Your CFO takes a video call. On screen: you, and two colleagues she knows by name. Your voice, your pauses, the word you always use right before you ask for something urgent. You tell her the deal is sensitive, nobody else can be told, and the money has to move today.
She will move it. Not because she is careless, but because every warning sign she was trained to spot is missing. No typos. No suspicious sender address. Just your face.
This already happened. In May 2024 CNN reported that Arup, the international engineering firm, confirmed that an employee in its Hong Kong office had been defrauded of 25 million dollars, in 15 transfers to five bank accounts. He had joined a video conference in which every other participant was AI-generated. The email had made him suspicious at first. Then he saw colleagues he knew on the call, and the suspicion went away.
Why this fraud works right now
BEC, business email compromise, is not new. The FBI's Internet Crime Report for 2024 logged 21,442 BEC complaints and 2.77 billion dollars in losses. What changed is not the idea. It is the cost and the accuracy of the step that comes before the transfer: persuasion.
A study covered by Malwarebytes in January 2025 ran targeted phishing campaigns against four groups. The control group got a generic phishing email: 12% clicked. Emails written by human experts: 54%. Emails generated entirely by a language model: also 54%. A model with a human in the loop: 56%. The same effectiveness as a human expert, at one minute per target instead of 34, and up to 50 times cheaper.
That is the whole story in one line. Targeted phishing used to be expensive, so it was saved for big targets. Now it is cheap, so it reaches you too.
According to the figures the Israel National Cyber Directorate published for 2025, phishing was the most common attack vector in Israel, accounting for 52% of all reported incidents. The Bank of Israel put it in writing too. Its Banking Supervision report of May 2025 warned explicitly about financial fraud making growing use of AI and deepfake technology for voice and visual impersonation, and it recommended, among other things, a phone hotline at every bank for immediate fraud reporting.
Technology will not save you. Stop waiting for it
Most management teams reflexively reach for a product. "What do we buy against deepfakes?" I understand the question. I also think it points the wrong way.
Deepfake detection is an arms race, and the forging side is always a step ahead, because it decides when to attack and with which tool. Every detection model that works today trains the next generation of forgers. And even a perfect tool would not be installed on your CFO's phone at seven in the evening.
The answer that works is boring: a procedure. The same kind you already have for the keys to the safe and for bank signatures. What changed is that it now has to cover the voice and the face as well.
The procedure on one page
This is what I tell every CEO to write, sign, and hand to everyone who can move money. It fits on one page.
Two-channel verification, always. Every request to move funds, change a supplier's bank details, or hand over access credentials is verified on a second channel the initiator did not choose. If the request arrived on a video call, you verify it with an outbound call to the number stored in the company directory. Not the number on the screen.
A spoken pass phrase. Agreed in advance between the CEO, the CFO, and the authorized managers. Written in no email. In no shared document. If the other side does not know it, the call is over.
A dual-signature threshold. Above an amount you define, two people approve separately, and neither one can approve alone, not even the CEO.
A change to a supplier's bank details is never urgent. This is the most common vector, and because it is less dramatic than a one-off transfer, it gets watched less. Every such change is verified by an outbound call to a known contact at the supplier, and documented.
Urgency and secrecy are a warning sign, not context. In the Arup fraud the two showed up together. They almost always do.
And the most important part, the one many CEOs forget: tell your team in writing that they are allowed to stop you. An employee who refuses to move money until they have verified is not reprimanded. If your team suspects that stopping the CEO will be held against them, the whole procedure is paper.
What I learned building payment systems
Across my career I have built systems that move real money, and the same principle came back in all of them: the strongest control is not better recognition of the request, it is separating the person who asks from the person who approves. On the platform I built, a financial action never completes on the channel it started on. Full stop. It costs three minutes of friction, and it closes most of the scenarios.
This procedure needs no budget, no project, and no vendor. It needs an hour of your time and a signature. If you want to go through it together and fit it to the approval processes you already have, I am available for a call.
