The essentials
- Minutes of public audio or video are enough to clone an executive convincingly — including live, interactive calls.
- The tell is never the face or the voice; it is the pattern: urgency, secrecy, and authority pushing a payment or credential action outside normal process.
- Verification means an independent channel you initiate — a callback to a number you already hold, or a pre-agreed code word. "It sounded exactly like her" is not verification.
- Report attempts even when they fail; finance and security teams need to know the campaign is running.
- Defenses that scale are procedural: callback rules and dual approval for payments above a threshold, with no executive exception.
The old advice — listen for robotic audio, look for glitchy video — is dead. Current tools sustain a fluent conversation in a cloned voice with a matching face, assembled from earnings calls, conference talks, and social clips.
What the technology cannot fake is your process. A fraudster can be the CEO's voice; they cannot answer the callback you place to the CEO's real number, and they cannot produce the code word agreed in a room.
Do this now
- Stop the transaction. Whatever stage the payment or credential change is at, pause it. Nothing legitimate is destroyed by an hour's verification; the script's whole design is to prevent that hour.
- Verify on a channel you initiate. Call the executive back on the number from your directory — not the number that called you, not a number from the meeting invite. Or use the code word if your organization has one.
- Preserve the artifact. Recording if you have one, caller ID, meeting link and organizer address, timestamps, and a written memory of what was said while it is fresh.
- Alert finance and security. An attempt on one person is a campaign against the organization — warn everyone who can move money that it is running, today.
- Report it. Law enforcement takes deepfake fraud attempts seriously even when they fail; the artifacts feed cases that span many victims.
- Institute the process defense. Callback verification and dual approval for payments over a threshold, code words for executive requests, and an explicit rule that urgency never waives the check.
What not to do
- Do not trust your senses over the process — the fake is built to beat your senses.
- Do not honor "tell no one, this is confidential" — secrecy demands are the signature, not a business norm.
- Do not verify by calling back the number that called you.
- Do not delete the meeting artifacts out of embarrassment if money moved.
- Do not exempt executives from the controls; the exemption is exactly what gets impersonated.
Preserve the evidence
Whatever else happens, these are the artifacts the investigation — and any insurance claim, dispute, or prosecution — will be built from:
- Recordings, caller IDs, meeting invites, and organizer addresses.
- Your contemporaneous notes of the conversation.
- Payment instructions received, with account details.
- The verification steps taken and their results.
Keep a clear head
People who caught these frauds usually report the same feeling: it seemed completely real, and the only thing that saved them was a rule they followed while feeling slightly foolish. Build for that: the check must be mechanical precisely so it survives a convincing voice and your own certainty.
If money moved before doubt arrived, the wire-fraud clock applies — bank recall first, self-recrimination later. The fake fooled a human doing their job; that is the crime working as designed.
Questions victims ask
How good are these fakes, honestly?
Good enough that trained listeners fail blind tests, and live conversation is no longer a barrier. Assume the audio and video channel proves nothing about identity, and let verification carry that weight.
We called back — but on the number from the meeting invite. Does that count?
No. The invite came from the attacker, so its numbers do too. Verification only counts when the channel is one you already held: the directory number, the known assistant, the code word.
What protections actually scale for a company?
Three: callback-on-known-number for any payment or banking change request, dual approval above a threshold, and a code word for executive-initiated urgency. Cheap, boring, and they defeat the state of the art.