The Fake CEO on the Video Call: Would Your Finance Team Pay?

In early 2024, a finance employee in the Hong Kong office of the engineering firm Arup joined a video call with people who looked and sounded like the company's CFO and several colleagues. None of them were real. Over about a week the employee made 15 transfers totalling 200 million Hong Kong dollars, around 25.6 million US dollars, before checking with the UK head office and realising it was a fraud (Fortune, CNN). Arup said its internal systems were not compromised.

That last detail is the point. Nobody hacked anything. A person with authority to pay was persuaded by a convincing performance, and the controls around the payment did not stop it.

Why this is now a finance-controls problem

Executive impersonation is old. What changed is the cost. Most senior executives at listed and venture-backed companies have hours of public video: earnings calls, conference talks, podcasts, interviews. That is enough raw material for a voice or face that holds up for a short call, especially one held over a poor connection with a reason to keep it brief.

Regulators have noticed the broader trend. In November 2024 FinCEN issued alert FIN-2024-Alert004 on fraud schemes using deepfake media, reporting an increase since 2023 in suspicious activity reports describing suspected deepfakes. That alert focuses on fake identity documents and getting past customer verification, not on executive impersonation, but it tells you the tooling is now routine for financial criminals.

Meanwhile the older version of the same fraud still costs the most. The FBI's 2024 Internet Crime Report put reported business email compromise losses at about 2.77 billion dollars for the year. A deepfake is an upgrade to that playbook: the email becomes a call, and the call is harder to doubt.

How it fails in practice

When these attacks work, it is rarely because staff are careless. It is because the organisation has quietly trained them that the executive's voice is the control.

• Seeing is treated as verifying. Policies say "confirm unusual requests with the requester". A video call with the requester feels like exactly that confirmation.
• Authority overrides process. Staff who would challenge an email will not challenge their CFO's face asking for discretion on a confidential deal.
• The out-of-band step goes back into the attacker's channel. "Call me back on this number" or "I'll add my lawyer to the call" keeps the verification inside the fraud.
• Payroll and bank-detail changes are softer than payments. Treasury may have dual approval on wires while a change to an employee's or supplier's account goes through on one person's say-so.
• Nobody owns the exposure. Security owns deepfake detection, finance owns payment controls, communications owns the executive's public footprint. The attack lives between the three.

A self-check before anyone builds a fake

Most of what matters can be checked on paper first. Ask your finance, treasury and payroll leads these questions and write down the honest answers.

• Can any single executive instruction, by voice or video alone, cause a payment or a bank-detail change? If yes, that is the gap, regardless of how good detection is.
• What is the callback rule, and which number does it use? It should be a number from your own directory, never one given during the request.
• Is there a code word or a pre-agreed challenge for urgent executive requests? Is it known only to the people who need it, and has anyone ever used it?
• Who may say no to the CEO? Is it written down that staff who delay a payment to verify it will be backed, even if the request was real?
• How much public audio and video of your top five executives exists? A quick search will tell you. Assume all of it is usable.
• Do payroll and supplier bank changes need the same second approval as an outgoing wire?
• If the Arup call happened to you tomorrow, which person would make the first transfer, and what would stop them? Name the person and the control.

What actually reduces the risk

Detection tools help at the margin, but the strongest controls are boring: no payment or bank change on the strength of voice or video alone; callbacks to numbers from your own records; dual approval that the second approver performs independently; and explicit permission, from the top, to slow down a request from the top. The executive's role is to make that permission credible by saying it out loud before an attack, not after.

It also helps to treat the executive's public footprint as part of the attack surface. You cannot delete earnings calls, but you can make sure the people who move money know that a familiar face and voice are now cheap to fake, and that the right response to an unusual request from a senior person is the same callback and second approval they would apply to anyone else.

How Riskernel runs this as a fixed-scope assessment

The Deepfake Executive Drill tests those controls under realistic pressure. It runs only with written consent from both the company and the executive being imitated. We build the fake a fraudster could make from public material, use it to ask finance, treasury or payroll staff to pay or to change bank details, and record whether they act on it and where the process stopped them or did not. You get a board report with a ranked fix plan. Scope and fees are agreed on a short call.