AI system·Intermediate·Executive audience

A deepfake video call of your CEO authorises a $2.4 million payment

The prompt — read this to the room

On Monday a finance manager joined a video call with what looked and sounded like your CEO and CFO, plus an "external lawyer". They explained a confidential acquisition and asked for three urgent payments to an escrow account, totalling $2.4 million. The manager made the payments after a follow-up email from the CEO's real address, sent through a compromised mail rule. Today the real CEO asks why finance moved money on a deal that does not exist. Your bank says the first transfer has left the receiving bank. The finance manager is distraught.

Total duration

1 h 30 min

People to involve

Best fit

Finance, Manufacturing

Who to involve

Most important first.

CFO / Finance
CEO / Managing director
CISO / Head of security
Legal counsel
HR
Board member

What it tests

Run the first hours of funds recovery: bank recall, law enforcement and insurers.
Investigate the mailbox compromise that made the deepfake convincing.
Treat the employee fairly while learning what failed in the process.
Redesign payment verification so it does not depend on recognising a face or a voice.

Outline of activities

1Discovery: the payment that should not exist
2The recovery clock: banks, law enforcement and insurers
3How it worked: the deepfake and the compromised mailbox
4The employee and the team
5Payment controls that survive synthetic media

Run sheet (Pro)

The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.

Loading…