CEO Fraud in the Age of Deepfakes: Why Controls Matter More Than Detection

€38 million in France. $39 million in Hong Kong. Several million in Switzerland. No malware exploited, no CVE triggered, no breach notification required.

CEO fraud has evolved from spoofed emails to AI-generated video calls where every participant is fake. Cases span 2019 to 2026. Same psychological playbook, increasingly sophisticated technology.

Attack flow:

1. Pretext established via email/phone (acquisition, audit, restructuring)
2. Secrecy and urgency demanded ("do not discuss", "end of business today")
3. Executive impersonation authorizes transfer (spoofed email, deepfake voice, or video)
4. Funds move through 3-4 jurisdictions before detection

Failure points:

• No out-of-band verification of urgent requests
• Single-person wire initiation and approval
• Policies allowing exceptions for "confidential" operations
• In CEO fraud, much of the attack path sits outside traditional telemetry

MITRE ATT&CK Techniques

What a Security Professional Would Do

SOC (Security Operations Center) / Blue Team

The SOC, often called the Blue Team, is the internal security monitoring and detection function. This is the team that watches email, endpoint, network, and log data for suspicious activity.

Where the SOC / Blue Team can help:

• Detect spoofed or lookalike executive emails inside corporate mail systems
• Flag finance users receiving urgent payment requests from new external senders
• Where finance audit logs are integrated, alert on payments that bypass normal approval workflows
• Preserve email, VoIP, chat, and endpoint evidence once fraud is suspected

Hard limit: If the scam runs mainly through personal phones, WhatsApp, SMS, or external conferencing, the SOC often has little or no direct visibility. In those cases, prevention depends more on finance controls and mandatory callback procedures than on SIEM detection.

GRC (Governance, Risk, and Compliance)

GRC is the part of security that defines policies, approval rules, risk controls, and audit requirements. In this scenario, GRC matters because CEO fraud is often a control failure before it is a detection failure.

Mandatory controls:

• Dual authorization for wires above threshold (no exceptions for "urgency")
• Out-of-band verification via corporate directory number (not number provided in request)
• Vendor bank account change = mandatory callback to known contact
• Policy explicitly states: secrecy requests do not bypass normal channels

Failure point: The Sefri-Cime case had 40+ transfers over several weeks. Club Alpin Français had 60+ emails over two days. That points less to a single missed alert than to weak or missing verification and approval controls.

IR (Incident Response)

Incident Response, usually shortened to IR, is the function that handles an active security event after it is discovered. In CEO fraud, that means trying to stop further transfers, preserve evidence, and improve the chances of recovering funds.

First hour response:

1. Contact bank immediately (recall window narrows by the hour)
2. Preserve all logs: email headers, call logs, VoIP recordings, chat transcripts
3. File police report (required for insurance, supports investigation)
4. Notify correspondent banks in transit jurisdictions
5. Document timeline: request received, transfers executed, fraud discovered

Recovery odds: Recovery odds drop quickly once funds are transferred, so the first hour after discovery is critical.

AppSec (Application Security) / Engineering

AppSec, short for Application Security, plus the broader engineering team, can reduce the attack surface by hardening email, approval workflows, and internal systems so fraudulent requests are harder to act on.

Technical controls:

• DMARC enforcement (reject SPF/DKIM failures from executive domains)

• External sender banners (visual flag on non-internal emails)

• Finance workflow integration (payment systems reject transfers without ticket references)

• Call recording analysis for synthetic voice patterns (emerging capability)

Key Takeaways

• Urgency + secrecy = mandatory verification: Out-of-band confirmation using corporate directory number, not number provided in request
• Repeated transfers usually point to weak controls: Dual authorization with no urgency exceptions
• Deepfakes defeat video verification: Callback to known number required even after video confirmation
• First hour determines recovery: Bank contact, evidence preservation, jurisdiction notification
• Red flags should trigger mandatory escalation: Urgency, secrecy, or requests outside normal process should never be left to individual judgment

CEO fraud is less a malware-detection problem than a verification and control-design problem. The organizations that handle it best treat urgency as a reason to slow down, not a reason to bypass process.