to what limit. It is not always included in standard cyber or crime cover.
Once the urgent steps are done, review what happened without blame: which check was missing or skipped, and why. Then warn the rest of the business. Criminals who got close once may well try again, with a different person or a different story.
Your One-Page Payment Verification Policy
Write these controls on a single page that everyone who can move money has read and signed. It should cover:
- Scope: any request to pay a new payee, change bank details or make an urgent or confidential payment, from anyone, including the CEO.
- Verification: call back on a number from your own records, plus challenge questions for senior approvers.
- Approval: two people for any payment above your threshold, with the second checking independently.
- New payees: Confirmation of Payee, a test payment and a hold before the full amount.
- No exceptions: signed by the CEO and every director.
- Reporting: who to tell, immediately and without blame, and your bank's fraud number.
- Review: every six months, and after any attempt.
It is the same one-page approach we recommend for an AI usage policy: short enough to remember, and clear enough to follow under pressure.
Conclusion
Deepfakes have not changed what criminals want. They still need someone in your business to send money to an account they control. What has changed is that a familiar face and voice no longer prove anything. The defence is a process that never depended on recognising anyone in the first place.
Spend an hour this week writing down your call-back rule and your two-person threshold, and get the CEO to sign them. If you would like help reviewing how your business handles AI-driven risks like this, or training your team, talk to AI Native Agency about our AI strategy and consulting work.
Frequently Asked Questions
- What is deepfake CEO fraud?
- Deepfake CEO fraud is a scam in which criminals use AI-generated video or a cloned voice to impersonate a company's chief executive or another senior leader, usually to persuade a finance employee to make an urgent payment to an account they control. The request is the same as in older email scams, but a familiar face or voice makes it far more convincing.
- How can you tell if a video call is a deepfake?
- Often you can't, especially on a small video tile over a patchy connection. Warning signs include an urgent and confidential request, a new number or meeting link, the camera being off or the picture glitching, and pressure not to tell anyone. The reliable test is to hang up and call the person back on a number you already hold.
- How much audio does it take to clone someone's voice?
- Very little. Modern voice-cloning tools can produce a convincing copy from a short recording, and conference talks, podcasts, webinars and company videos give criminals plenty of material. That is why a familiar voice on its own should never count as proof of identity.
- Will my bank refund money lost to a deepfake scam?
- It depends on who you are. The UK's mandatory reimbursement rules for authorised push payment scams cover individuals, micro-enterprises and charities with annual income under £1 million, up to £85,000 per claim. Larger businesses are usually outside those rules, so recovery depends on how quickly the money is frozen and on your bank and insurer. Report it to your bank immediately.
- Where do you report deepfake fraud in the UK?
- Call your bank first, using the number on your card or by dialling 159, because speed gives the best chance of freezing the money. Then report it to Report Fraud, which replaced Action Fraud in England, Wales and Northern Ireland, online or on 0300 123 2040. In Scotland, report it to Police Scotland on 101.
- Are small businesses targeted, or only large companies?
- Both. The best-known cases involve large companies, but UK Finance's figures show that CEO fraud mostly hits business accounts, and small firms often have fewer payment controls. Directors' names are public on Companies House, and one convincing call to the one person who can move money may be all it takes.
- Should our executives stop appearing in videos and podcasts?
- There is no need to disappear from public view, and it would not fully work anyway, because criminals need only a short clip. It makes more sense to assume your leaders' faces and voices can be copied, and to build payment processes that do not rely on recognising them: call-backs, challenge questions and two-person approval.
