The CEO on the phone is not the CEO

For years, executive fraud arrived by email: a short, urgent message from the "CEO" asking finance to pay a supplier today. Staff learned to be suspicious of email and to pick up the phone to check.

Attackers noticed. A few seconds of someone's voice from a conference talk, a podcast or a company video is now enough to build a convincing clone. The call that used to be the safety check has become the attack.

Why this works so well

Voice fraud does not rely on technology alone. It relies on the same pressure points as every good social engineering attack:

• Authority. The request appears to come from someone senior enough that questioning it feels risky.
• Urgency. A deal is about to close, a regulator is waiting, a supplier will walk away.
• Secrecy. "Keep this between us until the announcement." It conveniently stops the victim from checking with colleagues.

A cloned voice simply removes the last doubt. Good fakes are hard to spot by ear, and the people we most often see targeted, in finance and executive assistant roles, are under real time pressure every day.

Change the process, not the people

The goal is a payment process where it does not matter how convincing the caller is.

1. Call back on a known number. Any payment or bank detail change requested by phone, chat or email is confirmed by calling the person back on a number taken from the company directory, never one supplied in the request.
2. Two people for unusual payments. New beneficiaries, changed bank details and anything above an agreed threshold need a second approver who was not part of the original conversation.
3. No exceptions for seniority. Executives agree in advance, in writing, that they will never ask anyone to skip these steps. Then, when someone does ask, the request itself is the red flag.

Agree a verification phrase for the riskiest roles

For the small group who can move large sums, a pre-agreed challenge question or code word works surprisingly well. It should be something never written in email or chat, and changed if anyone thinks it may have leaked. It is low-tech and that is the point: a clone of a voice does not clone a shared secret.

Reduce the raw material

You cannot remove your executives from the internet, but you can be deliberate. Know which leaders have hours of clear audio online, brief them that they are likely targets, and make sure their assistants know the verification steps best of all.

What to do if a payment has already gone

Speed matters more than anything. Call your bank immediately and ask for a recall, report it to the police and your cyber insurer, and preserve the call logs, numbers and any messages. Banks can sometimes freeze funds if they act within hours. After a few days, the money is usually gone.

Deepfakes feel like a new kind of threat, but the defence is old-fashioned: a process that checks requests through a second, independent channel, and a culture where checking is expected rather than awkward.