A call from your CEO asks for an urgent payment. The voice sounds right. It may not be them.

How the attacks work

– Voice cloning: attackers copy a person’s voice from public recordings such as videos, interviews, or voicemail, then phone an employee

– Deepfake video calls: fake participants appear to be executives on a video meeting

– Hybrid attacks: an email request is followed by a call that “confirms” it, so the victim trusts both

Real-world evidence

– In a widely reported 2024 case, an employee at the engineering firm Arup in Hong Kong was tricked by a deepfake video call into making 15 transfers worth about HK$200 million (roughly US$25 million).

– The FBI’s 2025 Internet Crime Report, released in April 2026, was the first to count AI-related fraud separately. It logged 22,364 complaints and about $893 million in losses that referenced AI, including AI-linked business email compromise.

– Business email compromise overall was among the costliest cybercrime categories, at about $2.77 billion in reported U.S. losses in 2024.

– Experts warn that these figures undercount the problem because many victims don’t report.

Warning signs

– Unusual urgency or secrecy

– A request to bypass normal approval

– A change to payment details

– A call or video from an unexpected number or platform

– A voice that sounds slightly flat, delayed, or oddly worded

Controls that work

1. Call-back verification: confirm payment or bank changes by calling a number you already have on file, not one provided in the request

2. Dual approval for payments and changes above a set amount

3. A code word or challenge question for sensitive executive requests

4. Written procedures that no voice or video request alone can authorize a transfer

5. Limit public voice and video of executives where practical

6. Train staff, including finance and reception, with realistic examples

7. Check your insurance: some policies require documented verification procedures for social engineering coverage

Culture matters

Make it safe to say “I need to verify that.” Fraud succeeds when people feel pressure not to question authority.

Sources: FBI IC3 2025 Annual Report (April 2026) and reporting on the Arup case.

DBR Soft can help you build payment verification procedures and train your staff. Contact us for more information.