Scenario 02 Illustrative
Deepfake CFO Payment Fraud
An illustrative deepfake video call that asks a controller for an urgent wire transfer, and the verification controls that stop this kind of fraud.
Illustrative scenario, not a client engagement. This is a hypothetical example based on common attack patterns. It shows how we'd approach the problem, and doesn't describe a real client, incident or result.
- Sector
- Professional services
- Scenario
- Payment fraud
- Written for
- Leadership and IT teams
The situation
A controller at a mid-sized engineering firm is invited to an urgent video call. On screen are the CFO and two senior colleagues. The CFO explains that a confidential acquisition is closing today and asks the controller to wire $480,000 to a law firm's trust account, quietly, before the news gets out.
The faces and voices are convincing, but nobody on the call is real. Every participant is an AI-generated deepfake built from conference talks, webinars and social media clips. Attacks like this have worked: in a widely reported 2024 case, an employee in Hong Kong sent about US$25 million after a video call in which the other participants were deepfakes.
What's at stake
The risks
- Once money leaves the account, it's often moved on within hours and may never be recovered.
- Cyber insurance may exclude social engineering losses or cap them at a low sub-limit.
- The employee followed what looked like a direct instruction from a senior executive.
- If the attackers knew about internal matters, a mailbox may already be compromised.
Our approach
How we'd help
- Respond. If money has moved, call the bank immediately to request a recall, report the fraud to police and the Canadian Anti-Fraud Centre, and preserve the meeting invite, emails and logs.
- Investigate. Check whether email accounts or collaboration tools were compromised. Attackers often research their targets from inside a mailbox before they strike.
- Strengthen. Put payment controls in place that no call or email can override: call-backs to known numbers, dual approval and waiting periods for new payees.
- Train. Run realistic, scenario-based training on deepfakes and pressure tactics for finance staff, executives and their assistants.
Decisions for leadership
- Set a firm rule that no payment is authorized on the strength of a call, video or email alone, even from the CEO, and publicly back staff who enforce it.
- Set approval thresholds and decide who, if anyone, can override them.
- Review your insurance for social engineering and funds transfer fraud coverage.
- Agree how executives will verify each other in a genuine emergency, such as a code phrase or a call-back.
Technical notes
- Review mailbox audit logs for new inbox rules, unusual sign-ins and OAuth app consents. Email compromise often comes before a deepfake call.
- Enforce DMARC, flag external senders and monitor for lookalike domains.
- Configure Teams or Zoom to clearly label external participants and restrict anonymous joins.
- Verify requests using contact details from a trusted directory, never numbers or links supplied in the request.
- Use banking platform controls such as dual authorization and alerts on new or changed payees.
The takeaway
When seeing and hearing is no longer believing, process is the control. Verification has to be automatic and non-negotiable.
Related reading
Next step
Could this happen to you?
Tell us what you're protecting. We'll help you find the gaps before an attacker does, and plan how you'd respond if one gets in.
Book a consultationPrefer to talk?