When the Person on Your Screen Isn't Real: A Board's Guide to Deepfake Fraud
Executive Summary
A finance manager at a global engineering firm joins what looks like an ordinary video call. The CFO's on it. So are a few familiar colleagues. Nothing feels off. By the end of the call, roughly $25 million has moved out the door, and every single person on that screen was fake. Not spoofed emails, not typos in a domain name, an actual AI-generated video call. That's the world boards are now operating in, and honestly, most governance frameworks haven't caught up. This piece looks at what deepfake fraud actually does inside a company, walks through a real case that worked and one that didn't, and lays out a framework boards can start using this quarter, not after their own $25 million moment.
Quick Answer:
What Should a Board Do About Deepfake Fraud?
Stop treating a familiar voice or face as proof of identity. That's really the whole shift. Every high-value or high-authority instruction, no matter who appears to be giving it, should be verified through a completely separate channel, a callback to a stored number, a pre-agreed code phrase, something an attacker can't fake by copying a person's likeness. Training and detection tools matter, but they're second in line. The channel is what actually stops the money from moving.
What Is Deepfake Fraud, and Why Is It Hitting Boardrooms Now?
Deepfake fraud is when someone uses AI to convincingly recreate a real person's voice, face, or full video presence, usually a senior executive, to talk an employee into doing something they'd never do for a stranger: wire money, change bank details, hand over confidential data. It sounds like science fiction until you realize how little raw material it takes. Three to ten seconds of someone's voice, lifted from an earnings call or a YouTube clip, is enough to build a clone that holds up on a phone line.
Finance and treasury teams tend to be the target, not because they're careless, but because their whole job is to move quickly when a senior person flags something urgent. And urgency is exactly the lever fraudsters pull. A confidential acquisition. A time-sensitive vendor payment. A last-minute bank detail change before a deal closes. None of it looks unusual on the surface, which is precisely why it works.
Here's the part that should worry a board more than the technology itself: the economics have flipped in the attacker's favour. A convincing deepfake attempt might cost a few thousand dollars to pull off. If it lands, the payout can be in the millions. Even a low success rate makes that trade worth running again and again. Meanwhile, the old safety net, two people cross-checking a request, quietly stops working once both of them are looking at the same fake video. Studies on human accuracy at spotting deepfakes in real time put people at close to a coin flip. That's not a comforting number for anyone relying on gut instinct as a control.
Real-World Example: One Attack That Worked, One That Didn't
Arup: $25.6 million, gone in an afternoon
In January 2024, a finance employee at Arup, the UK engineering firm behind projects like the Sydney Opera House, got an email that looked like it came from the company's CFO, flagging a confidential deal. He was wary at first. Then he joined a video call where the CFO and several colleagues he recognised appeared to confirm everything. All of them were AI-generated. Over the course of that interaction, he authorised 15 separate transfers totalling around 25.6million,roughlyHK200 million, to five different Hong Kong bank accounts. Nobody caught it in the moment. The fraud only surfaced when he later followed up directly with Arup's head office and was told, flatly, that no such transaction had ever been approved.
WPP: the one that didn't work
A few months later, in May 2024, someone tried a similar trick on advertising giant WPP. Using publicly available photos of CEO Mark Read, fraudsters built a fake WhatsApp profile and invited another executive to a call, deepfaked video and audio included, asking for funds toward a supposed new venture. This time it didn't land. Something about the request felt wrong to the executive on the other end, and he simply didn't comply. No money moved. What's striking is that the technical quality of both attempts was probably similar. The difference came down to one person's instinct to pause, which is exactly the habit a good verification process is meant to build into everyone, not leave to chance or gut feeling.
The Boardroom View
It's tempting to hand this whole issue to IT and move on. That would be a mistake, and increasingly, regulators are making sure boards know it. In the UK, the Economic Crime and Corporate Transparency Act introduced a new "failure to prevent fraud" offence for large organisations, effective from September 2025. Unlimited fines are on the table for companies that can't demonstrate they took reasonable steps to prevent fraud, and deepfake-enabled schemes fall squarely under that umbrella. Boards are now expected to formally stand behind the effectiveness of their fraud controls, not just assume someone downstream has it handled.
Personal liability is shifting too. Research into cyber resilience has repeatedly found that board members at well-prepared organisations are actually more likely to be held personally accountable when something slips through, precisely because expectations are higher once you've shown you understood the risk. "We didn't think this could happen to us" is a weaker defence every year that passes. And frankly, the companies handling this best aren't necessarily running the fanciest detection software. They're the ones where someone on the board keeps asking, quarter after quarter, whether the verification habits are actually being followed, not just written down somewhere.
A Practical Verification Framework
Detection tools have their place, but they shouldn't be the main line of defence. Deepfake quality is improving faster than most detection software can keep pace with, and that gap isn't closing anytime soon. What actually holds up are controls that don't depend on recognising a face or a voice at all.
Verified callback discipline. Any transfer above an agreed threshold, regardless of who appears to be requesting it, gets a callback to a number already stored in the finance system, never the number the request arrived from. This single habit would have stopped the Arup transfer cold.
A rotating code phrase. Senior executives agree on a phrase that changes periodically and is only ever exchanged out loud, never over email, text, or chat. No phrase, no action, no matter how convincing the call looks.
A separate channel for board-level directives. Any instruction touching financial commitment or governance decisions gets confirmed through a second channel, typically run through the corporate secretary, before anyone treats it as real.
Two-person approval that assumes deepfakes exist. This only works if the two approvers are verifying independently, through different channels. Two people watching the same fake call together isn't a safeguard, it's the same blind spot twice.
Regular reporting to the risk committee. Impersonation attempts, whether they succeed or not, should get logged and reviewed the same way phishing attempts already are. That way the board sees a pattern building, not just the one incident that made headlines.
None of this needs a big budget or a specialist AI security hire. It needs the board to accept something a bit uncomfortable: a familiar face on a screen doesn't prove anything anymore.
Frequently Asked Questions
Can board members actually be held personally liable for a deepfake fraud loss?
Increasingly, yes, especially in jurisdictions tightening fraud-prevention duties, the UK being a clear example. It usually comes down to whether the board can point to documented, reasonable controls, not whether the fraud itself could have been stopped in every possible scenario.
How do you spot a deepfake on a live call?
Honestly, it's hard. Real-time detection studies put human accuracy close to chance. Small tells exist, a slightly delayed reaction, odd blinking, audio that doesn't quite sync with the mouth, but nobody should be betting company funds on catching those in the moment.
Isn't detection software enough by itself?
No, and it's worth being blunt about that. Detection tools are one layer, useful but not sufficient, because the generation side of this technology is improving fast. Out-of-band verification is the control that still works even when detection fails.
What's the first policy a board should actually put in place?
A mandatory callback verification rule for any transfer above a set amount. It costs almost nothing to implement and closes the exact gap that let the Arup fraud happen.
Is this really just a large-company problem?
Not at all. Smaller and mid-sized firms are often easier targets, mainly because they lean more on informal, trust-based approval processes instead of layered checks.
Key Insights
A familiar voice or face used to be enough proof of identity. It isn't anymore, and most existing controls were built on that old assumption.
The economics favour attackers by a wide margin, cheap to attempt, potentially enormous payout, which means this threat isn't going away on its own.
Regulators are moving from "prevent what you can" to "prove you took reasonable steps," and that shift puts this squarely on the board's plate.
The controls that actually work are low-tech and procedural, callbacks, code phrases, independent verification, not expensive detection software alone.
Key Takeaways
Deepfake fraud is a governance issue first, a technical one second.
Arup and WPP show the same threat playing out two ways, and the difference came down to one habit of pausing to verify.
A workable framework doesn't need a big budget: callback checks, code phrases, a separate board channel, and regular risk reporting cover most of the gap.
Boards that keep this on the standing agenda, not as a one-time briefing, are the ones best positioned when regulators or courts come asking.
Strengthen Your Board’s Readiness for Emerging Risks
Deepfake fraud is changing the way organisations approach cybersecurity, risk management, and corporate governance. Equip yourself with the knowledge to navigate emerging boardroom challenges and strengthen your governance capabilities.
Comments