Deepfake CEO fraud: real cases and a training playbook

Deepfake CEO fraud is ordinary authority-and-urgency fraud with a more convincing face and voice. The cases below are taken from original reporting and an FBI public service announcement. The training playbook after them uses deepfake video in email, which SecurityRing runs today with the leader's consent. See deepfake training for the product page.

Case 1: Arup, Hong Kong (reported May 2024)

The Guardian reported on 17 May 2024 that British engineering firm Arup confirmed it was the company behind a deepfake scam in Hong Kong. An employee was persuaded to pay HK$200m (about £20m) in 15 transactions to five bank accounts after a video call in which the other participants, including someone posing as a senior officer, were deepfakes. Arup said it had notified the police, that fake voices and images were used, and that its "financial stability and business operations were not affected". Hong Kong police classified the case as "obtaining property by deception".

Lesson for training: a video call with familiar faces is not proof of identity. Large or unusual transfers need a check outside the channel the request arrived on.

Case 2: WPP (reported May 2024, unsuccessful)

The Guardian reported on 10 May 2024 that fraudsters targeted WPP using the identity of its chief executive, Mark Read. They set up a WhatsApp account with his photo, arranged a Microsoft Teams meeting, and used a voice clone and YouTube footage of another executive to ask an agency leader to set up a new business. The attempt failed. In an email to staff, Read listed red flags including requests for passports, money transfers and any mention of a "secret acquisition", and wrote: "Just because the account has my photo doesn't mean it's me."

Lesson for training: secrecy plus a new channel plus money is the pattern. A profile photo proves nothing.

The FBI's warning

On 3 December 2024 the FBI's Internet Crime Complaint Center warned that criminals use AI-generated audio to impersonate relatives and public figures, and AI-generated video for "real time video chats with alleged company executives". Its tips include agreeing a secret word or phrase to verify identity, and hanging up and calling back on a number you know to be genuine.

Why practise with video in email

Both cases started with a message, followed by a call that looked and sounded real. A simulation can safely recreate the first step: an email from a leader with a short video asking for something urgent. Employees learn to stop and verify before any call or transfer happens.

A consent-based training playbook

1. Get consent first. In SecurityRing, deepfake video is enabled per workspace. The admin sends the leader a private identity consent link. The leader provides their own media: a photo and a voice sample, or a 2–5 minute speaking video. The admin then reviews a watermarked review video. Nothing uses a likeness without that consent.
2. Write the scenario like the real cases. Draft it in the AI Builder's Deepfake tab: urgency, secrecy, an unusual payment or data request. The red flags you mark become the lesson's teaching points.
3. Target the right people. Start with finance, treasury, executive assistants and anyone who can approve payments.
4. Teach at the moment. Employees see "▶ Play video message" in the email. Anyone who acts on the request lands on a training page with the email's red flags highlighted, in under two minutes.
5. Agree the verification rule. Use the lesson to point to your real process, for example a call back on a known number or a code word, as the FBI suggests.
6. Measure and repeat. Use the campaign report and focused retests. Revoking the leader's persona or turning off the workspace setting pauses deepfake campaigns, and generated media and cloned voice are deleted when they expire.

SecurityRing runs deepfake video inside email. It does not run live deepfake calls.