In short
In deepfake CEO fraud, criminals use AI-generated video or voice to pose as an executive and push an employee into an urgent, secret payment. It exploits authority and time pressure; the fake adds credibility. Reported business email compromise losses passed US$3 billion in 2025, according to the FBI. Protect yourself with a payment process no voice or face can override.
A few years ago, a fake email from “the CEO” was the classic trick. Now the CEO can appear on a video call, with the right face and the right voice, asking you to make a confidential payment today. Whether that money leaves the company then depends on the agreements in your payment process. Below you can read how the scam works, how big the problem is, and which simple checks stop it. I think the strongest defence starts with alert people across the whole organisation, who know how this fraud works and dare to question a request, with IT in support.
- For BEC scams that explicitly involved AI, businesses reported losses of over US$30 million in 2025, and the FBI warns that many victims do not realise AI was involved.
- In Hong Kong, an employee transferred about HK$200 million after a pre-recorded video call with a fake CFO.
- Europol calls fraud schemes the fastest-growing area of organised crime.
- Call back on a number from your own records, and require two people for large or unusual payments.
- In 2025 the FBI’s recovery team helped freeze over US$679 million in fraudulent transfers, a success rate of 58%.
Keynote by Richard
Cybercrime in the AI Era. How criminals use AI, what comes next and how your organisation can build resilience.
What is deepfake CEO fraud?
Deepfake CEO fraud is business email compromise with an AI-generated face or voice.
It is a form of business email compromise, or BEC: fraud aimed at companies that regularly make payments to suppliers. The FBI’s 2025 Internet Crime Report describes how criminals compromise email accounts, phone numbers and video meeting apps to get money transferred. The AI part is new. Chat tools write emails that sound exactly like a company’s CEO. Voice cloning copies how an executive speaks. Deepfake video adds a face. The goal stays the same: a transfer that looks approved from the top.
Recognising deepfakes is above all a matter of knowledge and awareness across the whole organisation. IT can support that, with knowledge and with systems that detect and monitor deepfakes.
The fake CFO in Hong Kong
A pre-recorded video call with a fake CFO cost a company in Hong Kong about HK$200 million.
A documented case comes from Hong Kong. In a written reply to the Legislative Council in June 2024, the city’s Secretary for Security described it step by step:
- At the end of January 2024, an employee received a phishing email from someone posing as the chief financial officer of the company’s head office in the United Kingdom.
- The employee was invited to a group video conference about “confidential transactions”.
- Following instructions, the employee authorised transfers to five local bank accounts. The loss was about HK$200 million.
- Police believe the video conference was pre-recorded, made from public online video clips and the voice of the executive. There was no real interaction.
- The fraudster ended the meeting with an excuse and continued the instructions through an instant messaging app.
The same reply mentions a second case, in May 2024. A staff member of a multinational joined a video call of almost 30 minutes with a “fake boss”, who asked for a transfer of nearly HK$4 million. Notice what made it work: a familiar face, a trusted role, secrecy and speed. As the Secretary describes it, no systems had to be hacked for that.
How big is the problem?
Reported BEC losses in the US passed US$3 billion in 2025, and many victims do not realise AI was involved.
Big, and probably larger than the figures show. In 2025 the FBI’s Internet Crime Complaint Center received 24,768 BEC complaints, with reported losses of over US$3 billion. More than 22,000 complaints in all crime types mentioned AI, with adjusted losses of over US$893 million. For BEC scams that explicitly involved AI, businesses reported losses of over US$30 million. That sounds modest, but the FBI itself warns that many victims do not realise AI was involved. In investment fraud, for example, losses with a reported AI link were over US$632 million, while total investment fraud losses exceeded US$8 billion.
In Europe, Europol’s latest threat assessment, IOCTA 2026, points in the same direction. It calls fraud schemes “the fastest-growing area of organised crime” and says generative AI continued to accelerate online fraud, including “enhanced realism in business email compromise (BEC) and CEO fraud”. Europol also writes that “social engineering and human error will remain the weakest links for fraudsters to exploit.” For a broader look at how AI is used to deceive people, read the new face of deception.
Why do people fall for it?
The scam is built around normal behaviour: authority, secrecy and speed.
Employees are trained to act quickly when a senior executive asks. A “confidential acquisition” explains why nobody else may know. A video call seems to remove the doubt that a strange email raises. In the Hong Kong case, the fraud started with a phishing email, and the video call made the request look real.
Spotting a deepfake by eye is getting harder. We described why in the death of truth: how deepfakes are rewriting reality. The same voice technology is used against families too, as in AI voice manipulation in virtual kidnapping. And AI is used on the attacking side in other ways, from phishing to malware: see the growing role of generative AI in cyberattacks.
How do you stop a fake CFO?
Rely on a payment process that makes the fake irrelevant, not on people recognising it.
Start by walking through your payment process, from the request to the transfer: which steps can AI and other technology support, such as recording who approved what, and which decisions stay with people, such as calling back and releasing the payment?
→ Read more: AI agents in financial services: what is allowed, what is required and what comes next
- Verify through a second channel you choose.
Call the requester back on a number from your own records, never on a number or link in the message. - Require two people for large or unusual payments.
No single employee should be able to release a large transfer, however senior the requester seems. - Make “secret and urgent” a red flag, not a reason.
Write in your policy that confidentiality never overrides the payment checks. Say it out loud from the top. - Use a verification word.
The FBI advises families to agree on a secret word or phrase to confirm identity. Finance teams can do the same for payment requests. - Protect changes to bank details.
A new account number for a known supplier always gets a call-back check. - Practise.
Run an exercise with a fake request, and discuss the result without blame. - Report quickly.
Speed matters. In 2025 the FBI’s recovery team helped freeze over US$679 million in fraudulent transfers, 58% of the amount at stake in the cases it handled, by contacting banks while the money was still moving.
Does the EU AI Act help?
Partly: the AI Act makes legitimate AI content easier to recognise, but criminals will not label their fakes.
The European Commission explains that under the AI Act, deepfakes must be clearly and visibly labelled, and that providers of generative AI must make AI-generated content identifiable. These transparency rules apply from August 2026. That helps honest users and platforms. Criminals will not label their fakes. The law makes it easier to recognise legitimate AI content, but your payment process still has to stop the illegitimate kind.
Richard speaks on this topic
Cybercrime in the AI Era. How criminals use AI, what comes next and how your organisation can build resilience.
Frequently asked questions
How does CEO fraud differ from BEC?
Business email compromise, or BEC, is fraud aimed at companies that regularly make payments to suppliers. CEO fraud is a form of it in which the criminal poses as a senior executive. The AI part is new: chat tools, voice cloning and deepfake video make the request look approved from the top.
What does the AI Act say about deepfakes?
Under the EU AI Act, deepfakes must be clearly and visibly labelled, and providers of generative AI must make AI-generated content identifiable; these rules apply from August 2026. Criminals will not label their fakes, so your payment process still has to stop them.
What should you do after a fake transfer?
Act at once and contact your bank while the money is still moving. Speed matters: in 2025 the FBI’s recovery team helped freeze over US$679 million in fraudulent transfers that way.
Can you spot a deepfake by eye?
It is getting harder. That is why the strongest defence does not depend on recognising the fake: call back on a number from your own records, require two people for large payments and agree on a verification word.
What should a board do now?
Start with three questions about your payment process, and test the answers.
Ask three questions. Can one person in our company release a large payment after a single call or video meeting? Do our finance staff know they are allowed, and expected, to say no to an executive? And when did we last test it? If the answer to the first question is yes, that is the place to start. It is also one of the themes in the keynote on cybercrime in the age of AI, because the weak spot is rarely the technology. It is the moment someone decides to trust.
Deepfakes show that new technology also gives criminals new tools. I think managers should above all encourage a critical eye here: staff who dare to ask an extra question and know they may say no to an executive. Practise it together, and then discuss openly what went well and what could be better. How to make people alert and keep them that way is also the subject of the keynote on the organisation of the future.
Richard van Hooijdonk is a trend watcher, futurist and international keynote speaker. Many trend watchers and futurists look at the future from a distance. Richard van Hooijdonk lives in it. His team consists of people and AI agents, and he has several chips implanted in his body. He has given more than 3,000 keynotes in more than 30 countries. View his keynotes →