Reported Deepfake Executive Impersonation Leads to $25 Million Fraud
Cybercriminals are reportedly using AI-generated deepfake audio and video to impersonate senior executives in 'whaling' attacks, making social engineering more convincing. A notable incident in 2024 involved a British engineering company, Arup, where an employee was deceived by a deepfake video conference into transferring approximately $25 million. A September 2026 Gartner survey indicated that 41% of CISOs reported deepfake social engineering incidents via audio calls, and 36% via video calls, in the preceding 12 months. The FBI also warned in May 2025 about AI-generated voice messages impersonating senior US officials for credential theft.
According to a report by teiss, cybercriminals are increasingly leveraging artificial intelligence to create convincing deepfake voice and video messages to impersonate senior executives. This tactic enhances 'whaling' attacks, a form of social engineering targeting high-level personnel or using their authority to illicitly obtain sensitive information, transfer funds, or gain access to corporate systems. The article highlights a significant incident in 2024 where an employee of the British engineering firm Arup in Hong Kong was reportedly defrauded of approximately $25 million. The employee participated in a video conference featuring digitally recreated versions of the company’s chief financial officer and other colleagues, leading them to authorize 15 transfers to five bank accounts. The company's internal systems were not compromised in this incident. The threat's growing prevalence is underscored by a September 2026 Gartner survey, which found that 41% of chief information security officers (CISOs) had reported at least one deepfake social engineering incident involving an employee audio call within the previous year, with 36% reporting incidents involving video calls. Additionally, in May 2025, the FBI issued a warning about malicious actors using AI-generated voice messages to impersonate senior US officials, attempting to build rapport before directing targets to fraudulent websites to steal credentials. These attacks exploit ordinary workplace behaviors, making traditional security awareness training less effective against sophisticated deepfake impersonations. The article suggests that strengthening verification procedures for financial transfers, sensitive information, or account permission changes, along with fostering a culture where employees feel comfortable questioning unusual instructions, are crucial countermeasures.