Deepak Gupta

Business payment fraud (BEC) · Also called CEO voice clone scam, AI voice BEC, fake executive WhatsApp, voice deepfake fraud

Deepfake CEO voice and messaging fraud

Deepfake CEO voice fraud uses an AI copy of an executive's voice, in a phone call, voice message, or messaging app, to tell an employee to make an urgent payment, buy gift cards, or share access. Because the voice sounds real, the request can slip past the usual checks unless a callback rule is in place.

How it works

Criminals clone an executive's voice from public recordings such as interviews, talks, or videos.
They call, leave a voice message, or text from a new number or messaging account, claiming to be the executive.
They ask for an urgent payment, gift cards, or access such as a password reset, often stressing secrecy.
The employee acts on the familiar voice, and the money or access goes to the criminals.

Red flags

An executive contacts you from an unknown number or a new messaging account.
The request is urgent and secret, and involves money, gift cards, or passwords.
The tone, pacing, or word choice does not quite match how the person normally speaks.
You are asked to move the conversation to a different messaging app.

If you are targeted

Stop: hang up or stop replying, and do not send money, cards, or access.
Call the executive back on a number from your company directory to check the request.
Call your bank at once and ask it to recall the payment; the FBI also suggests asking for a Hold Harmless Letter or Letter of Indemnity.
Report it. Our Report a scam page lists where to report in your country, such as ic3.gov and ReportFraud.ftc.gov in the US.

Where to report, by country

Prevention

For individuals

Verify any urgent request by hanging up and calling the person on a number you already know.
Agree a verification phrase with your team that a caller must give before any urgent request is acted on.
Never share passwords or one-time codes on a call, however senior the caller sounds.

For organisations

Make callback to a directory number mandatory for any payment or access request received by phone or message, with no exception for urgency.
Do not use voice recognition alone to approve payments or password resets.
Require two independent approvals for large payments and new payees.

Step-by-step controls: the implementation guide

By the numbers

Figures are for the reporting category this scam falls under, not this scam alone.

Business email compromise losses reported to the FBI IC3 in 2025	$3.05B	US, 2025, FBI IC3
Losses in FBI IC3 complaints mentioning AI in 2025 (overlaps other categories, never summed)	$893.3M	US, 2025, FBI IC3

Real cases

2024-07 · IT · Attempted
Ferrari executive stops a deepfake CEO voice call, 2024Unconfirmed by a primary source
2024-05 · GB · Attempted
WPP CEO impersonated with a voice clone on Teams, 2024Unconfirmed by a primary source

Delivered through: Voice phishing (vishing)

How official datasets classify it

FBI IC3: Business Email Compromise
UK Finance: CEO fraud
Scamwatch: Business email compromise scams
MITRE ATT&CK: T1684.001, T1657, T1566.004

Questions

Can scammers clone my CEO's voice?: Yes. The FBI says criminals use AI-generated audio to impersonate public figures and people victims know, and that voice cloning can be used to request wire payments in business email compromise.
How can I check a call from an executive is real?: Hang up and call them back on a number from your company directory, not the number that called you. A pre-agreed verification phrase adds another check.