Fake voice, fake video: how do you foil AI-powered CEO fraud?

The scenario in brief

Example, made up for illustration. Late on a Thursday afternoon, the bookkeeper of a fictional SME of twenty people receives a voice message from the managing director. It is his voice, his accent, the way he says ‘listen’. He explains that he is negotiating a takeover, that it is confidential, and that he will video call her in five minutes.

The call comes in. The managing director's face appears on screen, the picture a little jerky: ‘I'm on the train, the connection is bad.’ He asks for a transfer of €45,000 to a law firm, before 5 pm, without telling anyone. The bookkeeper hesitates, then remembers the rule pinned above her desk: she hangs up and calls the managing director back on his usual number. He is in a meeting with a client and has never called. The amount and the details are made up.

There is nothing exaggerated about this scenario. It is a smaller version of what Belgian and foreign authorities have described in recent years.

The fake King Philippe: the January 2026 alert

On 24 January 2026, the Federal Prosecutor's Office and the Centre for Cybersecurity Belgium (CCB) revealed that a gang had been posing for more than a year as King Philippe, his chief of staff and a major general. According to The Brussels Times and the French-language outlets Paris Match Belgique and BX1, which report the prosecutor's statement, the targets were foreign dignitaries, Belgian families and business leaders, chosen for their possible links with the royal family.

• The channels: phone, WhatsApp and email.
• The pretext: raising money to free Belgian journalists supposedly held hostage in Syria.
• What was new in January 2026: business leaders were invited to a video meeting with the King, whose images were, according to the prosecutor, ‘probably generated by artificial intelligence’.
• A variant: fake invitations to a King Baudouin Foundation gala dinner, with a request for a contribution. The Foundation replied: ‘Any call (of this kind) is fraudulent.’
• The outcome: most of the people targeted quickly saw through the scam, but one transfer was made.

Above all, remember the method: the fraudsters choose their targets carefully, use an authority nobody dares to contradict, then add the face and the voice to remove any doubt. That is exactly the recipe for CEO fraud, also known as fake president fraud.

What AI changes in CEO fraud

CEO fraud means posing as a company's director, or as a trusted contact, to push an employee into making an urgent, secret payment. Until now, it mostly came by fake email. The Belgian financial sector federation, Febelfin, notes in its 2026 brochure that fraudsters are increasingly using artificial intelligence ‘to imitate a voice or face (during phone calls, voice messages or video calls)’.

This is called a deepfake: a video, photo or recording made or altered by AI to make someone say or do something they never said or did. To imitate a director, you need recordings of their voice and face. Interviews, social media videos, webinars, voicemail greetings: for many SME directors, that material is already online.

The best-known case remains that of the engineering group Arup in Hong Kong. According to the Hong Kong police, quoted by CNN, an employee in the finance department sent 200 million Hong Kong dollars, about 25.6 million US dollars, in 15 transfers, after a video conference with a fake chief financial officer and fake colleagues. Arup confirmed that fake voices and images had been used.

Why looking for flaws in the picture is no longer enough

You often read that you should look for lips out of sync, a fixed stare or odd shadows. That helps, but it is a race you cannot win: the tools keep improving, and the fraudster always has an excuse ready, such as a bad connection or a call from the car.

Febelfin sums it up in one simple piece of advice: even if the request appears to be real, always verify it through a trusted channel, because AI can now impersonate a CEO. In other words, it is not your eye that protects you, it is your procedure. A perfect voice must never be enough to send money out.

The signals that should make you pause are almost always the same, with or without AI:

• Urgency: ‘before 5 pm’, ‘before closing’, ‘it's a matter of hours’.
• Secrecy: ‘don't tell anyone, not even your manager’.
• The exception: a new payee, an account abroad, a procedure you are asked to bypass ‘just this once’.
• Authority: the boss, a senior manager, a public figure, a lawyer or an auditor who insists.
• The unusual channel: a personal messaging account, an unknown number, a video call started without an invitation.

The defence: seven steps to put in place on Monday morning

None of these steps needs a tool or a budget. They only need everyone, the director included, to accept that a payment can wait for the length of a phone call.

1. Write the rule down and put it up: no payment and no change of bank account is ever made on the strength of a call, a voice message, a video call or an email alone, even from the boss.
2. Hang up and call back. For any urgent or confidential request, end the call and call the person back on the number you already had in your contacts, never on the one you are given.
3. Bring in two-person approval: above a set amount, two people approve each payment, and dual signatures are never left in the hands of one person, as Febelfin points out.
4. Appoint a fallback contact other than the director, whom people turn to with any urgent or secret request. Febelfin specifies that no one outside the company should know who this person is.
5. Agree on a check question with the people who make payments: a detail only you and they know, to ask when in doubt, and never written down in an email or a messaging app. An impersonator will struggle to answer it.
6. The director commits in writing never to ask for a secret transfer. The day ‘he’ does, everyone knows it isn't him.
7. Limit what is public: who makes the payments, who is on holiday, who is travelling. That is the information fraudsters gather first.

Explain these rules in ten minutes at the next team meeting, with the story of the fake King Philippe: it sticks in people's minds and shows that nobody is immune.

In a healthcare practice

The scenario adapts easily, for example: the fake voice of the senior doctor calling the receptionist during a conference for an ‘urgent’ deposit on a piece of equipment, or a fake supplier on a video call. The rule is the same: calling back on the known number comes before any payment, whatever the authority of the person on screen.

Will the European rules solve the problem?

Not for fraudsters. According to the European Commission, the European AI legislation requires certain AI-generated content, including deepfakes, to be clearly and visibly labelled. These transparency rules have applied since 2 August 2026. That is good news for legitimate content. But a fraudster will never put a label on a fake video: your internal procedure remains the real protection.

You have been caught out: what to do, in order

Every hour counts. Febelfin points out that if you notify the bank quickly, there is a greater chance of recovering the money.

1. Call your bank immediately to report the fraud and ask for the transfer to be blocked or recalled.
2. File a complaint with the police, with all the evidence: voice messages, screenshots of the video call, numbers, emails, the transfer order.
3. Tell your IT provider: if a mailbox was hacked to prepare the scam, the passwords must be changed.
4. Report the facts on ConsumerConnect, the FPS Economy website recommended by Febelfin.
5. Don't look for someone to blame: the person who was caught out was manipulated by professionals. They must be able to speak up straight away, without fear.

AI remains an ally, as long as payments are locked down

Artificial intelligence saves many businesses and practices time, and there is no reason to go without it. The risk does not come from the tool, but from an organisation where a single voice on the phone is enough to send money out. Close that door with a few simple rules, and even the most convincing imitation will get nowhere.

Protect your payments→