CEO deepfake: a ready-to-run tabletop scenario

October 5, 2026 · 6 min read · Also in Spanish

A complete scenario to rehearse, with your executive team, an urgent transfer requested by a fake voice or video of the CEO.

In 2024, a finance employee at Arup's Hong Kong office transferred about 25 million US dollars after a video call in which the chief financial officer and several colleagues were fakes, generated with deepfakes. There was no malware and no network intrusion: just people convinced they were talking to someone they weren't.

Cloning a voice now takes a few minutes of public audio. That's why this scenario is no longer science fiction, and why it's worth rehearsing with your executives before it happens. Here's one ready to run in an hour.

The scenario

Context: Friday, 5:40 p.m. The CEO is travelling and hard to reach. Treasury closes payments at 6:30.

Event 1 · The call

The CFO gets a call from an unknown number. It's the CEO's voice, with their tone and turns of phrase: "We're closing a confidential acquisition. I need a 2.4 million transfer to go out today to the outside counsel's account. Don't mention it to anyone until Monday." Minutes later, an email arrives from a supposed law firm with the bank details.

Questions per role:

CFO: do you authorise the transfer, hold it and verify through another channel, or ask a second executive to approve it?
CISO: the email got through the filters. Do you block the domain, analyse the headers, or warn the whole company?
General Counsel: if the acquisition were real, what would leaking it mean? And if it isn't?

What it shows: whether there's a procedure for verifying through an independent channel (calling back a known number, an agreed code word), and whether anyone feels they have the authority to stop an order from the CEO.

Event 2 · The video call

The "CEO" insists and suggests a video call with the "outside counsel". The image is a little pixelated; he says the airport connection is bad. Treasury asks whether to release the payment.

CFO: what would you ask on the call to confirm their identity?
CEO (the real one, when they finally answer a message): what instructions do you give, and to whom?
CISO: how do you preserve the evidence (recording, logs, emails) for the bank and the authorities?

What it shows: whether the team knows video is no longer proof of identity, and whether there's a direct contact at the bank to stop or recall a transfer.

Event 3 · The audio online

On Monday, an audio clip of the "CEO" making offensive comments about a customer circulates on social media. It's fake, but it sounds exactly like them.

Head of Communications: do you deny it immediately, wait for a forensic analysis, or not respond?
CEO: do you face the public yourself?
General Counsel: do you file a complaint, ask the platforms to take it down, or both?

What it shows: whether there's a communication plan for executive impersonation, not just for technical incidents.

Controls the debrief should surface

Independent-channel verification for any urgent or out-of-process payment, even when the order comes from the CEO.
Dual approval and amount limits, with no "confidential" exceptions.
A code word or security question agreed among the executives.
A contact at the bank to hold or recall a transfer in minutes, not days.
A communication protocol for denying fake audio or video.
Specific training for finance staff and executive assistants, the usual targets.

How to run it

Ask each executive to decide privately before discussing. In this scenario it matters even more: the pressure of hierarchy is exactly what the attacker exploits. If the CFO only stops the payment once they see the others would too, the control doesn't exist.

Put a clock on every event. The attacker wants urgency; so does the exercise.

Debrief questions

Who had the authority to stop the payment, and did they know it?
Which part of the procedure relied on "recognising the CEO's voice"?
How long did it take us to reach the bank?
What would we do differently next Friday at 5:40 p.m.?

This scenario is included in Critios as "The CEO's voice", in English and Spanish, with private decisions per role and a report of the timings and gaps found. Try the demo or simulate your crises with us.