Deepfakes, Voice Cloning and Digital Deception: The New Fraud Risk Finance Teams Can't Ignore

In February 2024, a finance employee at the engineering firm Arup joined what looked like a routine video call with the company's CFO and several colleagues, and authorised transfers totalling around $25 million — as widely reported at the time, including by CNN and Hong Kong police, everyone else on that call was an AI-generated deepfake, cloned from publicly available video and audio of real colleagues. No one hacked a system. They convinced a human being that a video call was real. That case reset how finance and audit teams think about fraud risk — the weak point is no longer just the network perimeter, it's whether you can trust what you're seeing and hearing.

What's Actually Changed

Executive impersonation fraud isn't new — "CEO fraud" and business email compromise scams have targeted finance teams for years, usually via a spoofed or lookalike email address. What's changed is the production quality and accessibility of the deception. Generative AI tools can now clone a voice convincingly from a short public sample — a conference talk, an earnings call, a LinkedIn video — and video deepfake tools can render a passable real-time likeness on a call. The barrier to producing a convincing fake has dropped from "requires specialist skill and time" to "achievable with commercially available tools and a modest sample of source material."

Where the Risk Shows Up in Finance Workflows

• Payment authorisation calls. A cloned "CFO" or "finance director" voice instructs a payment be expedited outside normal process, often citing confidentiality (an acquisition, a regulatory matter) to justify skipping the usual checks.
• Vendor and bank detail changes. A deepfaked voicemail or video message "confirms" a change of bank account for a supplier, timed to coincide with a real invoice due for payment.
• Video-call verification. As the Arup case showed, even a live multi-person video call is no longer reliable proof of identity on its own.
• Synthetic documents. AI-generated or manipulated invoices, bank statements and ID documents that pass a quick visual check but don't hold up to verification against source records.

A Practical Defence Framework

1. Separate the instruction from the verification channel. Any request to change payment details or expedite a transfer outside normal process should be verified through a second, independently-initiated channel — calling a known number, not one provided in the suspicious message or call itself.
2. Keep a hard rule for high-value or unusual transfers. No single call, video or message — however convincing — should be sufficient on its own to bypass a dual-authorisation control for payments above an agreed threshold.
3. Establish a verification phrase or process for genuinely urgent requests. Some finance teams now use a pre-agreed code phrase or callback protocol specifically for situations where normal process is being asked to flex under time pressure.
4. Train the team to notice pressure tactics, not just technical tells. Urgency, secrecy and appeals to authority are the actual attack vector; the deepfake is just the delivery mechanism. Staff who are trained to pause on those signals catch attempts that pure technical detection would miss.
5. Build a reporting habit, not a blame culture. Employees who suspect they've been targeted need to feel able to flag it immediately and without fear of embarrassment — the earlier a suspected attempt is reported, the more likely a payment can be recalled or stopped.

Worked Example: An Urgent Payment Request

A financial controller receives a video call that appears to be from the group CFO, requesting an urgent same-day transfer to close a confidential acquisition, with the CFO explaining that email is being avoided for confidentiality reasons and that normal sign-off would be "handled after the fact." Applying the framework above, the controller does not action the payment on the call itself. She ends the call and phones the CFO back on the number saved in the company directory — not a number given during the call — while also flagging the request to a second authoriser as required by the existing dual-control policy, regardless of how convincing the original call seemed. In this scenario the callback reveals no such request was made. The control that caught it wasn't a piece of deepfake-detection software; it was a process rule that didn't bend for urgency, secrecy or apparent seniority.

Common Pitfalls

The biggest mistake teams make is assuming this is primarily a technology problem to be solved with detection software. Detection tools have a role, but deepfake quality is improving faster than most detection tools can keep up with, and no finance team should rely on being able to spot a fake by eye or ear. The more durable defence is process: controls that don't get waived because a request looks, sounds or feels legitimate. The second common pitfall is treating this purely as an IT security issue rather than a finance-process issue — the control that stops this kind of fraud sits with payment authorisation policy, not the firewall.

Building This Into Team Practice

The strongest finance teams treat verification-channel discipline as a non-negotiable habit for any unusual or high-value instruction, reinforced periodically rather than covered once in an annual training session and forgotten.

Why This Belongs in a Structured CPD Programme

Fraud risk evolves faster than most annual training cycles can track informally, and structured, regularly refreshed CPD gives finance professionals a verifiable, up-to-date record of competence in an area where "I did a course on this once" is no longer a meaningful assurance a few years later.

How This Fits Into a Broader Compliance Programme

AI-enabled impersonation fraud sits at the intersection of financial crime prevention and operational risk management, and increasingly features in regulatory guidance on emerging fraud typologies from bodies including the UK's FCA and various national financial intelligence units. Firms that can evidence specific staff training on AI-enabled social engineering — distinct from generic cyber-awareness training — are better positioned both to prevent losses and to demonstrate a proportionate control environment if a fraud attempt does occur and is later reviewed by auditors, insurers or regulators.

FAQ

Can deepfake audio or video be reliably detected by finance staff?
Not consistently — quality varies and improves quickly, so training should focus on process discipline (independent verification, dual authorisation) rather than relying on staff to visually or audibly spot a fake.

Does cyber-insurance typically cover this kind of fraud?
Coverage varies significantly by policy and insurer, and some social-engineering fraud falls into specific policy carve-outs — firms should review their specific policy wording rather than assume coverage.

Is this only a risk for large organisations?
No — smaller firms are frequently targeted precisely because they may have less rigid payment-authorisation controls in place.

For related reading, see our guides to cybersecurity training for finance professionals and cyber threats in the finance industry. Build your team's fraud-defence skills with Learnsignal's CPD courses.