Deepfake Fraud: When the Voice on the Phone Isn't Your CEO 

For years, payment fraud against businesses followed a familiar script: an email, apparently from an executive or a supplier, requesting an urgent transfer or a change to banking details. Staff were trained to watch for the signs, including unusual phrasing, mismatched email addresses, and pressure to act quickly. 

Artificial intelligence has changed the script. Fraudsters can now clone a person's voice from a few seconds of publicly available audio, generate video convincing enough to survive a live call, and produce fluent, personalized messages in any language. The techniques that once exposed fraud, such as awkward wording or an unfamiliar voice, no longer apply reliably. 

What these attacks look like 

Voice cloning calls. An accounts payable clerk receives a phone call from someone who sounds exactly like the company's owner, referencing a real project and requesting an urgent payment to a new supplier account. The voice was cloned from a conference presentation, a podcast appearance, or a video on the company's own website. 

Deepfake video meetings. In the most widely reported case to date, a finance employee at the engineering firm Arup joined a video conference with what appeared to be the company's CFO and several colleagues. Every other participant on the call was an AI-generated fabrication. The employee, reassured by seeing familiar faces, authorized transfers totalling approximately US$25 million. 

AI-refined email compromise. Traditional business email compromise remains among the most financially damaging crimes reported to authorities in both Canada and the United States. AI has removed its most recognizable weakness: messages are now grammatically flawless, written in the sender's genuine style, and informed by details harvested from social media and corporate websites. These campaigns frequently begin with the intrusion techniques described in our article on how attackers gain access to small business networks. 

Why small and mid-sized businesses are exposed 

Deepfake fraud is often assumed to be a concern for large enterprises. In practice, smaller organizations present attractive targets for three reasons: executive audio and video are readily available online, payment approval often rests with one or two individuals, and formal verification procedures are less likely to exist. A fraudulent request that would encounter three layers of review at a large corporation may encounter none at a twenty-person firm. 

Defences that work 

The essential insight is that this class of fraud cannot be defeated by detection alone. Staff should not be expected to distinguish a cloned voice from a real one. Effective defence relies on procedure. 

1. Verify through a second, independent channel. Any request to transfer funds, change banking details, or release sensitive information should be confirmed by contacting the requester through a known channel, such as a phone number already on file, never through contact details supplied in the request itself. This single control defeats the majority of these attacks. 
2. Set payment thresholds requiring dual approval. Transfers above a defined amount should require sign-off from two people. Urgency, however convincingly expressed, does not waive the requirement. 
3. Make the procedure absolute. The policy is only effective if it applies without exception, including to requests that appear to come from the most senior person in the organization. Executives should state this expectation to staff directly: a genuine request will always withstand verification. 
4. Consider internal verification phrases. Some organizations now use a pre-agreed phrase or challenge question for authorizing sensitive requests made by phone or video. It is a simple measure, and one that no amount of cloned audio can supply. 
5. Harden the surrounding environment. Many deepfake frauds are preceded by email compromise that gives attackers knowledge of real projects and payment cycles. Multi-factor authentication, email authentication (SPF, DKIM, DMARC), and monitoring for mailbox rule tampering reduce the reconnaissance that makes these attacks convincing. 
6. Rehearse the scenario. Include a deepfake or urgent-payment scenario in security awareness training. Staff who have encountered the situation in an exercise respond far more reliably when it occurs in earnest. 

The principle to retain 

Seeing and hearing are no longer sufficient grounds for authorizing a financial transaction. The organizations best protected against AI-enabled fraud are not those with the most sophisticated detection tools, but those whose payment procedures assume that any voice, face, or message could be fabricated, and verify accordingly. 

Superion's managed cybersecurity services include security awareness training, email protection, and the account monitoring that deprives fraudsters of the intelligence these attacks depend on. Contact us to review your organization's payment verification procedures.