CEO voice fraud: a payment process that holds up

5:40 pm on a Thursday. A finance assistant takes a call from the CEO, who is traveling. He sounds tired and a little short with her. A confidential acquisition closes tonight, he says, and a deposit has to go out now. Details will follow by email. Please keep this between the two of you.

This scene is a composite example built from common reports, not a single real case.

Every part of that call is designed to switch off a check: authority, urgency, secrecy, and a voice she trusts. It is CEO fraud, the phone cousin of business email compromise. The FBI's IC3 has tracked it for years, and in December 2024 it warned that generative AI, cloned audio included, makes these attempts more convincing (FBI IC3, PSA241203).

Stop treating the voice as a control

"I know his voice" used to be a decent safeguard. It isn't anymore. A short public sample, from a conference talk or a podcast interview, can be enough to imitate an executive on a call.

Our view is blunt: training staff to hear fake voices is the wrong fix. People are poor at it, and someone rushed at the end of the day is worse. The right fix is a process in which a voice, however real it sounds, cannot move money on its own.

Four rules that work even if the voice is perfect

1. No payment on a call alone. A new payee or changed bank details needs a written request through a channel that was not used for the call.
2. Call back on the number in your own directory. Never the number that called, never a number given during the call.
3. Two people for anything unusual. A second approver who was not on the call, and who hears what was asked, including the part that was "confidential".
4. Urgent plus secret means an automatic pause. Put it in writing. Staff then have a policy to point to when they say "I need to confirm this first."

The last rule does the most work in practice. Assistants rarely push back on a CEO, not because they believe the call, but because being wrong feels personally risky. A written rule takes that risk off their shoulders.

What happens before the call

This fraud usually starts with homework. The attacker learns who approves payments, who is on leave, who travels with the CEO. Then the call lands when checking is hard: Friday evening, a public holiday, the hour before a flight.

It is worth looking at what your company publishes. Travel posts, org charts, "meet the team" pages: each one helps someone pick the right target and the right moment. You don't have to hide. You can choose what to leave out.

How to check a recording after a suspicious call

Start with the request, not the sound. Was the payee new? Did the details arrive through a different channel? Did anyone call the CEO back on a directory number? Those answers settle more cases than any amount of listening. Then make sure the evidence survives:

• Save the voicemail or call recording as a file, with the date, time and number.
• If any money moved, call the bank at once and ask about a recall.
• Report it. In the US, file with IC3 at ic3.gov.
• Write down what staff were told. It helps the investigation and the next training session.
• Tell the person whose voice was used. They may be the target of more than one attempt.

Plans are on the pricing page.

One thing to do this week

Pick one of the four rules and put it in writing. A rule that lives only in people's heads will fail on a Friday evening.

FAQ

Can an attacker really clone a CEO's voice?

Cloned audio appears in public FBI warnings about financial fraud, and talks or interviews often provide enough material to attempt it. Your process should assume it can happen.

Is training staff to hear fake voices enough?

No. Human ears are unreliable, especially under time pressure. Use payment rules that do not depend on recognizing a voice.

What should we do with a suspicious voicemail from the CEO?

Save the original file with the date, time and number, call the CEO back on a directory number, and hold any payment until the request is confirmed through a second channel.