🎭 When “Your CEO” Calls — and It’s Not Really Them

FULL scam list with reference

Here’s a detailed breakdown of emerging AI-powered fraud methods used in corporate / work contexts, drawn from recent reports and real-world cases. These are highly relevant for companies, employee workflows, partner interactions and vendor relations. I’ll include what the scam looks like, how it works, and report-cases / statistics.

---

1. CEO-/CFO-Impersonation via Deepfake Audio/Video

What it is: A scam where fraudsters impersonate a senior executive (CEO, CFO, or other leader) via spoofed voice and/or video (deepfake) and instruct someone in finance/accounts to transfer funds, pay a vendor, or change bank details.
How it works:

• The attacker studies publicly available media of the executive (video, audio) so they can clone voice, replicate mannerisms, even produce a live video conference or Teams meeting using synthetic media. We Live Security

• They send a seemingly urgent request (e.g., “this is urgent, don’t tell anyone, we need to pay this vendor now”) to someone who handles a payment or vendor relationship.

• Because the call/email appears to originate from the “boss”, the target carries it out without the usual checks.
  Reported cases / scale:

• The UK engineering firm Arup (Hong Kong office) lost US $25 million when an employee believed a deepfake video-call from senior execs and transferred money. World Economic Forum

• Reports note that generative AI tools have “made it much easier for scammers to create bogus texts and emails as well as deep-fake voices at scale”. CFO Dive
  Why it’s effective:

• High trust: employees expect to get directions from executives.

• Urgency + secrecy: scammers often emphasise “must act now, top priority”.

• Sophisticated media: deepfake voice + video can fool even vigilant people.
  Typical red-flags:

• Requests to pay a new vendor or change payment instructions without follow-up from usual procurement chain.

• The executive asks for secrecy or bypasses standard process.

• The caller uses non-usual channels (social messaging, unusual email).
  Work/Corporate relevance: Very high. Target is employee at frontline of payments or vendor management.

---

2. Voice-Cloning + ‘Urgent Payment’ to Partner/Vendor

What it is: Using AI to clone a voice of someone internal or external (e.g., partner, vendor, senior executive) then calling an employee asking for a transfer of funds, payment of invoice, or change in bank account.
How it works:

• Fraudster obtains voice samples (may come from public content or recordings).

• They generate an audio message or live call with the cloned voice (sometimes via a WhatsApp/VoIP call) saying e.g., “I’m abroad, urgent, here’s the account info, please transfer”.

• The employee, trusting the voice, processes the payment.
  Reported cases / scale:

• The FBI states criminals “can use AI-generated audio to impersonate well-known public figures or personal relations to elicit payments”. Internet Crime Complaint Center

• The UK-based advisory firm PwC cites publicly-reported cases where “voice clones appeared to have been used to perpetrate a scam against a UK-based energy company” by impersonating the parent company CEO. PwC
  Why it’s effective:

• Voice is more trusted than text.

• The urgency/emotion built in (e.g., “I’m stuck abroad”, “we’re in trouble”) lowers scepticism.
  Typical red-flags:

• A payment request by voice rather than written invoice in usual channel.

• The vendor or partner says something ambiguous and requests you to act quick.

• The bank account changes at the last minute without usual verification.
  Work/Corporate relevance: High: particularly for finance, procurement, vendor operations.

---

3. Phishing / Social Engineering Enhanced by AI (Emails, Chat, Website Clones)

What it is: Traditional phishing and business-email-compromise (BEC) scams are being enhanced by AI: more convincing language, fake websites, fake chat messages, mimicking the writing style of internal executives, creating fake vendor portals, etc.
How it works:

• Use of generative-AI (LLMs) to craft more personalised emails, referencing company details, senior names, internal projects. JPMorgan Chase

• Use of fake websites that look like legit partner/vendor sites, to trick employees into entering credentials or making payments.

• Use of automated AI chat agents (script-bots) that interact in real-time to persuade, escalate, and exploit.
  Reported cases / scale:

• The Deloitte report estimates that generative AI could enable fraud losses of up to US $40 billion in the US by 2027 (from US $12.3 billion in 2023) due to such AI-enhanced scams. Deloitte

• The article “AI-driven deception: A new face of corporate fraud” outlines how businesses are facing this shift in techniques. We Live Security
  Why it’s effective:

• The content is customised and contextually relevant, making the scam much more believable.

• Victims are used to doing things via email/chat, so the channel is familiar.
  Typical red-flags:

• Unexpected email from senior exec asking for vendor list, payment or sensitive info.

• Language slightly “off” or unfamiliar channel (WhatsApp instead of MS Teams).

• URL/website looks legit but domain is slightly different.
  Work/Corporate relevance: Very broad: applies to any employee interacting with email/finance/HR/vendor.

---

4. Multi-Person Interactive Deepfake Meetings or Videos (Video Conference Fraud)

What it is: A variation of #1 above but more advanced: a live or pre-recorded video conference is staged, involving multiple “senior executives” (all fake) and possibly using deepfake video and voice in real time, to pressure employees into action.
How it works:

• Fraudster sets up what appears to be a legitimate internal video call (e.g., on Zoom/Teams) with participants whose faces/voices have been cloned or manipulated.

• The meeting includes “senior execs” asking someone (e.g., in finance) to process a payment, sign a contract, approve a deal, etc.

• Because the meeting appears official and interactive, the target is more likely to comply.
  Reported cases / scale:

• In the Arup case: “an employee … was tricked into transferring a staggering $25 million … after participating in a video conference call where everyone else, including senior executives, was an artificial intelligence-generated fake.” Adaptive Security
  Why it’s effective:

• Live interaction adds realism, reduces time for verification.

• Multiple people create a sense of group consensus (“everyone else is agreeing”).
  Typical red-flags:

• An internal meeting organised outside usual channels: e.g., on a new link, participants not known.

• The meeting asks for urgent financial approvals with little documentation.

• Pressure to act quickly, with minimal follow-up verification.
  Work/Corporate relevance: Especially high risk for larger firms with many remote meetings, cross-regional staff.

---

5. Supply-Chain / Vendor Impersonation via Deepfake and Social Engineering

What it is: Attackers impersonate key suppliers, partners or vendors to instruct changes in invoices, bank accounts, or payment terms — using AI assistance for authenticity (voice, email style, websites).
How it works:

• The attacker obtains vendor information and internal procurement workflow knowledge.

• They send an email or call purporting to be the vendor: “we changed our bank account / we switched provider / urgent invoice please pay”. Possibly using cloned voice for a vendor rep.

• The finance department pays to a fraudulent account.
  Reported cases / scale:

• The PwC report cites voice-clone scams against UK energy company vendor relationships. PwC

• Payment scams report from U.S. Government Accountability Office (GAO) notes “some scammers even use generative AI — such as deepfakes — to make payment scams harder to detect.” Government Accountability Office
  Why it’s effective:

• Vendor payment is regular business process; employees may skip extra verification if it looks normal.

• The vendor is trusted; impersonation leverages that trust.
  Typical red-flags:

• Vendor requests payment to a different bank account than usual without prior notice (or vague reasons).

• Vendor invoice outside usual format or urgent push.

• Contact via new channel (e.g., WhatsApp rather than official email).
  Work/Corporate relevance: High for procurement, accounts payable, vendor management teams.

---

6. Internal HR/Payroll Fraud Using Synthetic Identities

What it is: Attackers use AI to create fake identities (synthetic media, voice clones) of employees or contractors, to submit false invoices, change payment information, or claim reimbursements.
How it works:

• The attacker obtains voice sample or uses synthetic voice to impersonate an employee/contractor.

• They contact HR or finance requesting immediate reimbursement, change of bank account, or emergency payment.

• Because voice matches familiar voice, HR/finance may comply.
  Reported cases / scale:

• While fewer large publicised cases focus on payroll specifically, reports show synthetic identities and deepfakes are increasingly used for corporate fraud. For example, the Deloitte report notes “bad actors find and deploy increasingly sophisticated, yet affordable, generative AI to defraud banks and their customers.” Deloitte

• The article on AI-driven deception emphasises the internal risk (employees being manipulated) rather than just external vendor fraud. We Live Security
  Why it’s effective:

• HR/finance often trust internal voice/email, may not double-check small changes.

• The attacker uses urgency/emotion (e.g., “my bank account was hacked, please transfer now”).
  Typical red-flags:

• Employee requests change in payment/bank details via voice or chat rather than formal channel.

• Reimbursement request outside usual workflow or unusually urgent.

• Voice or request doesn’t match known HR/finance policy (but voice appears correct).
  Work/Corporate relevance: Particularly relevant for HR, payroll, contractor relations, internal controls.

---

7. Corporate Investment / Acquisition Fraud Using AI (Pretending to Be Partner, Investor)

What it is: Scammers impersonate potential investors, merger/acquisition partners or large clients using AI-generated communication or deepfakes, to extract due diligence fees, payments, or sensitive corporate data.
How it works:

• Attacker contacts a senior executive, CFO or M&A lead saying they’re representing a big investor or client and need to wire funds, send documents, pay reputation-insurance fee, etc.

• They use AI-enhanced emails, fake websites, fake video calls with the investor, to appear legitimate.
  Reported cases / scale:

• The “Deepfake deep dive” report mentions that in CEO-frauds, “AI deepfakes are used to target businesses, including companies, suppliers and business partners.” Institute for Financial Integrity

• Deloitte and others warn that as AI lowers barrier to creating convincing fake personas, these fraud types will increase. Deloitte
  Why it’s effective:

• High stakes (M&A, large investments) means executives may relax verification in fear of losing deal.

• Use of plausible video calls seals credibility.
  Typical red-flags:

• New investor/partner insisting on hurry, confidentiality and wiring funds quickly.

• Communication outside usual channels; investor cannot be reached via official corporate address.

• Lack of formal documentation in expected standard for such transactions.
  Work/Corporate relevance: Important for C-suite, corporate development, and legal/compliance teams.