Deepfake CEO fraud: a familiar voice proves nothing.

In January 2026 a business owner in the Swiss canton of Schwyz transferred several million francs to a bank account in Asia. Over the previous two weeks, fraudsters had called him in the voice of a business partner he knew, about a confidential international deal. The voice had been manipulated with AI. According to the cantonal police, the fraud was only noticed once the payments had gone.

CEO fraud no longer stays in the inbox. Switzerland’s Federal Office for Cybersecurity (BACS) recorded 971 cases of CEO fraud in 2025, about 35% more than the 719 of 2024, and cited the Schwyz case in its warning: fraudsters increasingly use calls and voice messages in which a manager’s or a partner’s voice is “convincingly imitated using AI”.

A voice you recognise is no longer evidence of who is speaking. Any approval that rests on recognising someone, on the phone or on a video call, is already broken — and the fix is not a tool. It is a rule the chief executive has to own.

The call that used to expose the fraud now confirms it

Our article on business email compromise ended the fake-president email where the old advice begins: if in doubt, pick up the phone. That advice assumed the voice on the line could not be faked. The attacks of the last two years run the other way. A message sets the scene, a call confirms it, and each channel vouches for the other.

In January 2024 a finance employee in the Hong Kong office of Arup, the British engineering group, received a message about a secret transaction. He suspected phishing, then put his doubts aside after joining a video conference with what looked and sounded like the group’s chief financial officer and other staff, all digitally recreated. Over a week he made 15 transfers to five accounts: HK$200 million, about US$25.6 million. Arup confirmed the case in May 2024.

In February 2025, Italian prosecutors described calls in the cloned voice of the defence minister, Guido Crosetto, asking business leaders to fund the release of journalists held in the Middle East. One paid almost €1 million in two transfers before police traced the money to a Dutch account and froze it.

Video is still the exception. BACS has seen AI-manipulated video conferences, but says they appear “too complex for widespread use” and are “probably still in the experimental stage”. The volume is in phone calls and voice messages.

Five documented deepfake calls. Every loss stayed on the channel the attacker offered.

Why training staff to hear the fake is a losing bet

The instinctive answer is awareness training: teach people to hear the fake. The research says the ear is not a control. In a 2023 University College London study, 529 listeners identified deepfake speech about 73% of the time, and training improved that only slightly. In 2025, researchers at Queen Mary University of London cloned voices with off-the-shelf software from less than five minutes of speech each. Listeners judged 58% of the clones to be human — against 62% of the real recordings.

Executives publish their voices: conference talks, interviews, podcasts, company videos. Five minutes of a chief executive’s speech is rarely hard to find.

ENISA’s 2025 threat landscape reports that by early 2025, AI-supported phishing reportedly made up more than 80% of observed social engineering activity worldwide. Detection is a race against software that keeps improving. A procedure does not have to win that race.

What stopped the attempts that failed

Two well-documented attempts, both made public in 2024, failed. In neither does the record credit the ear alone.

At WPP, fraudsters set up a WhatsApp account with the chief executive’s photo and arranged a Teams meeting that seemed to include him and another senior executive, using a cloned voice and YouTube footage of that executive while impersonating the chief executive in the chat. They asked an agency leader to set up a new business, to extract money and personal details. The attempt failed, and the chief executive, Mark Read, warned staff afterwards: “Just because the account has my photo doesn’t mean it’s me.”

At Ferrari, an executive received WhatsApp messages from an unfamiliar number, then a call in the chief executive’s cloned voice about a confidential acquisition that needed a currency hedge. He noticed a slightly mechanical intonation, which deepened his suspicion. What ended the call was a question: the title of a book the chief executive had recommended to him days earlier. The line went dead.

Every loss stayed on the channel the attacker offered. At Ferrari, the call ended on ground the attacker did not control: a question nobody could look up. That gives three checks and one rule.

Three checks and one rule that still work when the voice is perfect. None of them depends on hearing the fake.

1. Hang up and call back on a number you look up yourself — the directory, the contract, the phone already in your contacts. Never the number that called, never one in the message. An incoming channel cannot vouch for itself.
2. Ask something that is not online. A phrase agreed in person between executives and the people who release payments, changed after each use; or a recent private detail, as at Ferrari.
3. A second approver for any payment requested by phone, video or message — the four-eyes principle that the Schwyz police and BACS both repeat.
4. No exception for a confidential deal. Secrecy, urgency and a new beneficiary together mean stop, whoever is asking. Schwyz, Arup and Ferrari all came wrapped in a confidential deal.

The chief executive’s sentence

Deepfake CEO fraud impersonates the person at the top, so only that person can disarm it. For a finance clerk, checking up on a request from the chief executive can feel like a career risk. That hesitation is what the attackers rely on.

So the chief executive says it out loud, to the people who move money: I will never ask you to make a payment on a call, a video or a message alone. If I seem to, hang up and call me back. You will never be in trouble for checking. BACS frames it as culture: healthy scepticism should count as a strength, not as disobedience.

Our training and awareness programmes rehearse exactly that call with finance teams until refusing feels routine, and our virtual CISO service makes sure the rule has an owner and survives the next reorganisation.

What NIS2 already asks for, and what the AI Act will not do

For companies in scope of NIS2, this is not optional good practice. Article 21(2)(j) lists “secured voice, video and text communications” within the entity, where appropriate, among the risk-management measures, next to multi-factor authentication. Article 21(2)(g) requires cybersecurity training, and Article 20(2) requires members of management bodies to follow training themselves. A payment instruction from a WhatsApp number nobody has verified is exactly what those measures exist to prevent: it is not a verified channel, whatever its encryption. Our NIS2 compliance service maps those measures onto your own approval chain.

Do not expect the AI Act to help. Since 2 August 2026, Article 50(4) has required deployers of AI systems that generate deepfakes to disclose that the content is artificial; we covered the duty in On 2 August, your chatbot must say it’s a bot. A fraudster will not label his call. The rule deals with honest deepfakes, not criminal ones.