CEO fraud consists of impersonating a senior executive, or a supplier, in order to obtain a transfer or sensitive information. There is nothing new about it. What has changed is that, with artificial intelligence, imitating a voice or a face has become accessible and convincing.
A multinational company was thus caught out in 2024 during a video conference in which every participant except the victim was an AI-generated fake, a case that was very widely reported. SMEs are targets too, because they have fewer control procedures and make decisions faster.
Good news: no technology is needed to defend yourself. Simple rules, known and applied, are enough. Here is the protocol we teach in our training.
verification rules to put in place
channels minimum to validate an unusual payment
The most common scenarios
- The fake executive — A message or call, with an imitated voice, asks accounting for an urgent and confidential transfer.
- The fake supplier — An email, sometimes followed by a call, announces a change of bank details for the next invoice.
- The fake video conference — Participants whose faces and voices are AI-generated request a transaction.
- The fake technician or fake bank — Someone introduces themselves to "secure" an account and asks for a code received by SMS.
- The fake candidate — A video interview with a faked identity or face, to gain access to information or a sensitive position.
- AI-written phishing — Emails without a single mistake, perfectly tailored to your sector and context.
The six rules of the protocol
1. Double validation through a second channel
Any unusual transfer, any change of bank details, any request for sensitive information must be confirmed by a different means from the one used for the request. Email received: confirm by phone. Call received: confirm through another route.
2. Call back on a known number
Always call the person back on the number already recorded in your files, never the one given in the message.
3. An agreed word for emergencies
A word or question known only to the people concerned, shared in person, to validate an urgent request outside the usual procedure.
4. A threshold and a payment workflow
Above a set amount, a second signatory is mandatory, whoever the requester is. No exceptions for "the boss is travelling".
5. Urgency and secrecy are warning signs
The more you are pressured, the more you need to verify. A request that forbids you from talking to a colleague is suspicious by nature.
6. The right to verify, without consequences
Every employee must know they will never be blamed for having checked, even if the request comes from the CEO. Without this, the procedure collapses under pressure.
Post these six rules in accounting and in customer service, and have every new person who joins read them.
After an attempt, or a successful fraud
- Contact your bank immediately — If a transfer has just been made, the bank is the one that can attempt to recall the funds. The faster you act, the more effective it is.
- Keep the evidence — Messages, addresses, numbers, recordings, screenshots. Do not delete anything.
- File a complaint — With the police. The complaint is often needed for bank and insurance procedures.
- Report it — In Belgium, the Centre for Cybersecurity (Safeonweb campaign) lets you forward suspicious messages to a dedicated address.
- Notify your insurer — Some policies cover cybercrime, subject to conditions and reporting deadlines.
- Inform the team — Without looking for someone to blame: the aim is to improve the protocol.
Train your teams, don't just inform them
A protocol that nobody has practised does not hold up under stress. The companies that resist best run short simulations: a fake call, a fake email from an executive, followed by a debrief. These exercises reveal weak points and build the right reflexes.
It is one of the workshops of our "recognising AI" training, delivered at your premises or remotely. For other uses of AI in business, see our template for an AI usage policy.
This content is general prevention information. For a specific situation, contact your bank, the police and, if necessary, a cybersecurity specialist.
Your questions about deepfakes and fraud
What is CEO fraud?
It is a scam in which someone impersonates a senior executive or a supplier to obtain a transfer or sensitive information, playing on urgency and confidentiality. AI can now imitate a voice and a face.
Can you spot a deepfake with the naked eye?
Less and less. Visible flaws disappear as the technology progresses. Protection therefore relies on verification procedures, not on the ability to spot a flaw.
How do you verify a supplier's change of IBAN?
By calling your usual contact back on the number already on file, never the one in the email, and by requiring written confirmation approved by two people.
Can an SME really be targeted?
Yes. SMEs are frequent targets because they have fewer internal controls. The scams are also largely automated and target a large number of companies at once.
Train your teams before the suspicious call.
We run awareness workshops and simulations tailored to your company.