CEO Fraud: How Deepfakes Turned an Old Scam Into a Board-Level Risk

In January 2024, a finance employee at the Hong Kong office of Arup, the engineering firm behind the Sydney Opera House’s structural design, got an email that looked like it came from the UK-based CFO. It asked for an urgent, confidential transfer. She was suspicious, as she should have been. Then she got invited to a video call.

On that call were the CFO and several other senior colleagues. They looked right. They sounded right. Reassured by the presence of people she recognized, she authorized fifteen separate transfers totaling HK$200 million, about $25.6 million, into five Hong Kong bank accounts. Every person on that call except her was a deepfake.

This is what CEO fraud looks like now. It’s the same underlying scam that has existed for a decade, an attacker impersonating an executive to move money or data, but the production values have changed completely. In practice this means the old advice, “verify through a second channel,” doesn’t automatically work anymore, because the second channel can be faked too.

CEO fraud is a subset of a much bigger, costlier problem

CEO fraud is one flavor of Business Email Compromise (BEC), and BEC is not a niche threat. According to the FBI’s 2025 Internet Crime Report, the agency’s IC3 unit logged 24,768 BEC complaints and $3.05 billion in reported losses last year, up from $2.77 billion in 2024. That’s a roughly 10% year-over-year increase in losses on top of an already massive base. Total cybercrime losses tracked by IC3 hit $20.877 billion in 2025, a 26% jump, and BEC remains one of the largest single categories behind investment fraud.

Here’s a number that should reframe how security teams think about BEC: Microsoft’s 2025 Digital Defense Report found that BEC made up only about 2% of the threats Microsoft observed, but accounted for 21% of attack outcomes, meaning actual damage. Compare that to ransomware’s 16% share of outcomes. Low volume, disproportionate impact. That’s the profile of an attack that succeeds by exploiting judgment under pressure rather than a technical vulnerability, which is exactly why patching software doesn’t fix it.

Separately, the Association for Financial Professionals found that 76% of U.S. organizations experienced attempted or actual payments fraud in 2025, with roughly 74% affected specifically by BEC. Classic executive impersonation, the CEO fraud pattern specifically, was still reported by 49% of organizations even as vendor and third-party impersonation schemes grew more common.

What actually changed: the verification channel got compromised too

The standard BEC defense for years has been simple: if a payment instruction arrives by email, confirm it through a different channel. Call the requester back on a known number. Check with someone else. Don’t trust the medium the attacker controls.

The Arup case broke that model because the video call itself was the fake channel. A Hong Kong police superintendent, Baron Chan, told local media that the employee had been invited onto a conference call with “many participants,” and because the participants “looked like the real people,” she proceeded with the transfers. Every visual and audio signal she used to confirm authenticity had been synthesized in real time.

Arup’s global CIO, Rob Greig, was candid about it afterward: “Like many other businesses around the globe, our operations are subject to regular attacks, including invoice fraud, phishing scams, WhatsApp voice spoofing and deepfakes. What we have seen is that the number and sophistication of these attacks has been rising sharply in recent months.” No systems were breached at Arup. No data was stolen. The failure was entirely procedural, a human being reasonably trusted a channel that was no longer trustworthy.

This is where teams usually trip up when they think about deepfake risk: they treat it as a detection problem (can we spot the fake?) instead of a process problem (does our authorization chain assume any remote channel could be fake?). Real-time, multi-participant deepfake video is achievable now on commodity hardware. The barrier to entry for this kind of attack is roughly comparable to running a basic phishing campaign in 2018, according to security consultancy Axlio, which studied the Arup case in detail. You don’t need a nation-state budget to pull this off anymore.

The FBI’s five classic patterns still matter, deepfakes just added a sixth

The FBI’s older guidance on BEC and CEO fraud identified several recurring patterns that are still accurate today:

• A fake vendor or supplier requests a wire transfer for an invoice, sending funds to a fraudulent account.
• A compromised executive email account (a real mailbox, taken over) is used to request funds directly, for example a hijacked CFO account emailing an accountant.
• A compromised employee mailbox gets used to send fraudulent invoice requests to that employee’s real vendor contacts.
• A fake attorney contacts an employee near close of business, pressuring for a transfer before day’s end.
• A fake executive requests W-2 forms or other personally identifiable information during tax season, then uses that data for follow-on phishing.

Add to that the newer pattern Arup and others have experienced: live synthetic video or voice used to authorize a transfer in real time. In February 2024, before Arup was even publicly named, Hong Kong police had already flagged the underlying technique. Around the same period, WPP’s chief executive Mark Read disclosed that scammers had used an AI voice clone of him in an attempted fraud, warning colleagues to watch for calls claiming to be from senior executives.

Who gets targeted, and why the targeting logic hasn’t changed

Even with better production values, attackers still go after the same functions, because those functions have the authority to move money or release sensitive data.

Finance and accounting teams

Anyone with wire authority or invoice-approval power is a target. Scammers build invoices that look legitimate and route them through normal AP workflows, sometimes posing as the CFO directly, sometimes as a known vendor whose email was separately compromised.

IT and system administrators

IT staff typically have the deepest access to networks and credentials, and a single successful phish against this group can cascade into much larger compromise. Ironically, IT teams often assume they’re too security-aware to fall for BEC, which is exactly the overconfidence attackers exploit with well-researched pretexts.

HR departments

HR holds current and former employee PII, salary data, and W-2 information. A fake HR data request, or a fake executive asking HR for an employee list, can seed a much wider phishing campaign against the whole company.

C-suite executives themselves

Executives are targeted directly too, not just impersonated. Their calendars, travel, and public appearances (conference talks, earnings calls, podcast interviews) provide exactly the audio and video source material attackers need to build a convincing clone. The more publicly visible an executive is, the more raw material exists to synthesize them.

Recognizing an attempt in progress

The behavioral red flags haven’t changed much even as the technology has.

• Urgency paired with secrecy. Legitimate finance requests rarely require silence. If you’re told not to loop in a second approver, that’s the tell.
• Unusual timing. Requests near close of business or outside normal hours, when verification is harder to arrange and people are more fatigued.
• An executive who’s conveniently unreachable. Being told they’re in a meeting and the payment just needs to be processed is a way to prevent you from calling them directly.
• A brand-new or unfamiliar destination account. Even in a live video call, ask why the payment destination changed.
• Subtle domain mismatches. ceo@yourbusines.com instead of ceo@yourbusiness.com is still a common trick and still gets missed under pressure.

What actually stops this, including the deepfake version

The uncomfortable truth is that the controls that would have stopped Arup are not exotic; they’re the same controls that have prevented BEC fraud for years, just enforced more strictly.

Channel separation that can’t be controlled by the attacker

A video call is not, by itself, an independent verification channel anymore, since the same attacker can control both the request and the confirmation. Real separation means calling a number pulled from an internal directory, not one provided during the conversation, or requiring in-person confirmation for high-value transfers.

Mandatory dual authorization above a defined dollar threshold

Two named people, each able to independently refuse, with no single person empowered to override the process under claimed urgency. Set the threshold low enough that a single social-engineering attempt can’t clear it.

Bank-side controls

Most commercial banks offer payee whitelisting, cooling-off periods for new payees, and their own fraud callback verification. Many organizations qualify for these features and simply haven’t turned them on.

Email authentication protocols

DKIM and DMARC won’t stop a deepfake video call, but they still catch a large share of classic domain-spoofing attempts before they reach an inbox. As of early 2025, over 7.2 million tracked domains had published DMARC records according to Valimail, though the same research notes most of those domains aren’t fully enforcing it, meaning the protection is often weaker than it looks on paper.

A culture that rewards pausing, not speed

Nearly every BEC and CEO fraud attempt relies on manufactured urgency defeating normal process discipline. The Arup employee was initially suspicious and was talked out of it. An organization where declining an urgent payment request is treated as good judgment, not obstruction, is one of the strongest defenses available, and it costs nothing to implement.

Security awareness training that includes deepfakes specifically

Most training programs still frame phishing as a text-and-link problem. That’s no longer sufficient. Training needs to cover live voice cloning, video manipulation, and the specific pattern of being confirmed by people who look and sound correct on a call.

Recovery is possible, but time-sensitive and partial

It’s worth being honest about limitations here: even when banks and law enforcement respond quickly, full recovery is far from guaranteed. The FBI’s Financial Fraud Kill Chain data shows that in 2025, agencies handled 3,900 incidents involving $1.164 billion in attempted theft, with a 58% success rate for freezing funds before they disappeared, down from a 66% success rate in 2024. That’s a meaningful chance of recovery, not a reliable one, and it depends entirely on how fast the fraud is reported.

None of this means video calls or remote verification should be abandoned outright. It means no single remote audio-visual channel, taken alone, should authorize a high-value transaction. The control architecture has to assume the channel might be compromised, because increasingly, it can be.

Also read: The Latest Cybersecurity Statistics and Deepfakes and Cybersecurity