Fraude del falso CEO con deepfake: cómo funciona, señales y qué hacer
Business fraud · alto
The scammer poses as the CEO, CFO or another executive and asks for an urgent, confidential transfer, for instance for a secret acquisition, a legal settlement or a strategic supplier. They first study the company through LinkedIn, the website and news.
Using AI tools, they clone the executive's voice from public videos and interviews and call finance, or set up a video call with fake participants. Sometimes contact starts by email or WhatsApp with the executive's photo and moves to a call "to confirm".
The request usually comes with time pressure, orders not to tell anyone and instructions to split the payment. According to Surfshark Research, global losses from deepfake fraud reached about US$ 2.5 billion in 2025.
Sinais / Signs
- An executive requests an urgent, secret transfer outside normal process
- Contact from a new or personal number, WhatsApp account or email
- Voice or video with small glitches: lag, lips out of sync, odd lighting
- Resistance to any verification ("no time, just do it")
- A new, offshore or personal destination account
Prevenção / Prevention
- Clear policy: no payment is approved by call, video or message alone
- Call back the executive's official number before acting
- Agree on code words or verification questions for sensitive requests
- Require dual in-system approval for out-of-pattern transfers
- Train teams with audio and video deepfake examples
- Limit unnecessary public exposure of executive details and org charts
O que fazer / What to do
- Contact the bank immediately to try to block or recall the transfer
- Preserve recordings, numbers, call links and messages
- Report to IC3 (US) or file a police report (Brazil)
- Alert the real executives and security team so the whole company is warned
- Review the approval process that allowed the payment
FAQ
How can I tell if a video call is a deepfake?
It is not always visible to the naked eye. The safest rule is to verify through another channel, calling a known number, before any payment.
Does asking the person to turn their head or cover their face help?
It can expose flaws in some tools, but it is no guarantee. Independent-channel verification remains essential.
Radar
- — Las pérdidas por fraude con deepfake llegan a US$ 2.500 millones en 2025 · US$ 2,5 bi. Es siete veces lo de 2024 (US$ 335 millones); en el 1S 2026 fueron US$ 764 millones. Fuente: Surfshark Research
- — Check Point: 1 de cada 27 prompts de IA generativa tiene alto riesgo de fuga de datos. En diciembre de 2025, el 91% de las organizaciones tuvo prompts de alto riesgo. Fuente: Check Point (via IT Edge News)
- Phishing and deepfakes: the 2025 numbers and how to spot them
- Ley de IA de la UE y deepfakes: obligaciones y calendario
FBI IC3 - Internet Crime Complaint Center · Surfshark Research - Deepfake fraud statistics · FBI IC3 2025 Internet Crime Report (PDF) · CERT.br