---
title: "CEO fraud and deepfake executive calls: how finance teams stop them"
description: "How CEO fraud works - from spoofed emails to deepfake video calls - and the verification steps that stop fake payment requests."
url: https://realpayee.com/ceo-fraud
canonical: https://realpayee.com/ceo-fraud
date_published: 2026-10-05
date_modified: 2026-10-05
updated: 2026-10-05
author: "RealPayee"
site: RealPayee
---

# CEO fraud and deepfake executive calls: how finance teams stop them

> **CEO fraud** is a scam in which a criminal impersonates a company's CEO, CFO or another executive to pressure an employee into sending a wire, buying gift cards or sharing sensitive data. It's a form of **business email compromise (BEC)**, also called executive impersonation or whaling. It now arrives by spoofed email, text, cloned voice or deepfake video, so finance teams stop it by verifying through a separate, known channel.

_Updated 2026-10-05 · 9 min read_

## Key takeaways

- Another name for CEO fraud is **business email compromise (BEC)**; it's also called **executive impersonation**, **whaling** or “fake president” fraud.
- The attacker's main tool is **authority plus urgency**: a confidential deal, a late payment, a boss who is unreachable.
- **Deepfakes raise the stakes**: Arup lost about $25.6 million after a video call with deepfaked executives; attempts against WPP and Ferrari failed because staff checked.
- The fix is procedural: every out-of-pattern executive request is verified on a **known channel** with a **challenge** the impostor can't answer, then goes through normal approvals.

## What is CEO fraud?

CEO fraud is social engineering aimed at the people who can move money. The attacker poses as a senior executive - usually the CEO or CFO, sometimes a board member, general counsel or outside lawyer - and asks a finance employee to do something urgent and confidential: wire funds for an acquisition, pay a “new supplier”, buy gift cards for a client event, or send W-2 data to the “auditors”.

It works because it exploits the organization's own hierarchy. Employees are trained to respond quickly to the boss, and the request is designed so that pausing to check feels like insubordination. The FBI's IC3 groups CEO fraud under business email compromise, which cost US victims roughly **$3.0 billion** in 2025, with an average loss of about $123,000 per complaint.

## Another name for CEO fraud

You will see CEO fraud described under several names. They overlap; the differences are mostly about who is impersonated and who is targeted.

| Term | What it means |
| --- | --- |
| Business email compromise (BEC) | The FBI's umbrella term for payment fraud via impersonated or compromised business email. CEO fraud is one type. |
| Executive impersonation | Any scheme where the attacker poses as a senior leader, by email, text, phone or video. |
| Whaling | Phishing aimed at senior executives (“big fish”). Often used loosely for CEO fraud in general. |
| Fake president fraud | Common name in Europe (French: fraude au président) for the same scheme. |
| Deepfake CEO / CFO fraud | CEO fraud using AI-generated voice or video of the executive. |

## How CEO fraud works

1. **Research.** Org charts, LinkedIn, earnings calls and press releases reveal who the CFO is, who runs AP, when the CEO is travelling and what deals are in the news.
2. **Access or spoofing.** The attacker uses a lookalike domain, a spoofed display name, a personal-looking Gmail (“sending from my phone”), or a genuinely compromised executive mailbox.
3. **The hook.** A short, informal opener tests responsiveness: “Are you at your desk? I need you to handle something discreetly.”
4. **The request.** A wire to a new account, often framed as a confidential acquisition, legal settlement or overdue supplier payment, with instructions not to discuss it.
5. **Escalation.** If the employee hesitates, a second persona joins - a “lawyer” or “banker” - or the attacker moves to a call, now often using a cloned voice.
6. **Repetition.** If the first transfer works, more follow, until someone outside the conversation notices.

## CEO fraud email examples

These are illustrative composites of common patterns, not real messages:

- “Are you available? I'm in meetings all day and need a quick favor. Reply here, don't call.”
- “We are closing a confidential acquisition. Our counsel will contact you with wire instructions. Please keep this between us until the announcement.”
- “Can you pay the attached invoice today? The vendor is threatening to stop work and I promised them payment.”
- “I need eight $500 gift cards for client appreciation. Send me photos of the codes.”
- “Please send me all employee W-2s for this year in PDF, for a review with the auditors.”

What they share: the sender is senior, the matter is urgent and secret, the normal process is bypassed, and the channel discourages a call back.

## Deepfake CEO and CFO calls

The old advice - “if in doubt, call them” - is no longer enough on its own, because the call itself can be fake. Three widely reported cases show the range:

- **Arup (2024).** A finance employee joined a video call in which the other participants - who looked and sounded like senior colleagues - were deepfakes. The employee made 15 transfers totalling about **$25.6 million**.
- **WPP (2024).** Attackers set up a Microsoft Teams meeting using a voice clone of the CEO to try to extract money and personal details. Staff did not comply and the attempt failed.
- **Ferrari (2024).** An executive received WhatsApp messages and a call from someone imitating CEO Benedetto Vigna's voice. He asked a personal question only the real CEO could answer; the caller hung up.

The lesson from Ferrari is the important one: the defense was not spotting artifacts in the audio - it was a **challenge** the impostor couldn't pass, on the employee's initiative. The IC3 reported that more than $30 million of BEC losses in 2025 had a confirmed AI nexus, and voice and video cloning keep getting cheaper.

> [!WARNING]
> **An inbound call is not verification**
> If the executive (or someone claiming to be them) called you, you have not verified anything. Verification is you reaching them on a channel you chose, using contact details you already had.

## Red flags of a fake executive request

- Secrecy: “don't mention this to anyone”, “this is under NDA”.
- Urgency tied to a deadline you can't check: a closing today, a penalty tonight.
- A new payee or bank account, especially overseas.
- A request to bypass approvals “just this once”.
- Contact by personal email, text or a messaging app the executive doesn't normally use with you.
- On calls: poor connection excuses, camera off or glitchy, refusal to switch to a call you initiate.
- Gift cards, crypto or anything hard to reverse.

## How to stop CEO fraud: a verification procedure

Write the following into your payment policy and have the CEO and CFO sign it, so that following it can never be seen as disobeying them:

1. **Pause on any out-of-pattern request.** Any request from an executive to move money, change payment details, buy gift cards or share payroll or tax data outside the normal workflow triggers verification - no matter the channel or the urgency.
2. **Do not reply on the same channel.** Do not answer the email, text, WhatsApp or call that made the request. Treat its contact details as untrusted.
3. **Reach the executive on a known channel.** Call the executive on the number in your company directory, message them in your internal chat tool from a contact you already have, or ask their assistant. Ask them to confirm the amount, payee and reason.
4. **Use a challenge only the real person can answer.** Ask a pre-agreed code word or a personal question the attacker could not research. Never accept “I can't talk now, just do it” as confirmation.
5. **Apply normal approvals.** A confirmed request still goes through dual approval and payment limits. Executives cannot waive the controls by being senior or in a hurry.
6. **Record and report.** Log who verified, how and when. If the request was fake, report it to IT and security, and to the FBI's IC3 if money moved.

### A one-paragraph executive commitment

> [!NOTE]
> “I will never ask anyone in finance to skip our payment approval process, keep a payment secret from the controller, or act on a request we have not verified on a channel you chose. If you receive such a request - even if it looks, sounds or appears on video exactly like me - verify it first. You will never be in trouble for checking.” - [CEO name]

### Controls that back up the procedure

| Control | Why it helps |
| --- | --- |
| Dual approval above a set threshold | One deceived employee can't release money alone |
| Executive code words or challenge questions, stored offline | Defeats voice and video cloning |
| No payments to new payees without vendor verification | Blocks the “pay this new supplier” variant |
| Email banners for external senders and lookalike domains | Makes spoofed executive emails stand out |
| Tabletop exercises with a simulated deepfake call | Builds the habit of pausing under pressure |
| Out-of-band, identity-bound approvals for high-value wires | Proves the real executive approved this exact payment |

## Where RealPayee fits

[RealPayee](https://realpayee.com) turns the verification step into a system rather than a habit. A high-value wire or an out-of-pattern request is held; the real executive confirms it on their own enrolled phone, or with ID plus a live selfie, via SMS, Slack or Teams; then it is released or blocked with an audit record. A cloned voice on an inbound call can't complete that check. See also our [wire fraud prevention guide](https://realpayee.com/wire-fraud-prevention).

## How to verify a payment request from an executive

1. **Pause on any out-of-pattern request** - Any request from an executive to move money, change payment details, buy gift cards or share payroll or tax data outside the normal workflow triggers verification - no matter the channel or the urgency.
2. **Do not reply on the same channel** - Do not answer the email, text, WhatsApp or call that made the request. Treat its contact details as untrusted.
3. **Reach the executive on a known channel** - Call the executive on the number in your company directory, message them in your internal chat tool from a contact you already have, or ask their assistant. Ask them to confirm the amount, payee and reason.
4. **Use a challenge only the real person can answer** - Ask a pre-agreed code word or a personal question the attacker could not research. Never accept “I can't talk now, just do it” as confirmation.
5. **Apply normal approvals** - A confirmed request still goes through dual approval and payment limits. Executives cannot waive the controls by being senior or in a hurry.
6. **Record and report** - Log who verified, how and when. If the request was fake, report it to IT and security, and to the FBI's IC3 if money moved.

## Frequently asked questions

### What is CEO fraud?

CEO fraud is a scam in which a criminal impersonates a CEO or other senior executive to trick an employee into sending money, buying gift cards or sharing sensitive data, usually by exploiting urgency and secrecy.

### What is another name for CEO fraud?

CEO fraud is a type of **business email compromise (BEC)**. It is also called executive impersonation, whaling (when executives are targeted), or “fake president” fraud in Europe.

### What does a CEO fraud email look like?

Typically short and informal, from the CEO's name on a lookalike or personal address, asking if you're available, then requesting an urgent, confidential wire or gift-card purchase and discouraging a phone call.

### Can deepfakes really fool finance staff?

Yes. In 2024 an Arup employee made transfers totalling about $25.6 million after a video call with deepfaked executives. Verification on a channel you initiate, with a challenge only the real person can answer, is the reliable defense.

### Is CEO fraud the same as whaling?

They overlap. Whaling is phishing that targets senior executives; CEO fraud impersonates executives to target employees. Many people use the terms interchangeably.

### What should I do if I sent money after a CEO fraud email?

Call your bank immediately to request a recall, report it to your security team and to the FBI at ic3.gov, preserve all messages, and notify your insurer.

## Sources

- [McDonald Hopkins - The sobering truth of the FBI's 2025 Internet Crime Complaint Center report](https://www.mcdonaldhopkins.com/insights/news/the-sobering-truth-of-the-fbis-2025-internet-crime-complaint-center-report)
- [Fortune - Ferrari exec foils deepfake attempt by asking the scammer a question only CEO Benedetto Vigna could answer](https://fortune.com/europe/2024/07/27/ferrari-deepfake-attempt-scammer-security-question-ceo-benedetto-vigna-cybersecurity-ai/)
- [AFP - Over 75 percent of U.S. firms experienced payments fraud in 2025 (2026 Payments Fraud and Control Survey)](https://www.financialprofessionals.org/about/learn-more/press-releases/Details/over-75-percent-of-us-firms-experienced-payments-fraud-in-2025-while-ai-adoption-for-fraud-mitigation-lags)

## Related

- [Wire fraud prevention: how to stop bank wire fraud](https://realpayee.com/wire-fraud-prevention) - Controls that prevent business wire fraud: out-of-band verification, payment thresholds, dual approval and audit trails. (markdown: https://realpayee.com/wire-fraud-prevention.md)
- [Vendor fraud: types, examples and how to prevent it](https://realpayee.com/vendor-fraud) - What vendor fraud is, the most common schemes (vendor impersonation, fake bank changes, fake invoices) and the controls that stop them. (markdown: https://realpayee.com/vendor-fraud.md)
- [Payment fraud glossary](https://realpayee.com/glossary) - Plain-English definitions of payment fraud and verification terms: BEC, vendor impersonation, callback verification, positive pay and more. (markdown: https://realpayee.com/glossary.md)
- [Compare: manual callbacks vs bank-account validation vs RealPayee](https://realpayee.com/compare) - An honest comparison of approaches to stopping vendor-impersonation and fake payment requests. (markdown: https://realpayee.com/compare.md)

---

**Further reading**
- [Vendor verification guide](https://realpayee.com/vendor-verification.md)
- [Free vendor bank-change policy template](https://realpayee.com/templates/vendor-bank-change-policy.md)
- [Compare: callbacks vs bank-account validation vs RealPayee](https://realpayee.com/compare.md)
- [Pricing](https://realpayee.com/pricing.md)

Canonical HTML: https://realpayee.com/ceo-fraud · Site index for AI agents: https://realpayee.com/llms.txt?src=md-footer · Pricing: https://realpayee.com/pricing.md · Book a demo: https://realpayee.com/demo