Impersonation, deepfakes and social engineering
Would your finance team pay a fake CEO on a video call?
In 2024 a finance worker at Arup joined a video call with people he believed were the chief financial officer and other members of staff. All of them were deepfake re-creations, and he went on to send the money. Nobody hacked anything. Many executives have public video and audio from earnings calls and talks, and staff are often trained, without anyone meaning to, that the executive's face and voice are the control.
Built for Any company with finance, treasury or payroll staff who act on executive requests; CFO, Controller, Head of Treasury, CISO
The problem in numbers
What the public record shows
Every figure links to the page it came from, with its date.
200 million
Hong Kong dollars: what the Arup worker sent after the fake video call, about 25.6 million US dollars
cnn.com, 2024-05
2.77 billion
US dollars in reported business email compromise losses in 2024 (FBI IC3), the wider impersonation-for-payment category this drill sits in, not deepfakes alone
cyberscoop.com, 2025-04
What you get
The deliverables
You get a test, run with written consent from the company and the executive, of whether staff act on that fake, and a board report with a ranked fix plan.
A realistic fake, built only from public material
The voice or video a fraudster could make from your executive's public footprint, made only with written consent from the company and that executive.
A live drill
The fake asks agreed finance, treasury or payroll staff to pay or to change bank details. Every response is recorded.
A board report
Where the process stopped the request, where it did not, and at which step and role it went through. It names roles, not individuals.
A ranked fix plan
Changes such as no payment on voice or video alone, callbacks to numbers from your own records, and a second approver who checks independently.
How it runs
3 to 4 weeks, start to finish
3 to 4 weeks
Consent and paper check
Written consent from the company and the executive, then a review of callback rules, approval limits and who can change bank details.
Build and drill
The fake is built from public material and used in agreed calls and messages to the staff in scope. No real money moves.
Report and readout
A board report with the ranked fix plan, presented to finance and security together.
Consent. This runs only with written consent from your company and from the executive being imitated, before anything starts. Nothing is sent to anyone outside the agreed scope.
Method
How the answer is produced
Controls, not detection
The drill tests whether your payment process holds when the request looks real, not whether a tool can spot the fake.
Only public material
The fake uses only what anyone could find: earnings calls, talks, interviews. That is what a fraudster would have.
No money moves
The drill stops at the point a payment or change would be made. What gets recorded is whether staff would have acted.
Why Amir
Designed and led by someone who has built fraud models in production
The patents closest to this problem:
Amir is a named inventor on EP 4744195 A2 (Methods and systems for threat assessment based on expected pathways of malicious actors, filed at Skyhawk Security; pending).
A related idea: it rates a threat by the routes an attacker is likely to take toward valuable assets, much as the drill follows the path from a fake call to a payment or bank change. The drill is a process test and is not an implementation of the patent.
View on Google PatentsAmir is a named inventor on US 12,626,151 B2 (Method and system for testing a classification machine learning (ML) model of a tenant of a service provider, in a cloud-based environment, filed at NICE Actimize; granted).
An analogy only: it covers testing a decision system on realistic cases before relying on it, much as the drill tests payment approvals against a realistic fake. The drill is not an implementation of the patent.
View on Google PatentsThese patents were filed at the companies named. They show the problems Amir has worked on; they are not Riskernel products.
Is this you
You probably need this if
- A single executive instruction by voice or video can trigger a payment or a bank-detail change.
- Your callback rule does not say which number to call, or allows a number given during the request.
- Payroll or supplier bank changes need less approval than an outgoing wire.
- Your executives have hours of public video and audio from earnings calls, talks or podcasts.
- A cyber-insurance renewal asks how you verify executive payment requests.
Questions
Before you reach out
Do you need the executive's permission?
Yes. The drill runs only with written consent from both the company and the executive being imitated.
Does any money move?
No. The drill records whether staff would act, and stops before any payment or bank change is made.
Is this a deepfake detection product?
No. Detection helps at the margin. The drill tests the boring controls that stop the fraud even when the fake is good.
Who should be involved?
Finance or treasury, security, and the executive. The risk sits between those teams, so all of them should see the result.
Will staff be blamed?
The report is about the process, not individuals. Part of the fix is making it explicit that staff who slow down a request to verify it will be backed.
Scope Deepfake Executive Drill with Amir
Tell Amir what you run and what worries you. He replies with a short scope outline.