Believable Enough Can Move the Money

The Visibility Trap

Every public executive moment now has a second use. The earnings call that reassures investors can train a voice clone. The keynote that builds authority can supply facial data. The podcast that makes a founder sound accessible can give criminals the cadence, pauses, and verbal habits they need. The leadership video meant to humanize the company can become raw material for someone else's command.

For years, companies pushed executives into visibility because visibility created trust.

CEOs became more public, more conversational, more available, and more recognizable. That was useful for customers, investors, employees, and the market. It also created a library of material that attackers can now reuse without permission, context, or much technical effort. This is the part many leadership teams still have not absorbed.

Deepfake fraud is not mainly about fake media. It is about what fake media can get an organization to do before anyone has time to prove it was fake.

A convincing voice does not need to survive forensic review. It needs to survive long enough to move a payment, accelerate a vendor change, reset credentials, create internal confusion, or place the company on the defensive in public. A fake executive video does not need to fool everyone forever. It needs to become the first version of the story while legal, security, communications, and leadership are still deciding who is allowed to say what.

That is why the old framing has failed. Deepfakes are not a future reputation problem. They are an operating problem now. They attack the space between authority and verification.

The Breach Starts Before the Fake Is Proven

Most organizations still behave as if identity is recognizable in real time. A familiar voice carries authority. A familiar face lowers resistance. An urgent request from someone senior receives a different kind of attention than the same request from someone lower in the hierarchy.

People do not merely process the instruction. They process the status of the person giving it. Attackers understand that better than many executives do.

The employee who receives a suspicious request is not making a clean technical judgment. That employee is navigating pressure, rank, timing, confidence, and fear of being the obstacle. The fake succeeds when the organization has trained people to move faster for authority than for procedure.

This is why deepfake fraud feels new while exploiting something old. Companies have always had informal authority pathways. A senior leader says something, and friction disappears. A request is labeled confidential, and the normal process becomes negotiable. A deadline is described as urgent, and verification feels like disobedience.

Generative AI did not create those habits. It made them usable at scale.

The result is a control environment where the decisive question is not whether employees know deepfakes exist. Many do. The decisive question is whether the company has removed the ability of a familiar face or voice to override controls.

If a cloned CFO's voice can accelerate a transfer, the issue is not the clone's quality. The issue is the weakness of the process that allowed sound to behave like authorization.

The CEO Is Not the Target. The Operating Model Is.

Deepfake attackers do not need to hate your company. They only need to understand how it works. They need to know who can approve payments, who can pressure exceptions, who has public voice samples, which executive travels frequently, which teams react quickly to senior requests, and which procedures are respected on paper but softened in practice. They are not merely impersonating a person. They are impersonating the organizational permission that the person carries.

Executive identity should now be treated as a protected enterprise asset. Not because CEOs are fragile. Because modern companies attach enormous operational consequences to executive presence.

A CEO can move employees. A CFO can move money. A general counsel can freeze disclosure. A board chair can influence confidence. A division head can alter procurement behavior. A senior investor-relations voice can shape market perception. Those roles carry practical power, and that power was built for a world in which identity signals were much harder to fabricate.

Deepfakes change the economics of that assumption. Public visibility becomes training data. Hierarchy becomes leverage. Urgency becomes the delivery mechanism.

The corporate risk is not limited to the spectacular loss. The $25 million deepfake transfer case involving Arup became famous because the number was large and the scenario sounded cinematic. The attempted WPP impersonation drew attention because fraudsters used a fake WhatsApp account, voice cloning, and meeting mechanics to create a plausible executive interaction. Those cases matter, but the larger lesson is less dramatic and more dangerous.

A failed attempt can still reveal that the company's controls depend on vigilance instead of design. Vigilance is useful. It is not a control architecture.

Believable Enough Is the Standard

Executives often imagine deepfake risk as a quality problem. They picture a fake that must be flawless, sustained, and technically impressive. That is comforting, and it is wrong.

Fraud rarely needs perfection. It needs context.

A voice call during travel. A message near the quarter close. A request framed as confidential. A video meeting with poor connection quality. A vendor change that appears to come from the right chain of command. A fake public statement released when the company is already under pressure. None of these scenarios requires Hollywood-level realism. They require enough plausibility to make hesitation feel costly.

Generative AI also removes many of the defects companies used to rely on. Bad grammar, awkward phrasing, strange formatting, and obvious inconsistencies were once part of the informal defense system. They helped employees smell fraud.

The FBI has now warned that generative AI helps criminals create more believable text, images, audio, and video, including content that reduces the human errors that used to expose schemes.

That is the real degradation of the old model. The signals people were trained to spot are getting cleaner, while the pressure tactics remain familiar. The attacker no longer has to sound like a cartoon criminal. The attacker can sound like someone who belongs in the workflow.

The most dangerous deepfake may not be the viral video everyone sees. It may be the boring voice message that one employee believes for seven minutes.

Culture Has Become Part of the Attack Surface

No control survives a culture that quietly punishes verification. Many companies claim they want employees to challenge suspicious requests. In practice, the person who slows down an executive instruction can still be treated as difficult, timid, or insufficiently commercial. This is especially true in organizations that celebrate speed but only discuss controls after something has gone wrong.

Attackers exploit that contradiction. They do not only imitate voices. They borrow the emotional force of hierarchy.

A junior finance employee may know that a second validation step is wise. That same employee may also know that delaying a legitimate CEO request could become a career problem. A procurement manager may sense that a change in vendors feels unusual. That manager may still process it if the request appears to come through a senior channel with urgent language. A communications lead may want to wait for confirmation before responding to a fake public statement. The market may not wait.

This is the part leadership teams own directly. When I raise this with executives, the resistance is rarely about the control itself. It is about the discomfort of being verifiable — of accepting that their own voice should no longer be enough.

Verification cannot depend on personal courage in moments of pressure. It has to be required, rehearsed, and socially protected before the pressure arrives.

A serious organization makes verification ordinary. It makes out-of-band confirmation a standard part of sensitive work. It makes clear that no executive is important enough to bypass controls created to protect the enterprise. If senior leaders dislike that, they are not defending efficiency. They are defending an exploitable privilege.

Deepfake resilience starts when the company stops treating skepticism toward authority as disrespect.

Detection Will Not Save a Bad Workflow

Detection tools will be part of the answer, but they are not the answer. Companies will need synthetic-media monitoring, forensic review, authentication technology, watermarking where available, social listening, threat intelligence, and tooling that helps identify manipulated content.

The technical layer is necessary. It is also too slow for many of the moments that cause loss.

If a fake voice triggers a payment before anyone analyzes the audio, detection arrives as a postmortem accessory. If a fabricated executive video spreads before the company has a public authentication path, forensic confidence may come after the first narrative has already hardened. If a manipulated document helps open an account or change a payee, the weakness sits in the verification process, not merely in the document image.

FinCEN's alert on deepfake media fraud targeting financial institutions is important for that reason. It does not treat the threat as entertainment or speculation. It describes fraud schemes, red flags, and reporting obligations. The signal to boards and executives is clear: synthetic identity abuse has entered the formal risk environment.

Once that happens, the burden shifts. The question is no longer whether deepfake fraud sounds futuristic. The question is why sensitive workflows still accept spoofable identity signals as if the warnings had not arrived.

A company does not need to detect every fake to reduce deepfake risk. It needs to ensure the fake cannot be easily converted into action.

Communications Is Now a Control Function

The communications team used to arrive after the incident. That timeline no longer works. A fake executive statement can create employee panic, customer confusion, investor speculation, media attention, or counterparty hesitation before the company has completed internal alignment. A manipulated clip can force the company to prove a negative under public pressure. A fabricated apology, confession, resignation, or strategic announcement can become the first draft of reality for people who will never read the correction carefully.

In that environment, communication is not merely a messaging function. It becomes part of the control environment.

The company needs a way to authenticate truth quickly. It needs established channels that employees, investors, journalists, customers, and partners know they can trust. It needs authority to respond before the internal process turns into a meeting about who owns the meeting. It needs coordination among legal, security, finance, investor relations, HR, and leadership before a fake appears.

This is where many companies are still exposed. They may have crisis language. They may have social monitoring. They may have approval chains. What they often lack is a rapid authentication model.

A synthetic-media incident creates a vacuum. If the company does not fill that vacuum fast, the fake fills it first.

The Bank of Italy has had to warn the public repeatedly about false images, videos, and articles misusing Governor Fabio Panetta's name and image — filing a complaint with judicial authorities, telling the public that none of the content corresponded to reality, and then issuing follow-up notices as the material kept circulating. A central bank, with every institutional channel at its disposal, could not make the fakes stop. It could only make the truth findable. That is the basic shape of the problem every visible institution now faces.

You cannot improvise credibility at the exact moment credibility is under attack.

The Board Question Has Changed

Boards should stop asking whether management is aware of deepfakes. Awareness is cheap. It is also easy to perform. A board presentation can acknowledge the issue, describe the technology, mention a few public cases, and leave the operating model untouched. Everyone nods. Nothing changes.

The harder question — the one I put to leadership teams — is whether the company still lets executive identity function as an undocumented control override.

Can a senior-sounding request accelerate payment? Can a video call create enough comfort to change a vendor's bank account? Can a confidential message from a leader bypass the normal escalation process? Can an executive's public image be used in a fake investment pitch before the company notices? Can communications respond to a synthetic statement in minutes, or does it need to wait for a committee process built for a slower information environment?

Those are board questions because they concern governance, control design, crisis readiness, and foreseeable risk.

They are not limited to cybersecurity. They sit across treasury, legal, communications, compliance, investor relations, HR, procurement, and audit.

NACD's guidance is useful here because it frames deepfakes as a board-level stress-test problem rather than a narrow technology concern. EY's crisis work points in the same direction: organizations need preestablished protocols, scenario planning, and cross-functional readiness because the response window has collapsed.

A board that treats this as a technical nuisance is not reducing risk. It is misclassifying it.

Foreseeability Is Becoming Expensive

There are legal and audit consequences hidden within this shift. Deepfake fraud is moving from surprising to foreseeable. Regulators, law-enforcement agencies, financial-crime authorities, professional services firms, and governance organizations have now documented the threat in specific terms. The FBI's 2025 IC3 report broke out AI-related complaints as a separate category for the first time in the report's 25-year history: 22,364 complaints and $893 million in reported losses — a figure the FBI itself notes reflects only what victims recognized and reported. FinCEN has warned financial institutions. The FBI has warned about AI-generated voice impersonation. Deloitte has projected significant fraud-loss growth. The UK government has linked deepfake growth to concerns about fraud and impersonation.

After enough warnings, a company cannot easily claim that synthetic impersonation was unimaginable.

That does not mean every incident becomes negligence. It means the post-incident questions become more uncomfortable. Which high-risk actions depended on voice, video, email, or internal status as proof? Which exceptions were allowed under urgency? Which teams had rehearsed a synthetic-media event? Which executives had protected authentication channels? Which controls existed only in policy but not in behavior?

Audit committees should care because deepfake fraud exposes the gap between documented processes and lived processes. Legal teams should care because discovery will not be kind to organizations that knew the threat was real while leaving obvious vulnerabilities untouched. Insurers should care because claims will increasingly turn on whether the company had reasonable controls, not whether the fake was convincing.

Deepfakes do not only create loss. They create evidence of whether leadership had modernized its assumptions.

The New Operating Standard

The companies I see taking this seriously do not start with a slogan. They redesign the places where plausibility becomes action.

High-risk financial steps will no longer depend on a single channel or familiar voice. Payee changes, urgent transfers, payroll modifications, account access, credential resets, confidential data releases, and executive exceptions will require independent validation.

The validation will occur through pre-registered channels that attackers cannot control simply by joining the same call or writing from the same thread.

Executive communications will need authentication pathways. Employees should know where to confirm sensitive instructions. Investors and media should know where the company validates market-moving statements. Partners and banks should understand how the company handles unusual requests involving senior leaders. The company should be able to say, quickly and publicly, which channels are authoritative and which are not.

The rehearsal has to include the people who will actually decide under pressure.

Treasury, security, legal, communications, investor relations, HR, and executive leadership need to work through the same scenario at the same table.

A tabletop exercise that stays inside cybersecurity will miss the crisis. A communications drill without finance will miss the loss. A legal review without operational behavior will miss the moment when the company actually fails.

Most of all, leadership has to change the cultural permission structure.

Employees must be expected to verify, not merely allowed to verify. The CEO has to be willing to hear that a request cannot proceed until the control is complete. The CFO has to accept that speed is not evidence. The board has to insist that executive authority no longer functions as a shortcut around the designed process.

Trust does not disappear in this model. It becomes structured.

The Day the Fake Arrives

The worst moment to design a deepfake response is the morning a fake arrives. By then, the company is already dealing with too many clocks. Money may be moving. Employees may be forwarding messages. Journalists may be asking for confirmation. Investors may be watching. Legal may be demanding precision. Security may still be reviewing the artifact. The executive being impersonated may be traveling, unreachable, or emotionally furious that anyone believed the fake in the first place.

That is not the moment for philosophical debate about AI. That is the moment when the company discovers whether it has an operating model.

If the process is clear, the fake meets friction. Sensitive action stops. Verification moves through a separate channel. Communications authenticates the truth through known pathways. Legal and security work inside a rehearsed structure. The board receives useful information instead of theater. The company may still suffer disruption, but it is not learning the basics during the incident.

If the process is unclear, the fake becomes management's instructor.

That is the avoidable failure. The technology will keep improving. The cost of imitation will keep falling. Executive visibility will keep producing raw material. None of that requires paralysis. It requires accepting that the old trust model has expired.

The face on the screen is no longer proof. The voice on the call is no longer reassuring. The urgent request from someone important is no longer a reason to reduce friction. In a synthetic-media environment, authority has to be verified before it is obeyed.

The companies that understand this will still be attacked. They will also be harder to use.

The companies that delay will keep calling deepfake fraud sophisticated when the more embarrassing truth is simpler: they left authority ungoverned.

Every argument in this piece reduces to one question: where, exactly, can a convincing fake still make your company act?

Most leadership teams cannot answer it. Not because they haven't heard of deepfakes — because nobody has walked the workflows where authority still substitutes for verification.

That is the work I do with leadership teams. I map where executive identity can override your controls, redesign the verification points that matter, and put your organization through the incident before an attacker does.

You will eventually learn where your company is exploitable. The only open question is who runs the exercise.