CEO Impersonation and Deepfake Fraud: Assessing the Risk
TL;DR · the short version
CEO impersonation is a form of business email compromise (BEC): an attacker poses as a senior executive to pressure an employee into a fraudulent payment, data disclosure or access. AI has sharpened it - voice clones and video deepfakes now let attackers impersonate an executive on a call, defeating the 'I recognise their voice' check. Assess exposure by looking at who can move money or grant access and what verification is required. The defence is process, not detection: out-of-band verification so no single channel authorises high-risk actions.
CEO impersonation fraud is a decades-old social-engineering play — pose as the boss, apply urgency and authority, get an employee to wire money or hand over access. What has changed is the fidelity: AI voice clones and video deepfakes now let an attacker be the executive on a call, defeating the "I recognise their voice" check that a lot of informal verification quietly depends on.
How the attack works
An attacker poses as a senior executive and pressures an employee into a harmful action — usually a fraudulent payment, sometimes a data or access request. Urgency ("I need this done now, discreetly") plus authority short-circuits scrutiny. With a cloned voice or deepfaked video, the impersonation extends from email to phone and video calls that feel like proof of identity.
Why deepfakes change the calculus
Employees are trained to distrust emailed payment requests — but a call in the executive's voice, or a video with their face, feels verified. Voice and video can no longer be treated as authentication, which is exactly what many payment-approval processes implicitly assume.
Who is exposed
Anyone who can move money or grant access: finance/AP, executive assistants, HR, IT admins — especially where one person can act on an apparent executive request without independent verification.
CEO impersonation red flags
The clearest red flag in a CEO impersonation attempt is a request that pairs executive authority with a reason to skip your normal process - urgency, secrecy, or "I can't talk, just get it done."
- Urgency and secrecy - "this must go out today", "keep this between us", often timed for when the real executive is travelling or it is out of hours.
- Payment changes - new or changed bank details, a new beneficiary, an unusual destination country, or a request for gift cards.
- Channel switching - a request that moves you off corporate email to a personal phone, a messaging app or a new video-call link.
- Look-alike identities - a sender domain one character off, a display name that does not match the address, or a Reply-To address that differs from the From address.
- Process bypass - asks to skip the second approver, the purchase order or the callback "just this once".
- Resistance to verification - on a call or video, avoiding a callback to a known number or a pre-agreed verification question.
Any one of these is a reason to pause and verify out of band through a known contact. Train finance, accounts payable, executive assistants, HR and IT admins on them, and make it explicit that checking an executive's request will never be held against anyone.
The defence: process, not detection
Do not try to spot the deepfake in the moment. Require out-of-band verification for high-risk actions — payments over a threshold, bank-detail changes, sensitive data/access — via a pre-agreed channel and known contact, never the channel the request arrived on. Add a mandatory second approver and a callback to a known number, and make verifying an executive request expected, not insubordinate.
Assess and rehearse with the deepfake awareness tools →, and quantify identity exposure with the Identity Risk tool.
Frequently asked questions
What is it? A BEC attack impersonating an executive to authorise fraudulent payments, data sharing or access — now aided by AI voice/video deepfakes.
Why do deepfakes make it worse? They defeat voice/face recognition, so a call or video feels like proof of identity.
How to defend? Out-of-band verification and dual approval for high-risk actions — assume voice and video can be faked.
Who is exposed? Anyone who can move money or grant access, especially without mandatory verification.
Frequently asked questions
What is CEO impersonation / deepfake fraud?
CEO impersonation is a social-engineering attack, a form of business email compromise (BEC), where an attacker poses as a senior executive to pressure an employee into a harmful action — usually authorising a fraudulent payment, but also sharing sensitive data or granting access. AI voice cloning and video deepfakes now let attackers impersonate an executive convincingly on a phone or video call, not just over email, which defeats the recognition-based trust people place in a familiar voice or face.
Why do AI deepfakes make this worse?
Because they break the informal verification people rely on. Employees have long been told to be suspicious of emailed payment requests, but a phone call in the executive's cloned voice — or a video call with their deepfaked face — feels like proof of identity, and urgency plus authority pressures people to act. Voice and video can no longer be treated as authentication, which is exactly what many payment-approval processes implicitly assume.
How do we defend against executive impersonation?
The defence is process, not detection technology. Require out-of-band verification for high-risk actions — payments above a threshold, changes to bank details, sensitive data or access requests — using a pre-agreed channel and a known contact method, never the one the request came in on. Build in a mandatory second approver, a callback to a known number, and a culture where verifying an executive request is expected, not insubordinate. Assume voice and video can be faked.
Who is most exposed to CEO impersonation fraud?
Anyone who can move money or grant access — finance and accounts-payable staff, executive assistants, HR, and IT admins — especially where a single person can authorise a payment or change on the strength of an apparent executive request. Organisations without mandatory out-of-band verification and dual approval for high-risk actions are the most exposed, regardless of size.