What are deepfake CEO calls, and how do we protect against them?

Criminals now use AI-generated voice, and sometimes video, to impersonate a senior manager on a phone or video call and ask for an urgent payment or confidential data. A few minutes of public audio, from a conference talk or a podcast, can be enough to clone a voice. In a widely reported 2024 case in Hong Kong, an employee transferred about 25 million US dollars after a video call in which every other participant was a deepfake. You cannot rely on spotting the fake, because the quality keeps improving. Protect the process instead: no payment or data release on the strength of a call alone, a call-back to a number from your own records, a second approver for transfers above a set amount, and perhaps an agreed verification question for requests from executives. Make it explicitly acceptable for staff to hang up and call back, even when the caller sounds exactly like the CEO. Network monitoring plays no part in stopping this.

← All 29 questions on Phishing and e-mail aftermathAll topics