Deepfake and cloned-voice fraud: a protocol for companies

What has happened: cases and numbers

The reference case is Arup. In early 2024 a finance employee at the engineering firm's Hong Kong office joined a video call with what appeared to be the CFO and several colleagues; all were deepfakes. The employee made 15 transfers totaling HKD 200 million, about $25.6 million. Hong Kong police described the case in February 2024, and Arup confirmed in May that it was the victim.

The FBI has since documented the pattern: criminals cloning relatives' voices to fake emergencies (December 2024) and, since April 2025, impostors posing as senior US officials with texts and AI-generated voice messages to build trust and take over accounts, often moving the victim to another messaging platform. HR is a target too: in August 2025 Anthropic reported North Korean operatives using Claude to get and keep remote IT jobs at Fortune 500 technology companies.

How these attacks work, conceptually

Four ingredients, none of them technical on the victim's side.

• Raw material. Public recordings of the person to imitate: interviews, earnings calls, conference talks, podcasts, social clips. The voice models behind this are covered in voice and audio AI in 2026.
• A pretext. A confidential acquisition, an overdue supplier invoice, a regulator's request: a story that explains why the usual procedure must be skipped.
• Urgency and secrecy. "It has to go out today", "don't mention this to anyone". Pressure removes the time to think.
• Channel switching. The conversation moves to a channel the attacker controls: from email to WhatsApp, from a text to a voice note, from a call to a video meeting. The FBI describes exactly this move.

It is the old CEO fraud with a convincing voice, and Arup adds staging: several fake participants on the same call. The targets are predictable (treasury, accounts payable, payroll, executive assistants, IT help desks), and so is the weak point: the impostor needs you to act inside their channel and on their timeline. Any control that moves the exchange to a channel you trust, or adds time, breaks the scheme.

Why detection tools alone are not enough

Deepfake detectors and watermarks are useful, but they cannot be the control that stops a payment. NIST's report on synthetic content (AI 100-4, November 2024) concludes that no single provenance or detection technique is a comprehensive solution.

Watermarks exist only when the generator applies them. Since August 2, 2026, the EU AI Act has required providers of systems that generate synthetic audio and video to mark their output, but a fraudster using an open-weight model or a service outside the EU will not comply. Marks can also be attacked: UnMarker (IEEE Symposium on Security and Privacy, 2025) cut the best detection rate of semantic image watermarks to 43%. And a live call leaves no time to upload a clip and wait for a score.

The verification protocol, step by step

For finance, HR and executive assistants. Adapt the thresholds to your size; keep the principles.

Two principles sit above the table: no payment or bank change is approved on the strength of a voice or a video alone, whoever seems to be speaking, and verification happens on a channel you chose, never the one the request came from.

Pause-and-verify culture, training and simulations

A protocol only works if people feel safe applying it to a senior voice, so the signal must come from the top: the CEO and CFO tell their teams in writing that they will never ask for a payment or bank change by voice or video alone, and that being verified is expected.

• Train finance, HR, assistants and help desk staff with real cases (Arup, the FBI warnings), not generic slides.
• Run a tabletop exercise: an urgent request from the "CFO" arrives on a Friday afternoon. Who calls whom, and who can stop the payment?
• Run controlled phishing and voice-pretext simulations agreed in advance with management, HR and legal, with written consent from anyone whose voice or image is used.
• Measure behavior, not attendance: share of staff who verified, time to escalate, payments stopped.

Slash runs controlled phishing and social-engineering tests from COP 5 million (see the pentest page); for the technical side, read how AI changes pentesting.

If the money already left: incident response

1. Call your bank immediately and request a recall or freeze of the transfer at the first suspicion: a false alarm is easier to undo than a transfer that has moved on.
2. Preserve evidence: call logs, numbers, voice notes, meeting links, chats, emails with headers and transaction details. Don't delete anything or confront the impostor.
3. Contain: freeze related pending payments, reset credentials that may be compromised, and warn the impersonated executive and the teams likely to be targeted next.
4. Report. In Colombia, to ColCERT, the national cyber emergency response team (it has incident and phishing reporting channels), and through a criminal complaint; CONPES 3995, the national digital security policy, also lists the National Police's CSIRT (CSIRT PONAL). If personal data were compromised, Ley 1581 of 2012 requires informing the SIC, through the security-incident module of the national database registry (RNBD). If a US bank or subsidiary is involved, the FBI's IC3 takes complaints. In France and elsewhere in the EU, use the national channels and involve your DPO.
5. Learn: identify the control that failed or was bypassed, update the protocol and share the lesson without blaming the person who was deceived.

Legal context in Colombia and the EU

Context, not legal advice: review your case with counsel.

Colombia. Ley 2502 of 2025 (signed July 28, 2025) amended Article 296 of the Criminal Code on falsedad personal (impersonation): when it is committed with artificial intelligence, the fine increases by up to one third, provided the conduct does not constitute another offence. The law defines deepfakes and orders a public policy against AI misuse within two years. In a payment fraud, your lawyer will assess which offences apply.

European Union. Article 50 of the AI Act has applied since August 2, 2026. Providers of systems that generate synthetic audio, images, video or text must mark output in a machine-readable, detectable way (systems already on the market have until December 2, 2026), and deployers must disclose the deepfakes they publish, with lighter duties for evidently artistic or satirical work. Breaches can cost up to 15 million euros or 3% of worldwide annual turnover.

Fraudsters don't label their fakes, so these rules mostly give victims and authorities a legal basis. For your own company they cut the other way: if you use an executive's synthetic voice or avatar in marketing or training, get written consent and label it where the AI Act applies. More in our 2026 regulatory map.

Executives: manage your public voice and video footprint

The FBI advises limiting public audio and images of yourself, but an executive cannot vanish from public view. The aim is to know what exists and make sure none of it can move money.

• Inventory recordings: earnings calls, interviews, podcasts, keynotes, social videos.
• Protect personal numbers and accounts, which impostors use to open "private" channels.
• Agree a code word in person with your assistant, your CFO and your family.
• Tell teams, clients and key suppliers how you will and will not contact them, so the exception stands out.
• Watch for fake profiles using your name and photo on professional networks and messaging apps.