CEO Impersonation Fraud

Impersonation wire fraud aimed at company presidents and business partners is not fundamentally different now that AI voices and fake video meetings are involved. The core defense is to set three rules in advance: never verify someone by voice or face alone, never let one person complete a transfer alone, and always call back on a number that is already registered. The ways to spot fakes will keep changing, but procedures that stop a payment hold up no matter how far generative AI advances. This article covers the typical schemes, why small and mid-sized businesses are targeted, internal rules you can decide today, technical measures and their costs, and what to do first if you become a victim.

A deepfake is AI-generated video or audio that looks and sounds like the real person. Voice cloning is the technology that can produce a voice resembling a specific person from as little as tens of seconds to a few minutes of audio. Executives' voices and faces are more publicly available than most people realize: earnings briefings, social media posts, interview audio, recorded web meetings.

With older "fake email from the president" scams, odd phrasing or a suspicious sender address sometimes gave the scam away. When people hear the boss's voice on the phone, the natural reaction is to believe it, and voice cloning exploits exactly that. What has changed is that "it sounds like them" or "they appear on screen" no longer counts as proof of identity.

The skeleton of the scheme, however, is the same as wire fraud has always been: urgency, secrecy, an unusual bank account, and a request to skip the normal procedure. If you know this skeleton, the defensive approach stays clear even as technology advances.

Japan's National Police Agency also warns about business email compromise (BEC), a fraud in which criminals impersonate a business partner or the company's own executive and send fake emails to prompt payment. It advises confirming bank account changes through a channel other than email, such as a phone call, and asking the bank promptly to recall the transfer if money has already been sent (National Police Agency: Business Email Compromise (Japanese)).

Actual cases fall into the following four patterns, or combinations of them.

A finance or administrative employee receives a call in the voice of the president or another executive. The caller says, "This is a confidential deal with a partner and the money must go out today. I will explain the details later," and pushes the employee to transfer funds to a specified account. Because the voice sounds just like the real person and the caller seems to know some internal details, the employee loses the chance to doubt. The incoming number may even look like the president's mobile phone, but caller ID can be spoofed, so a displayed number is not proof either.

Overseas, there have been reports of cases where the other participants in a video meeting were fakes that closely resembled the real people. In Hong Kong in 2024, an employee at the Hong Kong office of the UK engineering firm Arup was drawn into a fake video meeting with people posing as the CFO and colleagues, and transferred about HK$200 million in several payments. This was reported based on Hong Kong police statements, and the fakes were said to have been built from footage and audio of past online meetings. Reports also say the fraud came to light when the employee checked with the company's head office (news coverage: Computing).

The lesson is that even "several people are on screen, so it must be real" is a risky judgment. It is also worth noting that what finally helped was a very basic action: confirming through a separate channel with the head office.

Recent scams do not rely on a single channel. First an email from the "president" says a call will follow, and then instructions arrive by phone or a calling app. Someone who was not suspicious at the email stage is reassured by the voice. The reverse also happens: instructions by phone, followed by an email or invoice for the paperwork. Even if several channels line up, if they all come from the same criminal, nothing has actually been verified.

Many schemes do not use the president's name at all. The criminal poses as a contact at a business partner and asks by email or phone: "We have changed our bank account, please pay the new account from next time." If the partner's email account has been taken over, the request can arrive in the middle of a genuine email thread, which makes it even harder to detect. The damage also runs the other way: business partners can receive fake emails pretending to be from your company. Anti-spoofing settings for your own domain help reduce that, and the steps are covered in An Introduction to SPF, DKIM, and DMARC for Email Spoofing Protection.

- The decision-maker and accounting are close, and one person can send money: where one instruction from the president moves an accountant, the transfer is finished before any check takes effect
- Internal relationships can be guessed from public information: the president's name, staff names, and business partners can be found on websites, job postings, and social media
- Payment rules are not written down: people act on "this is how we always do it," so there is no basis for refusing an exception
- No dedicated IT or security staff: there is nobody to consult about a suspicious contact
- Relationships make refusal hard: it is psychologically difficult for a subordinate to doubt and double-check a direct instruction from the president

Even without the multiple approval layers and specialist departments of a large company, if the company clearly states that doubting and verifying is the right behavior, this weakness shrinks considerably. The next section gives concrete measures.

Internal rules cost almost nothing and have a large effect. Put them in writing and keep them where everyone can see them. It is important to state that the president is subject to the rules too. For how to build company-wide policies, see also How to Create an Information Security Policy for Small and Mid-sized Businesses.

Make it so that one person requests and a different person approves, and no transfer executes without both. The approval feature in online banking (settings that separate the creator from the approver) can enforce this in the system. Transfers instructed by the president must also be checked by another person. In a company with only two employees, simply deciding that the president and the accountant must both agree, and that the president's instruction alone does not move money, is already effective.

When you receive a request for a transfer or an account change by phone or email, do not use the number or email address written in the request. Call back on a number registered in your own records or past documents. If the other party insists, "Please call this number instead," be suspicious of that very number. If the instruction came in a video meeting, end the meeting and call back on a registered number.

Decide on a passphrase shared only among the people involved in transfers, such as the executive and the accounting staff. Do not write it in email or chat; share it in person. When a request comes by phone, ask the caller to say the passphrase. Even if AI imitates a voice, it does not know a passphrase that was never shared. Change it periodically and whenever someone leaves. A question-style check (for example, "Where did we go on last year's company trip?") also works, but avoid information that is public on social media or elsewhere.

When a business partner asks to change bank details, do not change them based on an email or phone request alone. Receive a written change notice (with a seal or signature), and also confirm with the contact person using a registered phone number from past transactions. Practices such as starting with a small first payment after the change, or holding payments for a set period after a change, are also effective.

Set conditions such as "payments above a certain amount must always be checked by two or more people" and "for a first payment to a new account, always verify the account holder's name." Choose amounts that fit the size of your company, for example based on your average monthly payments, with a threshold set higher than normal. The exact figures are for each company to decide. What matters is that a payment that meets the condition always stops, with no exceptions.

Fraudulent instructions tend to combine three features: (1) pressure to act quickly, (2) a demand not to tell anyone else, and (3) a request for an unusual procedure or account. If even one of the three applies, always consult another person and verify. If the president tells employees directly, "Even if it is me and even if it is urgent, do not skip verification," the psychological burden on the person doing the checking goes down.

Technical measures reinforce the rules. Costs vary greatly with company size and the services in use, so treat the following strictly as rough estimates.

The top priority is turning dual approval and call-back into rules, which costs almost nothing. Services that technically detect deepfake video and audio exist, but their accuracy changes constantly and they are a heavy burden for a small or mid-sized company to adopt and run alone. It is more realistic to build procedures that stop payments even when the fake cannot be detected than to rely on detecting fakes.

Email spoofing remains an entry point alongside voice and video. Setting up SPF, DKIM, and DMARC for your own domain lowers the risk that customers and business partners receive fake emails in your name. However, your settings cannot stop email from domains managed by others or from look-alike domains. Do not rely on your own settings alone; also build the habit of checking the sender of every email you receive.

Taking over an email account is one cause of business-partner impersonation with bank detail changes. Enabling multi-factor authentication (a mechanism that requires something such as a confirmation code in addition to the password) on email and cloud services is a low-cost, high-impact measure. Adding a warning label to email from outside the company makes it easier to notice a fake that looks internal but is actually external.

If you have sent money, or may have, it is a race against time. Once the money is moved to another account, recovery becomes difficult. Act in this order as soon as you suspect a problem.

- 1. Contact your bank and request a recall: Call the bank you sent the money from as soon as possible. Give the date and time, amount, and destination account, and ask about a recall and procedures that could lead to freezing the recipient account. Check whether the bank has an emergency line outside business hours
- 2. Consult or report to the police: Contact the nearest police station or the prefectural police cybercrime consultation desk, and ask about filing a damage report
- 3. Preserve evidence: Keep, without deleting, the emails received (saved so that header information is included), call history, recordings, video meeting records, transfer receipts, and chat messages. Do not wipe or reset computers; record the situation first and then decide
- 4. Notify business partners: If your company was impersonated, or if a partner's email account may be compromised, tell the other party. Further damage may be occurring on their side
- 5. Write up the internal timeline: While memories are fresh, record when, who, through which channel, and what was done
- 6. Secure your accounts: If takeover is possible, change email and other passwords and set up multi-factor authentication. If personal or confidential information may have leaked, see also Responding to a Data Breach

It is also important not to blame the employee who fell victim. Blame delays reporting and lowers the chance of recovery. Creating a culture in which people who report immediately are valued ends up keeping the loss smaller.

Position training not as a way to spot deepfakes but as a way to make verification a habit. Detection tips go out of date along with the technology, but procedures remain.

- Do not decide someone's identity by voice or face alone, and know that AI can imitate both
- When asked to transfer money or change an account, call back on a registered number
- If something feels urgent, secret, or unusual, do not act on the spot; consult another person
- An instruction from the president is not a reason to skip the verification steps
- Report immediately when something seems off; nobody is blamed for a false alarm

Short, repeated sessions tend to stick better than a single annual lecture. For example, once a quarter, run a 15-minute role-play of "a call from someone claiming to be the president." For costs and how to choose, see The Cost of Security Awareness Training and Phishing Drills.

- Are transfers set up so that the requester and the approver are different people (dual approval)?
- Is there a rule that transfers instructed by the president are also checked by someone else?
- Is there a procedure to call back on a registered number when asked for a transfer or account change by phone or email?
- Have the people involved in transfers agreed on a passphrase?
- Do bank detail changes from business partners require paperwork and a second channel?
- Are there extra-check rules for payments above a certain amount and for first payments to a new account?
- Does everyone know that "urgent," "secret," and "unusual" are warning signs?
- Is multi-factor authentication enabled on email and cloud services?
- Have you checked SPF, DKIM, and DMARC for your own domain?
- Have you shared a list of the bank contacts and police consultation desks to call in an emergency?
- Do you practice the verification steps regularly, for example through role-play?

Deepfakes and voice cloning have strengthened the power of wire fraud to make people believe it. The essence of the defense, however, is not spotting the AI but building a system in which no transfer is completed on one person's judgment alone. This week, decide and document the four rules: dual approval, call-back on a registered number, a passphrase, and written confirmation of bank detail changes. Next, set up multi-factor authentication for email and measures for your own domain, in an order that is manageable. Finally, prepare a list of contacts for use when you notice damage. Completing these three stages alone moves most small and mid-sized businesses a long way forward.