Voice Deepfakes in Corporate Scams: The New CEO Fraud

A finance employee gets a call. The voice on the other end sounds exactly like the company's CFO — same tone, same accent, even the same particular way of pausing while speaking. It asks for an urgent transfer, with the natural authority of someone who's done it hundreds of times before. Everything sounds perfectly normal, except it isn't the CFO — it's a synthetic voice generated from seconds of public audio from conferences, interviews, or corporate videos where the real executive once spoke.

We already explored in our guide on CEO fraud / BEC why this type of scam works by exploiting authority and urgency. Voice deepfakes add a layer of credibility no text email, no matter how well written, could ever match — hearing your boss's recognizable voice triggers an automatic, almost instinctive level of trust the human brain isn't well equipped to question in the moment, especially under the pressure of an urgent request.

Current voice cloning technology requires surprisingly little source material — sometimes just seconds of the person's real speaking audio are enough to train a model capable of generating new synthetic audio that replicates not just the voice's tone and timbre, but also characteristic speech patterns, accent, and cadence. Executives with public presence — recorded talks, interviews, corporate videos, even social media posts with audio — provide exactly the source material this technology needs.

Urgent transfer instructions by phone call, where the CEO's or CFO's cloned voice directly requests a transfer, often combined with the same urgency and confidentiality pressure that characterizes traditional CEO fraud.

Video calls with synthetic participants, internationally documented cases where multiple visible participants in a corporate video call — including recognizable executives — were entirely AI-generated, tricking the victim into authorizing significant transfers.

Voice messages reinforcing requests made by email, where the deepfake is used as an additional "verification" layer to lend credibility to a fraudulent request that would otherwise raise suspicion.

The good news is the effective defenses against this AI-powered variant are, to a large extent, the same ones we already cover in our guide on CEO fraud: mandatory out-of-band verification, never through the same channel the suspicious request arrived through. If the instruction came by phone call, verify by text to an already-known number, or in person — never confirming back to the same number the executive supposedly called from.

Set up a pre-agreed verification word or phrase with key executives and the finance team, specifically to use for any unusual voice or video transfer request — something a deepfake generated from public material couldn't know.

Mandatory dual approval for significant transfers, no exceptions based on the requester's apparent authority or urgency, no matter how convincing the voice sounds.

Specific training on this emerging threat for finance staff, updating awareness that "hearing the right voice" is no longer sufficient verification on its own.

Consider limiting the public availability of audio and video from executives with significant financial authority, where reasonably possible, reducing the material available to train a voice cloning model.

Voice cloning technology continues improving in quality while becoming more accessible and cheaper to use, meaning this attack vector will likely become more common, not less, over time. Businesses that update their verification processes now, instead of waiting to become victims first, are better positioned against this trend.

To train your team with calls, not only emails, see our security awareness programme and test them with the phishing simulator.