Your CFO Is on the Phone. It Isn’t Your CFO.

Deepfake voice and video attacks are no longer a theoretical threat. In 2024, one company wired $25 million to attackers after a fake CFO conducted a video call. Your employees aren’t trained for this.

A finance employee at Arup, one of the world’s largest engineering firms, joined what appeared to be an ordinary video conference with colleagues. On the screen were people she recognized: the company’s CFO and several other senior executives. They looked familiar. They sounded familiar. Nothing seemed out of place.

The request, however, was unusual. During the meeting, the CFO instructed her to authorize wire transfers totaling $25 million USD. Trusting the people on the call, she completed fifteen separate transactions to five bank accounts in Hong Kong.

None of the executives on that video call were actually there. Every face and every voice had been generated by artificial intelligence using publicly available photos, videos, and audio recordings of Arup’s leadership team. By the time the deception was uncovered, the money had already disappeared.

This was not a traditional cyberattack. No firewall was breached. No malware was installed. No software vulnerability was exploited. It was an identity attack.

For the first time, attackers didn’t need to steal an executive’s credentials. They simply became the executive. And the employee had no reason to believe she was speaking to anyone else.

The Threat That Arrived Ahead of Schedule

The 1,633% increase in deepfake voice phishing, or vishing, attacks is not a statistical anomaly. It represents a fundamental shift in how attackers impersonate trusted people.

Not long ago, creating a convincing voice clone required specialized expertise, expensive equipment, and lengthy audio recordings. Today, publicly available AI tools can generate remarkably realistic voice replicas from just a few seconds of recorded speech.

That means most senior executives have already provided attackers with the raw material they need. Every podcast appearance, conference presentation, earnings call, webinar, YouTube interview, LinkedIn video, or media interview becomes training data for an AI model capable of mimicking their voice with startling accuracy.

“The attacker doesn’t need to guess your CFO’s password. They need a two-minute video of your CFO speaking. The rest, AI handles.”

In other words, your CEO, CFO, and executive team may already have a digital twin in the hands of a cybercriminal. The question is no longer whether the technology exists. It is whether your employees can recognize the difference before they authorize a payment, disclose sensitive information, or grant access to critical systems.

Why This Is an Identity Security Problem

Deepfake fraud is fundamentally an identity security problem. More specifically, it is an authentication problem. Organizations invest heavily in verifying identities when someone signs into a system. Multi-factor authentication. Device trust. Behavioral analytics. Anomalous login detection.

Every one of these controls is designed to answer the same question: Is this person really who they claim to be?

But all of those controls assume the authentication challenge happens at a login screen. They offer no protection when an employee joins a video meeting and sees what appears to be their CEO, hears what sounds like their CFO, or receives a phone call from someone whose voice is indistinguishable from a trusted executive.

This is the gap deepfake attacks exploit. Rather than attacking technology, attackers exploit human trust. They bypass technical controls entirely by convincing an employee that the person asking for a wire transfer, sensitive information, or privileged access is exactly who they appear to be.

For decades, we have taught employees to verify identities online. AI has now made it necessary to verify identities in conversations as well.

The Attack Scenarios

These scenarios are no longer hypothetical. Every one of them can be executed using AI tools that are readily available today, and each targets the same vulnerability: employees who believe they are communicating with someone they know and trust. The technology may be new, but the objective is the same: persuade a trusted person to take an action that benefits the attacker.

Scenario #1: The CFO Call

An accounts payable employee receives a Microsoft Teams call from the CFO. The video looks authentic. The voice is unmistakable. The CFO explains that the company is finalizing a confidential acquisition and needs an urgent wire transfer. “Don’t use email,” he says. “This has to remain confidential.” The employee authorizes the payment.

The CFO’s account was never compromised. No malware was installed. No firewall was breached. The attacker needed only a convincing deepfake and a cloned voice.

Scenario #2: The IT Help Desk Reset

Your IT help desk receives a call from a senior executive who claims to be locked out of their account minutes before an important meeting. The caller sounds exactly like the executive because the voice was cloned from conference presentations and company videos available online.

After answering a handful of security questions gathered from LinkedIn and your corporate website, the caller persuades the technician to reset the executive’s password and MFA enrollment. The attacker now owns a legitimate account with full access.

This is a variation of the social engineering technique used in the MGM Resorts breach, where attackers convinced the help desk to reset credentials for a privileged user.

Scenario #3: The Vendor Impersonation

A trusted contractor receives an email from what appears to be your CISO, followed by a phone call confirming the request. The voice is familiar. The terminology is correct. The caller explains that an external security assessment requires temporary elevated access and asks that it be enabled immediately.

Wanting to support the security team, the contractor grants the requested permissions. Hours later, attackers begin moving laterally through your environment using the access that was willingly provided.

No passwords were guessed. No systems were exploited. The organization simply trusted the wrong identity.

Case Studies

The MGM Warning: Your Help Desk Is a Deepfake Target

The MGM Resorts breach did not involve deepfake technology. It didn’t need to. Attackers successfully convinced the IT help desk to reset credentials for a privileged user through social engineering alone. The lesson was clear: if an attacker can persuade your help desk they are someone they are not, they can bypass many of your technical security controls.

Deepfake voice technology dramatically increases that risk.

Help desks are trained to help people regain access to their accounts. When someone calls claiming to be locked out, sounding frustrated and under pressure, the instinct is to resolve the problem quickly. AI-generated voice clones make that deception far more convincing by allowing attackers to sound exactly like the employee or executive they are impersonating.

Without a verified, out-of-band identity verification process for password resets, MFA resets, and privileged account recovery, your help desk can become one of the easiest paths into your organization. The attacker doesn’t need malware, stolen credentials, or a software exploit. They just need a phone call that sounds authentic.

Building Defenses Against AI Identity Fraud

Deepfake attacks succeed because people trust what they see and hear. That means the most effective defenses are not just technical controls. They are business processes that assume voice and video can no longer be treated as proof of identity.

The Uncomfortable Reality

For more than two decades, organizations have been told that employees are the weakest link in cybersecurity. The solution, we were told, was better awareness training. Teach people to recognize phishing emails. Teach them to question suspicious requests. Teach them to be more vigilant.

That advice is no longer enough. Deepfake technology changes the equation because it attacks something humans have always relied on: the ability to recognize a familiar face and voice. When an AI-generated executive is visually and audibly indistinguishable from the real person, even well-trained employees can be deceived.

The answer is not to expect employees to become experts at detecting AI-generated voices and videos. The answer is to redesign high-risk business processes so that trust is never based on voice or video alone.

The organizations that will withstand this new generation of attacks will not be the ones with the most convincing awareness campaigns. They will be the ones that make it impossible to authorize a wire transfer, reset privileged credentials, or grant elevated access without independent verification.

In the age of artificial intelligence, seeing is no longer believing. Neither is hearing. The only proof of identity that matters are ones that can be independently verified.

Find Out Whether Your Authentication Controls Can Stop AI Fraud

Our Identity Security Gap Analysis includes a dedicated section on authentication and identity fraud prevention. Six questions reveal whether your processes could catch a deepfake impersonation, or would let it through.