Executive Deepfake Fraud Controls Must Survive a Convincing Voice

A senior executive appears on a video call and asks finance to make an urgent payment. The voice is familiar. The request refers to a real project. The caller says the transaction is confidential and the normal approver is unavailable.

The control should not depend on an employee detecting whether the face or voice is fake. It should require the payment to pass an established verification and approval process even when the request is convincing.

Executive deepfake fraud controls are ordinary payment and identity controls designed to hold under impersonation pressure. A real executive should expect the same checks. Familiarity can explain a request; it cannot authorize a transfer by itself.

TLDR

• A familiar voice, face, email thread or caller ID is not enough to approve a payment.

• Verify material requests through a separate, previously established route, not contact details supplied in the request.

• Separate verification of identity, business purpose, beneficiary details and approval authority.

• Dual approval helps only when reviewers independently perform the required checks.

• Give staff a safe way to pause an urgent request, including one that seems to come from the top.

Verify the transaction, not the performance

Deepfake audio or video can make an impersonation more persuasive. It does not change the basic question: is this transaction legitimate, and has the right person approved it through the authorized process?

The FBI's business email compromise guidance recommends out-of-band verification and establishing that route early in the relationship. The same principle is useful when the message arrives by voice or video. A second conversation inside the suspicious channel is not independent verification.

Do not turn this into a visual-detection contest. Unusual lighting or a delayed response may prompt caution, but a convincing call can still be fraudulent. A genuine call can also be affected by technical problems. The payment process needs to work without a reliable guess about the media.

Keep the contact route outside the request

Use a trusted directory or an established supplier record to initiate the check. If the requester supplies a new number, asks you to stay on the call or sends a link to a verification room, those details should not replace the approved route.

Maintain the directory through a controlled process. A callback offers little protection if an attacker has already persuaded someone to alter the stored number. Changes to beneficiary or contact details need their own verification and records.

The independent check should cover the substance: amount, recipient, purpose and relevant bank details. Confirming only that an executive recognizes a project can leave the fraudulent destination unchallenged.

A fictional urgent-payment tabletop

This fictional scenario uses an invented company and no real payment details. It is a rehearsal, not instructions to attempt a transaction.

Pressure in the scenario	Required control behavior	Evidence from the exercise
Apparent chief executive requests secrecy	Employee uses the approved escalation route despite the claimed confidentiality.	Reviewer can show who was contacted and why.
Caller supplies a new callback number	Employee initiates verification from the controlled directory instead.	Exercise record identifies the independent source.
Request changes the beneficiary	Finance follows the established change-verification process.	Verified details are compared with the payment instruction.
Second approver sees a senior name	Approver performs independent checks rather than endorsing the first person's confidence.	Both reviews record their basis.
Normal approver is unavailable	Payment pauses or uses a pre-authorized exception route with stated limits.	No authority is invented during the call.

Ask participants to explain what would happen outside office hours. A policy that relies on one unreachable person can create the pressure to bypass it.

Make dual approval more than two clicks

Two people can be fooled by the same story. Define what each reviewer must establish and ensure that the second reviewer can challenge the first without simply repeating the same compromised conversation.

Use the organization's actual payment limits and delegated authorities. A request's urgency should not raise those limits. Where an emergency route exists, specify who can use it, which evidence remains mandatory and how the event is reviewed afterward.

Do not assume that a code word or personal trivia solves identity. Such information can be exposed, guessed or socially engineered. It may be a supplemental signal, but the payment should still follow the approved transaction controls.

Give a pause the same status as a successful payment

Staff need to hear that a legitimate executive will accept verification. A process that exists on paper but is punished in practice will fail when the requester sounds important enough.

Test the control in a safe, authorized exercise. Measure whether staff use the independent route, identify changed details and stop when verification fails. Avoid a blame exercise built around who spotted the fake first.

If a suspected fraud has already produced a payment, follow the incident process promptly, including contacting the financial institution through an established route and preserving relevant evidence. Specific recovery and reporting steps depend on the facts and jurisdiction. Do not wait for certainty about the deepfake before escalating a potentially fraudulent transfer.

Sources

FBI, Protected Voices: Business Email Compromise (2019), out-of-band verification and established communication routes. DHS Homeland Security Investigations, Cornerstone, April 2025, Issue 63, deepfake-enabled impersonation and alternative-channel verification. The tabletop and control workflow are practical recommendations, not a guarantee against fraud. For related oversight of evidence and follow-up, see audit committee cybersecurity questions.

Frequently asked questions

Can a video call authenticate an executive payment request?

It can be part of a conversation, but it should not replace the organization's payment verification and approval process. Treat the identity, transaction details and delegated authority as separate checks.

Is calling the number in the message enough?

No. Use a previously established, independently sourced route. A number supplied by the suspected requester may simply lead back to the impersonator.

Does dual approval prevent deepfake fraud?

It can reduce risk when both reviewers follow meaningful checks. It is not a guarantee. Two approvals based on the same unsupported story or compromised channel do not provide independent verification.

What should executives do differently?

Support verification even when the request is genuine and urgent. Keep delegated authority and emergency routes clear. Reward staff for pausing an unverified request rather than pressuring them to bypass the process.

Closing

The useful test is not whether finance can recognize a synthetic voice. It is whether a convincing executive request can bypass verification, beneficiary checks or approval limits. Rehearse that question before the real call arrives.