CEO deepfake and executive impersonation: what to do

1. What is happening to companies: three documented cases

• Arup (Hong Kong, January 2024): an employee at the Hong Kong office of the UK engineering firm received a message about a "confidential transaction" from the UK-based CFO. On the video call that followed, the CFO and several colleagues were AI-generated fakes. The employee made 15 transfers to five Hong Kong bank accounts, HK$200 million in total (about US$25 million). Arup confirmed that "fake voices and images were used".
• WPP (disclosed May 2024): scammers used CEO Mark Read's public photo on a WhatsApp account to arrange a Microsoft Teams meeting that appeared to include Read and another senior WPP executive. They used a voice clone and YouTube footage of that executive, with "Read" off camera in the chat, and asked an agency leader to set up a new business to obtain money and personal details. It failed because the people targeted were careful.
• Ferrari (July 2024): an executive received WhatsApp messages and then a call imitating CEO Benedetto Vigna's voice about a confidential acquisition. He asked the caller for the title of a book Vigna had recently recommended to him. The caller hung up.

Business leaders are also targeted through cloned public figures: in February 2025, the voice of Italy's defence minister, Guido Crosetto, was cloned to approach top Italian executives. Former Inter Milan owner Massimo Moratti sent nearly €1 million, which police later froze in a Dutch bank account.

The money involved is large. The FBI's Internet Crime Complaint Center recorded US$3.05 billion in business email compromise losses in 2025 across 24,768 complaints, and, for the first time, 22,364 complaints involving AI, with losses of more than US$893 million.

2. A transfer was requested or made: the first hours

1. If money has left, call your bank now and ask for a recall of the funds. The FBI's advice is explicit: "time is of the essence". In 2025, its Recovery Asset Team froze US$679 million out of US$1.16 billion in attempted thefts it acted on.
2. If the payment has not gone through, stop it and block the fraudulent bank details in your payment systems.
3. Alert senior management, finance and the executive who was impersonated, through a channel you trust.
4. Save everything: calling numbers, messages, emails with full headers, call recordings or notes, meeting invites, payment orders.
5. Report it:
   • US: file at ic3.gov with full transaction details, whatever the amount. The FBI says prompt complaints can help freeze funds.
   • UK: report to Report Fraud (England, Wales and Northern Ireland, 0300 123 2040), or Police Scotland on 101.
   • EU: report to the police in your country; in France, 17Cyber guides businesses to the right service.
6. Reset passwords and turn on two-factor authentication if an email account may have been compromised, and notify your insurer if you have cyber or crime cover.

3. A fake video or ad of your executive is circulating

1. Save evidence: the URL of every ad, video and page, dated screenshots, the advertiser or account name and, for Meta ads, the Ad Library entry.
2. Warn publicly from your official channels: "A manipulated video of [name] is circulating. We do not offer investments this way. Do not send money."
3. Report each item on the platform under impersonation or scam, then look up the advertiser's other ads. Step by step: our scam ad guide.
4. Use the tools built for public figures: Meta offers public figures facial recognition that detects scam ads using their face: opt-in in the UK and EU since March 2025; in many other countries Meta enrols targeted public figures itself and they can opt out.
5. If the voice is cloned (voice notes, calls, dubbed video), also follow our AI voice clone guide.
6. If the platform refuses or does not answer: in the EU, platforms must offer an internal appeal under the Digital Services Act; elsewhere, request a review and send a written notice.

4. Prevention: the controls that stop these scams

1. Call back, every time. Any urgent, confidential or unusual payment request is confirmed by calling the person on a number already on file, never the one in the message. This is the FBI's core advice on cloned voices.
2. Two-person approval. No unusual payment and no change of bank details without sign-off from a second person, following a written procedure.
3. A verification question or code word that only the real people know, like the book question at Ferrari, or a word agreed in advance.
4. No exceptions for the CEO. The rule applies even when "the CEO" says it is urgent or secret. Those are exactly the arguments scammers use.
5. Train the people most exposed: finance, treasury, executive assistants, overseas subsidiaries. Walk them through the real cases above.
6. Accept that executive videos are public. You cannot take every conference talk or interview offline, and that is the material voice clones are built from. The defence is that a voice or a face alone never authorises a payment.

UK Finance recorded 197 CEO fraud cases and £5.6 million of losses in 2025, the least common type of authorised push payment scam (under 1% of cases), against £41.3 million for invoice and mandate fraud.

5. What the law says

Impersonating an executive to obtain a payment is fraud in the US, the UK and the EU. In the US, the FTC's Government and Business Impersonation Rule, in force since April 2024, lets the agency seek penalties and refunds from those who falsely pose as a business. Platforms also ban impersonation and deceptive ads under their own rules, so takedowns do not require a court order. Whether you can recover funds from a bank or bring a claim depends on your jurisdiction and contracts: speak to a lawyer. This page is general information, not legal advice.