Deepfake CEO Scam: Real Cases and How to Stop One

A deepfake CEO scam uses AI video or a cloned voice of an executive to rush staff into secret payments. See real cases, warning signs and controls that work.

Quick answer: A deepfake CEO scam is a fraud in which criminals use AI-generated video or a cloned voice of a company's chief executive or another senior leader, usually in a video call, voice note or phone call, to push an employee into an urgent, confidential payment or into handing over data. The most effective defense is procedural: no payment or change of bank details is approved on the strength of a call or message alone, however senior and convincing the person seems.

It is a high-tech version of CEO fraud, which is a form of business email compromise (BEC). The FBI's Internet Crime Complaint Center recorded about $3.05 billion in reported BEC losses in 2025, and over $30 million of BEC losses in which AI was involved (FBI IC3 2025 Internet Crime Report). Below: how the scam works, verified cases, warning signs and the controls that stop it.

How a deepfake CEO scam works

1. Research. Attackers collect public video and audio of executives from earnings calls, interviews and conference talks, and work out who in finance can move money, often from professional networking profiles.
2. First contact. A message arrives from the "CEO" or "CFO" by email, or from a new WhatsApp number that uses the executive's real photo. Singapore's police, central bank and cyber security agency described this pattern in a March 2025 joint advisory: unsolicited WhatsApp messages from people posing as company executives, followed by an invitation to a live Zoom call (Singapore Police Force).
3. The call. On the video or voice call, the executive and sometimes other colleagues appear and sound real. In the Singapore cases, a second impostor posing as the company's legal counsel sent documents such as a non-disclosure agreement to the victim's personal email address.
4. The pretext. A confidential acquisition, a regulatory matter or an urgent supplier payment explains why the employee must act quickly and tell no one.
5. The payment. Funds go to new accounts, sometimes split into several transfers.

Real deepfake CEO cases

These incidents were reported by reputable news outlets or disclosed by the companies themselves:

According to CNN's reporting on the Arup case, the employee first suspected that the initial message was phishing, but his doubts faded once the call showed colleagues who looked and sounded familiar. Arup confirmed that fake voices and images were used and said its internal systems were not compromised.

Two lessons stand out. First, the attempts that failed were stopped by people noticing that the channel was wrong or by asking a question a clone could not answer, not by spotting visual glitches. Second, the attackers relied on public material: a profile photo, conference footage and knowledge of who works where.

Warning signs on a call or message

• A senior leader contacts you on a personal messaging app or from a new number instead of the usual company channels.
• The request is secret: "don't discuss this with anyone, not even your manager".
• Normal approval steps are to be skipped "just this once" because of time pressure.
• Money is to go to a new beneficiary, or bank details have suddenly changed.
• Documents arrive at your personal email address, or a "lawyer", "regulator" or "investor" joins the conversation.
• Participants avoid interaction, keep answers short and scripted, or refuse to move to a call that you start.
• The person cannot answer a simple question about a recent, private conversation.

Visual clues such as lag, odd blinking or lip movements that don't match the audio can help, but deepfake quality keeps improving. Treat them as a bonus, not a test to rely on.

Controls that stop deepfake CEO fraud

• Out-of-band verification for every payment request. Call the requester back on a number from the company directory, never one supplied in the message or the call. This applies to the CEO too, and the CEO should say so to staff.
• Dual approval and limits. New payees, changed bank details and transfers above a set amount need a second approver who was not on the call.
• Approved channels only. Define where executives make requests: company email, internal chat, the company's own meeting platform. Anything else is reported, not acted on, as the LastPass employee did.
• Challenge questions and code phrases. Finance teams and executive assistants can agree verification phrases with executives, or simply ask about something recent and non-public, as in the Ferrari case. The same habit protects families from the AI voice cloning scam.
• Training for the people who move money. Finance, treasury, executive assistants and new starters need scenario-based training that covers video and voice, not only email. Singapore's advisory specifically recommends warning employees who make fund transfers.
• A smaller attack surface. Enforce DMARC on your domains, watch for lookalike domains and fake executive profiles, and get them removed early. Our guide to executive impersonation covers fake profiles, emails and sites in detail.

If money has already been sent

1. Call your bank immediately and ask it to recall or freeze the transfers. Speed matters; the Singapore advisory tells businesses to call their bank first and then make a police report.
2. Report to law enforcement. In the US, file a complaint at ic3.gov; elsewhere, contact the police or the national fraud reporting service.
3. Preserve the evidence: meeting invitations, chat logs, phone numbers, email headers, documents and payment records.
4. Remove the infrastructure. Report the fake messaging accounts, and the lookalike domains used to send emails or host documents. Phishvoid handles the website and domain side: its team verifies each fake site and reports it to hosts, registrars and browser blocklists.
5. Review what made it possible and close the gap in your payment process before the next attempt.

FAQ

What is a deepfake CEO scam?

It is a fraud in which criminals use AI-generated video or a cloned voice of a senior executive to convince an employee to make an urgent payment or share sensitive data, usually during a video call, phone call or voice message.

How did the Arup deepfake scam work?

According to Hong Kong police as reported by CNN, a finance employee joined a video call with what appeared to be the CFO and other colleagues. All of them were deepfakes, and the employee made 15 transfers totalling about HK$200 million.

Can you detect a deepfake on a video call?

Sometimes, through lag, unnatural movement or audio that doesn't match the lips, but not reliably. It is safer to verify the request itself: call back on a known number and require a second approver for any unusual payment.

How is a deepfake CEO scam different from whaling or spear phishing?

Whaling and spear phishing are targeted attacks, usually by email. A deepfake CEO scam is a targeted attack that adds synthetic voice or video to make the impersonation interactive and more convincing.

Are deepfake investment ads the same thing?

No. Those ads use a leader's face to defraud the public rather than staff. We cover them in fake ads and deepfake investment scams.