CEO fraud and business email compromise in the deepfake era
CEO fraud (a form of business email compromise, or BEC) used to rely on a spoofed email. Today it can add a cloned voice note, a phone call or a video call, which makes it far more persuasive. This page explains the pattern and how to break it.
The pattern
- An attacker researches the company: who approves payments, who the executives are, who the vendors are.
- A message arrives from a spoofed or look-alike address, a hijacked thread or a lookalike domain. It is often followed by a call.
- The request is urgent and confidential: pay an invoice, change a vendor account, buy gift cards, move funds.
- Deepfake audio or video is used when someone asks to talk it through.
Controls that break it
| Control | What it stops |
|---|---|
| Out-of-band confirmation on the executive’s own device | Any impersonator who does not hold that device, including voice and video clones |
| Dual approval for payments and bank-detail changes | A single deceived employee |
| Call-back to a known vendor number before any bank change | Hijacked threads and fake vendor emails |
| Email authentication (SPF, DKIM, DMARC) and look-alike domain checks | Spoofed senders and reply-to tricks |
| Realistic drills | Hesitation to challenge a senior person |
How Wardeye supports these controls
Wardeye gives approvers a one-step way to send an “Is this you?” for wires, bank changes, gift cards and password resets, and records the answer in an audit trail. A read-only Microsoft 365 connection (beta) checks sender authentication, look-alike domains and reply-to mismatches, alongside your email gateway with no MX change. It does not replace your email security or your payment approvals.
Frequently asked questions
What is the difference between CEO fraud and BEC?
BEC (business email compromise) is the broad category of fraud using email impersonation or account takeover. CEO fraud is the version where the attacker poses as an executive to demand a payment or sensitive information.
Can email security alone stop CEO fraud?
No. Gateways filter many bad messages, but they do not hear a phone call, see a video call or know the executive’s intent. Confirming the request with the real person is still needed.
What should an employee do with an urgent payment request from an executive?
Do not act on the call or message alone. Confirm through a separate, known channel, follow the normal approval path and keep a record. A real executive will accept the delay.
Does Wardeye integrate with Microsoft 365?
Wardeye can connect to Microsoft 365 read-only through the API to flag email impersonation signals. It is optional, in beta, revocable, and does not store message bodies.