CEO Fraud Evolves: Deepfakes and AI-Powered WhatsApp Scams Target Corporate Payments

Overview of the Scam

This fraud, known internationally as CEO fraud or boss scam, involves criminals impersonating company executives or senior managers to instruct employees to make unauthorized transfers. While traditionally executed through email spoofing or compromised corporate email accounts, recent attacks now exploit messaging apps like WhatsApp combined with AI technology.

How the Scam Operates

Typical WhatsApp Attack Sequence

1. Initial Contact: Messages arrive from unknown numbers, often using the victim's regional area code, displaying the authentic name and photo of a real executive.

2. Trust Building: Conversations begin casually with innocuous questions like "Good morning, are you busy?" without immediate financial requests.

3. Payment Demand: After establishing rapport, attackers request urgent payments outside normal company procedures, with recipient bank details provided later.

4. Pressure Application: Justifications such as "I'm in a meeting" or "This involves confidential information" discourage verification through other channels before transfer completion.

5. Fund Dispersal: Transferred money is rapidly distributed across multiple bank accounts, complicating tracing and recovery efforts.

AI-Enhanced Attacks

Recent cases incorporate deepfakes—AI-generated video and audio. In 2024, UK-based engineering multinational Arup fell victim to a deepfake attack during a video conference, where AI replicated executives' voices and appearances. The victim executed 15 transfers totaling approximately $25 million. This technology undermines traditional verification methods based on facial recognition or voice confirmation.

Warning Signs

Red Flags to Monitor

• Payment instructions through unusual channels (WhatsApp, messaging apps)
• Unusual emphasis on urgency or time pressure
• Requests to avoid verification attempts
• Hastened demands for bank account changes
• Claims of unavailability (meetings, travel, confidential matters)

Prevention Measures

Organizational Safeguards

1. Verification Protocols: Respond to unusual payment instructions by contacting the supposed sender using previously registered phone numbers or in person. Never call back the number from which the message originated.

2. Maintain Approval Workflows: Never bypass standard authorization steps, regardless of claimed sender status.

3. Monitor Beneficiary Changes: Treat requests for account information changes—especially those emphasizing urgency or confidentiality—with heightened skepticism.

4. Secure Messaging Applications: Enable two-factor authentication in WhatsApp and regularly review connected devices and active sessions.

5. Employee Training: Conduct regular awareness training for finance, procurement, and executive support staff about this fraud method.

6. Account Oversight: Monitor legitimate accounts for signs of unauthorized access.

If Funds Have Been Transferred

1. Immediate Notification: Contact your financial institution immediately and report suspected fraud.

2. Pix Recovery (Brazil): For Pix transactions, use the Banco Central's Special Return Mechanism (MED) to request reversal within 80 days. Swift action increases recovery probability.

3. Evidence Preservation: Retain all messages, phone numbers used, transfer receipts, beneficiary information, and related evidence.

4. Official Reporting: File a police report and notify your information security team.

Critical Takeaway

The fundamental threat of this fraud operates without penetrating corporate systems; it exploits employee trust and the perception of urgency. As AI technology renders traditionally reliable verification methods (voice calls and video conferences) untrustworthy, organizations must rely on multi-layered, formal authorization procedures as their primary defense.