CEO fraud / executive impersonation with deepfake：手法、警示信号与应对
Business fraud · alto
The scammer poses as the CEO, CFO or another executive and asks for an urgent, confidential transfer, for instance for a secret acquisition, a legal settlement or a strategic supplier. They first study the company through LinkedIn, the website and news.
Using AI tools, they clone the executive's voice from public videos and interviews and call finance, or set up a video call with fake participants. Sometimes contact starts by email or WhatsApp with the executive's photo and moves to a call "to confirm".
The request usually comes with time pressure, orders not to tell anyone and instructions to split the payment. According to Surfshark Research, global losses from deepfake fraud reached about US$ 2.5 billion in 2025.
Sinais / Signs
- An executive requests an urgent, secret transfer outside normal process
- Contact from a new or personal number, WhatsApp account or email
- Voice or video with small glitches: lag, lips out of sync, odd lighting
- Resistance to any verification ("no time, just do it")
- A new, offshore or personal destination account
Prevenção / Prevention
- Clear policy: no payment is approved by call, video or message alone
- Call back the executive's official number before acting
- Agree on code words or verification questions for sensitive requests
- Require dual in-system approval for out-of-pattern transfers
- Train teams with audio and video deepfake examples
- Limit unnecessary public exposure of executive details and org charts
O que fazer / What to do
- Contact the bank immediately to try to block or recall the transfer
- Preserve recordings, numbers, call links and messages
- Report to IC3 (US) or file a police report (Brazil)
- Alert the real executives and security team so the whole company is warned
- Review the approval process that allowed the payment
FAQ
How can I tell if a video call is a deepfake?
It is not always visible to the naked eye. The safest rule is to verify through another channel, calling a known number, before any payment.
Does asking the person to turn their head or cover their face help?
It can expose flaws in some tools, but it is no guarantee. Independent-channel verification remains essential.
Radar
- — Deepfake fraud losses reach US$2.5bn in 2025 · US$ 2,5 bi. That is seven times 2024's US$335m; H1 2026 added US$764m, for a cumulative ~US$3.7bn. 来源: Surfshark Research
- — Check Point: 1 in 27 GenAI prompts carries high data-leak risk. In December 2025, 91% of organizations had high-risk prompts. 来源: Check Point (via IT Edge News)
- Fake charity deepfakes in Brazil: inside Operation Cáritas
- Phishing and deepfakes: the 2025 numbers and how to spot them
- EU AI Act and deepfakes: duties and timeline for security teams
FBI IC3 - Internet Crime Complaint Center · Surfshark Research - Deepfake fraud statistics · FBI IC3 2025 Internet Crime Report (PDF) · CERT.br