Deepfake CEO Fraud: Why That Urgent Voice Call May Not Be Your Boss

The scam used to arrive as a typo-filled email from the boss asking for an urgent wire. Now it arrives as a phone call in the boss voice, and it is far harder to catch. Attackers use AI to clone a voice from as little as three seconds of audio pulled from a webinar, a voicemail, or a social post. Deepfake attacks have surged dramatically, and AI-generated impersonation now drives a large and growing share of business email compromise.

How the attack unfolds

An attacker scrapes a few seconds of an executive voice, generates a convincing clone, then calls or leaves a voicemail for someone in finance: a vendor changed banks, a deal is closing, a wire must go out before end of day. The pressure and the familiar voice do the work. Because there is no malware and no obvious phishing link, traditional filters never see it. The average AI-augmented BEC loss now runs well into six and seven figures per incident.

Why small and mid-sized firms are targets

Attackers hit the businesses least likely to have a verification process: professional services firms, CPA and wealth offices, law firms, and logistics companies that move payments daily. In South Florida, where wire transfers to partners across the Americas are routine, a single convincing call can move a large sum before anyone thinks to check.

The defense is a process, not a product

Technology helps, but the fix is a rule everyone follows: any payment or bank-detail change is verified through a second, pre-agreed channel before money moves. Call the known number on file, never the one in the request. Add a confirmation step for wires above a set amount, train your team on synthetic-voice scams, and lock down email with authentication so spoofed messages do not slip through.

Deepfake fraud works because it exploits trust and urgency, not a software hole. A simple, enforced verification habit takes both away.