The phone rings and it is the voice of the office’s owner: “I’m in a meeting, I can’t talk. You need to make a bank transfer straight away to close a confidential deal, I’ll send you the details.” It really is his voice, and his tone too. But it is not him. This is the deepfake scam with a cloned voice, one of the threats that artificial intelligence has made far more accessible.
What is a voice deepfake?
A voice deepfake is a synthetic voice, generated with artificial intelligence, that realistically imitates the voice of a real person. Creating one only requires audio samples that are often easy to find: a social media video, an interview, a webinar, a voice message. The same applies to video: there are tools capable of swapping a face in real time during a video call.
How CEO fraud works
CEO fraud has been around for years: the criminal pretends to be the head of a company and asks a member of staff for an urgent, confidential payment. Its email variant is called BEC (business email compromise): a mailbox is hacked or imitated in order to send invoices with a different IBAN (bank account number).
The typical scheme has four ingredients:
- Authority: the request comes from someone you do not say no to (the owner, an important client, an institution).
- Urgency: “Within the hour”, “before close of business”.
- Confidentiality: “Don’t tell anyone, it’s a sensitive deal”.
- Unusual channel: an unknown number, WhatsApp, a new email address.
AI adds an extremely powerful ingredient: the right voice or face.
Real cases
- Arup (Hong Kong, 2024). An employee of the multinational engineering firm took part in a video call with what appeared to be the chief financial officer and other colleagues. They were all fake. The result: 15 bank transfers totalling about 200 million Hong Kong dollars, roughly 25 million US dollars. The company confirmed that “fake voices and images” had been used.
- Italy, February 2025. Several well-known business owners received phone calls in which the voice, reproduced with AI, was that of the Defence Minister Guido Crosetto, asking for money to free supposedly kidnapped journalists. According to press reports, one of the business owners made two transfers totalling about 900,000 euros; the Milan Public Prosecutor’s Office opened an investigation.
If the scam works on experienced managers and major entrepreneurs, it can work on an office’s front desk too.
How can you recognise a cloned voice?
It is increasingly difficult, and it is not wise to rely on your ears. Some clues may appear (unnatural pauses, a flat tone, evasive answers to off-script questions, audio that is strangely “clean”), but these systems improve month by month.
Far more reliable are the contextual signals: urgency, secrecy, a request for money or data, an unknown number, no way of calling the person back. They are the same signals as in email phishing.
The 5 rules that stop the scam
- No payments on request by phone or chat, without exception. Every transfer request must go through the office’s official channel.
- Always verify on a second channel. Hang up and call the owner or client back on the number you already know, not the one that called you.
- Agree on a code word. A secret word or question, known only to authorised people, to be asked whenever an unusual request comes in. It works within families too.
- Two signatures for payments above a certain threshold and for every change of a supplier’s IBAN.
- Nobody gets told off for checking. The owner must say it clearly: “If I call you about an urgent transfer, always call me back.” The fear of being a nuisance is the fraudster’s best ally.
What about email fraud (BEC)?
The email version is even more widespread: an “updated” invoice with a new IBAN, sent from the real supplier’s compromised mailbox or from an almost identical address. The countermeasures:
- verify every change of bank details by phone, on the number already held in your records;
- two-factor authentication on the office’s email, so that your own mailbox is not used against your clients (→ guide to passwords and MFA);
- watch out for forwarding rules that suddenly appear in the mailbox: they are a sign of a compromise.
What to do if you have already paid
- Call the bank immediately and ask for the transfer to be recalled: in the first few hours it is sometimes possible to stop it.
- Report it to the Postal Police (Polizia Postale, Italy’s cybercrime police).
- Keep everything: numbers, recordings, messages, emails.
- Inform the owner and, where involved, the clients or suppliers whose identity was used.
The full procedure is in the guide cyberattack: what to do straight away.
The role of technology
Against a cloned voice, the first defence is procedure. Technology does, however, help to close the doors through which fraudsters gather information or break into mailboxes: a network that notices suspicious logins or connections to malicious sites, and reports them to the owner straight away, reduces the risk of the scam starting from inside the office. That is what Strega Defence does. To understand how AI is changing threats, also read artificial intelligence and cybersecurity; to take stock of your office’s security, see the 10-question checklist.
Frequently asked questions
How much audio is needed to clone a voice?
With today’s tools, a few seconds of recording can be enough for a convincing imitation, and a few minutes for a very realistic one. Social media videos, webinars and voice messages are easy sources to find.
How can I check whether the person calling me is really my boss or my client?
End the call and ring the person back on a number you already know, or ask a question or request a code word agreed in advance. Never use the number or contact details provided during the suspicious call.
What is CEO fraud?
It is a fraud in which the criminal pretends to be the owner or a manager of the organisation and asks a member of staff for an urgent, confidential payment. Today it can happen by email, phone, messages or video call, even with a voice and face faked by artificial intelligence.
Can a bank transfer made because of a scam be recovered?
Sometimes, if you act within a few hours: the bank can attempt to recall the transfer before the funds are moved on. The more time passes, the harder it becomes. You should always report it to the Postal Police.
Can video calls be fake too?
Yes. There are tools capable of replacing face and voice in real time during a video call, as the 2024 Arup case shows. The same rule applies to requests for money: verify on a second channel.
Sources and further reading
- The Arup case: a 25-million-dollar deepfake scam in Hong Kong — CNN, 16 May 2024.
- Truffa con la voce di Crosetto: le vittime (in Italian) — Calcio e Finanza, 11 February 2025. The victims of the Crosetto voice scam.
- Truffa Crosetto agli imprenditori (in Italian) — Il Giorno. The Crosetto scam targeting business owners.
- Vishing (in Italian) — Italian Data Protection Authority (Garante per la protezione dei dati personali).
- Cybercrime, il report 2025 della Polizia Postale (in Italian) — Sky TG24, 10 January 2026. The Postal Police’s 2025 cybercrime report.
- Commissariato di PS Online – segnalazioni (in Italian) — Polizia Postale. The Postal Police’s online reporting service.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
