AI-powered CEO fraud: how to protect your company from deepfakes

The boss calls. The voice sounds familiar, you can even hear his characteristic pauses. He asks for an urgent transfer to a new supplier or a change of bank account number, because “the accountant is on vacation and this can’t wait”. Today such a voice can be faked with an AI tool, so recognizing someone by their voice is no longer proof.

In this guide you get a simple procedure for a small company. It consists of a verification password, a callback to a known number, the two-person rule for transfers and a short team training session. You can put it in place in one afternoon, without buying any special software.

What AI-powered “CEO fraud” looks like

The scheme is old; only the tool changes. The scammer pretends to be someone the employee trusts: the owner, a partner, the CEO or the accountant. Today, instead of an email from a spoofed address, they can send a voice message on a messaging app or call with a voice that imitates the real person.

Material for faking a voice is often available online: a video on the company website, a recording from an event or a post on a social media profile. I’m not claiming that every voice can be faked perfectly. But it’s enough for the call to be short and the line to be noisy for the time pressure to work.

Typical requests look like this:

• an urgent transfer to a new account, “because the deal is falling apart”,
• a change of a supplier’s bank account number on the next invoice,
• buying gift cards or prepaid top-ups and sending the codes,
• a request for codes from text messages or for access to online banking,
• “just don’t tell anyone, it’s a confidential transaction”.

How to tell that something is wrong

The voice can be very convincing, so don’t judge how it sounds. Judge the circumstances. Fraud almost always has a few features in common:

1. Urgency. “I need this within an hour.”
2. Secrecy. “Don’t tell anyone, including the accountant.”
3. An unusual channel. The boss writes from a new number or from a messaging app he has never used to give instructions.
4. A new account or a new recipient. It’s the first time you have seen this company or this account number.
5. Skipping the usual procedure. The boss usually asks for an invoice, but now “there’s no time”.

If two of the five points fit, end the call and follow the procedure below. You don’t have to be certain that it’s fraud. It’s enough that you are not certain that it isn’t.

Step 1: set a verification password

A verification password is a word or a short question known only to the people authorized to give financial instructions. A scammer doesn’t know it, even with a good voice.

Rules that make it more effective:

• agree on it verbally, at a meeting, not by email or on a messaging app,
• choose something that can’t be found online, so not your dog’s name or a street name,
• a question with an answer is better than a single word, because it’s harder to guess,
• change it every few months and after every change in the team,
• the rule is simple: no password, no transfer, even when the owner calls in person.

The owner shouldn’t take offense at this. It works in his favor, because it also protects his money.

Step 2: call back on a known number

A password isn’t enough if it leaks or someone overhears it. The second layer is a callback. You hang up and call a number you have had saved for a long time: from a business card, from a contract or from your own address book.

What not to do:

• don’t call back the number that has just called you,
• don’t tap “call back” in the message,
• don’t use a number given in the same message.

If the boss doesn’t answer, write to a known email address or ask someone who is nearby. If the matter is truly urgent, the boss will call again. If it’s a scammer, they will disappear or start applying pressure. That is information too.

Step 3: the two-person rule for transfers

The strongest protection is one where a single person cannot send money alone. In a small company, a simple version is enough:

• one person prepares the transfer,
• a second person approves it after checking the invoice and the account,
• for a new recipient or a change of account number, add a phone call to the business partner at the number from the old contract or their website,
• set the thresholds yourself: from what amount the rule always applies.

In business online banking, many banks let you configure two signatures or a limit for one person. Look in your bank’s settings or ask your advisor. If you run a one-person company, the role of the second person can be filled by your accountant or a trusted person who gets a notification from you about transfers above a set amount.

A changed account number on an invoice is a separate and very common case. I describe it in the guide on a swapped bank account number on an invoice: it includes a procedure for the accounting department and a plan for the first hour after the transfer.

Step 4: a short team training session

A procedure won’t work without talking to people. 15–20 minutes every few months is enough. At the meeting:

1. Explain how the fraud works and play a few sample recordings from the internet for the team, so they can hear how realistic an artificial voice sounds.
2. Show the five warning signs from this guide.
3. Practice the scenario: “the boss calls and wants a transfer to a new account”. What do you do, step by step?
4. Say outright that everyone has the right and the duty to verify an instruction, including when it comes from the owner.
5. Decide who people should go to with their doubts.

The most important sentence every employee should hear: “Nobody will hold it against you that you checked an instruction, even if it turned out to be genuine.”

What to do if the transfer has already gone out

The first minutes matter most. Act in this order:

1. Call your bank at the hotline number given in the app or on the bank’s website. Say that you suspect fraud and ask them to try to stop or recall the transfer.
2. Keep the evidence: screenshots, call recordings, voice messages, phone numbers, times and the content of invoices. Don’t delete anything.
3. Report the matter to the police, attaching the materials you have collected.
4. Report the incident to CERT Polska (Poland’s national computer security incident response team) through the form at incydent.cert.pl. Such reports help warn other companies.
5. Warn your team and business partners that someone is impersonating your company. The same scammer may call someone else.
6. If the scammer obtained passwords or access to accounts, change the passwords and turn on two-factor authentication.

I don’t promise that the bank will always manage to stop the money in time. The sooner you call, the better the chance.

Reduce the material available to scammers

A scammer usually prepares: they check who the boss is, who makes the transfers and how the company talks to customers. We publish some of this information ourselves. It’s worth limiting it:

• don’t list private phone numbers or the full company structure with financial roles on your website,
• don’t publish internal documents or invoice templates with payment details,
• keep an eye on the forms and mailboxes on your website: spam and break-ins often come before someone impersonates a company,
• turn on SPF, DKIM and DMARC for your company email to make it harder to spoof the sender’s address (I describe this in the guide on emails going to spam),
• after any changes in the company, review who has access to online banking and mailboxes.

If you want to check how well your website is protected, start with the free Check your website tool: in about 30 seconds you will see what to improve in security and in your domain’s email.

A printable checklist

• [ ] We agreed on the verification password verbally.
• [ ] We confirm every transfer to a new recipient by phone at a known number.
• [ ] Transfers above a set amount are approved by two people.
• [ ] The team has completed a 15-minute training session.
• [ ] Everyone knows whom to notify when something raises doubts.
• [ ] We keep the bank’s phone number and the incydent.cert.pl address somewhere visible.
• [ ] We have turned on two-factor authentication for online banking and email.

Summary

The boss’s voice on the phone is no longer proof of identity. A verification password, a callback to a known number and the two-person rule cost a minute, but they can save the company from losing the money for a whole month’s payroll.

If you want to check the security of your company’s website and server, I will carry out a security audit for you, and if needed, I will secure your server and application. Write to me, I reply within 24 hours, and new clients get 20% off their first order.