Deepfake voice and video fraud against businesses

Generative AI tools can produce convincing synthetic speech from recordings of a real person, and increasingly realistic synthetic video. Executives are easy targets because their voices and faces are public: earnings calls, conference talks, podcasts, webinars, social media videos.

The fraud itself is old. It is the executive-impersonation scam, now delivered by phone or video instead of email. A typical pattern starts with an email or message that sets up a confidential matter, followed by a call or video meeting in which a familiar-seeming executive confirms the request and asks for speed and discretion.

In February 2024, Hong Kong police said they had received a report from an employee of a multinational company who made transfers totalling about HK$200 million after video conference calls with people posing as senior officers of the company. Police said the fraudsters appeared to have used publicly available video and AI-generated voices. It is one of the most widely reported cases, and it shows that a multi-person video call is no longer proof that the people on it are real.

In Canada, the Canadian Anti-Fraud Centre collects reports of fraud and cybercrime, including impersonation schemes, through its online reporting system, and the Canadian Centre for Cyber Security's generative AI guidance warns that AI can be used to create convincing phishing and to impersonate people. The common thread in reported cases is not the technology; it is a request for an unusual payment, under time pressure, with a reason not to check.

• A request to move money, change payment details, buy gift cards or share credentials, especially outside the normal process
• Urgency combined with secrecy: 'confidential acquisition', 'don't mention this to anyone yet'
• The caller cannot be reached on their known number, or asks you not to call back
• A new meeting link or platform, or a call from an unknown number claiming to be a colleague's 'other phone'
• Video that is brief, low quality, or where the person avoids interaction, or a camera that is 'broken'
• Speech that sounds slightly flat, has odd pauses, or does not respond naturally to interruptions
• A request that arrives just after a public appearance or news about the company

The strongest control is to verify through a channel the fraudster does not control. Callback to a known number, taken from your own directory and not from the call or message, defeats most impersonation, cloned voice included.

Some organizations add a verification phrase or challenge question for high-risk requests: something agreed in person, never written in email or chat, and changed periodically. It is a useful second layer for executives and finance, but it should supplement the callback and dual approval, not replace them.

1. 01

   Pause

   Any payment or access request by phone or video, however senior the person appears, is paused until verified.

2. 02

   Hang up and call back

   On the number in your own directory. Do not use a number, link or meeting invite supplied by the requester.

3. 03

   Use the challenge

   If you have a verification phrase arrangement, ask for it on the callback.

4. 04

   Follow the written process

   The payment still goes through dual approval like any other.

Deepfakes defeat recognition, not process. A payment procedure that requires callback verification, two approvers for new payees and changed details, and a hold before the first payment to new account details will stop a cloned CEO the same way it stops a spoofed email.

Leadership has to say, in writing, that nobody may instruct staff to skip verification, and that staff who delay a genuine request to verify it will be supported. Brief executives too: they are the ones being impersonated and they can reduce the risk by never making payment requests by phone or video alone, and by telling finance to expect that.

We investigate impersonation and payment fraud, including how the fraudster got the inside information, and help rebuild controls afterwards. 24/7 incident line: (289) 582-9930.

1. 01

   Call your bank's fraud department now

   Ask for a recall of the payment. Speed matters more than anything else.

2. 02

   Report it

   To local police, and to the Canadian Anti-Fraud Centre through reportcyberandfraud.canada.ca.

3. 03

   Preserve evidence

   Call logs, meeting links and invites, chat messages, emails with full headers, and any recording. Do not delete the meeting or messages.

4. 04

   Check for a compromise

   Impersonation often follows a mailbox or account takeover that gave the fraudster context. Have sign-ins, forwarding rules and app consents reviewed.

5. 05

   Tell your insurer and counsel

   Social engineering losses are treated differently across policies; notify promptly.