How to stop deepfake CEO fraud
By Muzamil Awan · Updated
Deepfake CEO fraud uses AI to copy a leader's voice or face and pressure staff into sending money. A good deepfake is hard to spot by ear or eye, so verify the person, not the voice: every urgent payment request should be confirmed by the real executive on a device they own.
The Arup case
In early 2024, an employee at the engineering firm Arup in Hong Kong joined a video call with what looked like the company's CFO and several colleagues. They were all deepfakes. The employee made 15 transfers worth about $25 million.
Why detection alone falls short
Deepfake detectors look for signs that a voice or video is fake. Each new AI model makes those signs harder to find. In 2025 the FBI recorded $893 million in losses in complaints that involved AI.
Rules that stop it
- No payment on the strength of a call, video or message alone
- Urgent or secret requests always get an extra check
- The executive confirms from their own registered phone
- Leadership agrees to these rules in advance, so staff feel safe saying no
Where Paysealed fits
Paysealed's Gmail and Outlook add-ons flag risky requests, like an email asking you to pay a new bank account or an urgent payment to a new payee, and Paysealed holds them until the real approver confirms on their own registered phone with Face ID or a fingerprint. An email, a call or a cloned voice can't produce that confirmation.
Questions
- Can a deepfake pass a live video call?
- Yes. The Arup case showed a full video meeting of fake colleagues can be convincing enough to move millions.
- Do code words stop voice-clone scams?
- They help, but code words can be shared, forgotten or phished. A passkey on the executive's own phone can't be read out on a call or copied by AI.
Sources
Try Paysealed free
Free pilot for founding customers.