"How should we protect our processes so as not to pay someone who impersonates one of our executives with a fake voice or video?" For finance and procurement teams, this question is now on the agenda not as a theoretical risk but as a concrete need for controls. One of the five actions that Gartner published on 30 September 2026 and recommends security leaders take by the end of the year is devoted directly to this topic: according to Gartner, deepfake threats are now mainstream. The core of the recommendation is clear, too: organization-wide processes should be redesigned so that recognizing a person is no longer an acceptable basis for approving a decision or a transaction.
In this article, we lay out the scale of the threat using official sources, examine a case on the public record, and review the controls that can be applied in payment and approval processes.
How widespread is the threat?
In the Global Cybersecurity Outlook 2026 survey that the World Economic Forum published in January 2026, 73% of respondents reported that they or someone in their circle had been affected by cyber-enabled fraud during 2025. According to the same report, CEOs rank cyber-enabled fraud as the top concern for their organizations.
The 2025 annual report of IC3, the internet crime complaint center of the U.S. Federal Bureau of Investigation (FBI), puts numbers on one of the costliest risks on the corporate side. In frauds classified as business email compromise (BEC), 24,768 complaints and roughly $3.05 billion in losses were reported in 2025; the corresponding loss in 2024 was roughly $2.77 billion. The report's definition is also noteworthy: BEC is carried out not only by email but also by exploiting communication channels such as phone numbers and virtual meeting applications.
The AI dimension is also tracked separately. IC3 states that in 2025 it received 22,364 complaints containing information related to artificial intelligence, and that the adjusted loss in those complaints exceeded $893 million. Under the BEC heading, where the report gives examples such as emails impersonating a CEO produced with chatbots and payment requests made through voice cloning, businesses appear to have reported losses of more than $30 million in cases involving AI. The picture in Europe is similar: Europol's IOCTA 2026 report finds that generative AI increases the realism of BEC and CEO fraud.
A case: the video meeting where everyone was fake
A written reply that the Hong Kong government gave to the Legislative Council on 26 June 2024 describes, in an official record, how this type of attack works. In the incident reported to the police at the end of January 2024, an employee received a phishing email impersonating the head office's chief financial officer and was invited to a group video meeting about transactions said to be confidential. Following the instructions, the employee authorized transfers to five local bank accounts, and a loss of approximately HK$200 million resulted.
In the police's assessment, the meeting was pre-recorded content produced from the impersonated executive's publicly available video and audio recordings on the internet; in other words, there was no real interaction between the employee and the fraudster. The meeting was ended on a pretext, and the payment instructions continued over instant messaging. The same reply also covers a second incident from May 2024: an employee joined a video meeting of about 30 minutes with an "executive" who had reached out through a messaging app, and was asked to transfer approximately HK$4 million.
The pattern in the case is instructive from a process-design standpoint: an emphasis on secrecy, urgency, an unexpected channel, and a familiar face and voice. Each of the controls needs to be built to neutralize these four elements.
Why is "recognizing" no longer enough?
In its warning dated December 2024, the FBI reports that criminals use AI to generate video for real-time video chats with people who appear to be company executives. In its more recent warning dated July 2026, it stresses that AI-generated content has reached a level at which it is often difficult to distinguish.
For this reason, expecting employees to "spot the fake by eye" is not a control on its own. Gartner, too, recommends a multilayered approach that backs detection technology with contextual signals, additional identity-verification layers and content-provenance checks. In other words, trust should rest not on a person's voice or face but on the process itself.
A checklist for payment and approval processes
The steps below are a general framework derived from the warnings and recommendations in the sources; each organization needs to adapt it to its own authorization matrix, banking infrastructure and risk appetite.
- Set a call-back rule using a registered number. Whatever channel a payment or sensitive-information request arrives through, hang up and contact the person on a number registered in advance. The FBI recommends verifying a caller's identity by ending the call and finding the number independently. A number or link provided in the request should never serve as a means of verification.
- Make dual approval mandatory. For payments above a certain threshold, the person who gives the instruction and the person who approves should be different people; the approval should be recorded in the payment system's own workflow. A video call, voice message or email alone should not count as approval.
- Manage payment-detail changes as a separate process. No change to a supplier's or payee's account details should be entered into the system without being confirmed through the contact details in the master record; the first payment after a change should go through an additional check.
- Treat a change of channel as a red flag. If someone familiar reaches out from a new number or platform, the FBI recommends confirming this new contact information through a previously verified channel. A move from a meeting to messaging, as in the case above, should be handled under the same rule.
- Meet pressure for secrecy and urgency with process. Phrases such as "don't tell anyone" or "it has to be done today" should not be grounds for an exception but triggers for an additional check. The FBI likewise recommends critically assessing the plausibility of a request and its context. Senior management stating openly that it will follow this rule itself makes it easier for employees to say "no".
- Establish internal verification phrases. For critical roles, a pre-agreed question or phrase that is not shared over digital channels provides an additional layer. The secret-word method that the FBI recommends for families can be adapted to a corporate context; even so, this method should not replace the call-back.
- Write the incident-time plan in advance. IC3 says that time is critical once a fraudulent transfer is noticed and recommends asking the bank for an immediate recall. Through IC3's fund-freezing process, roughly $679 million was frozen across 3,900 incidents in 2025; the success rate was 58%. The bank's emergency contact line, the internal notification chain and the steps for preserving records should be defined beforehand. We covered the general response and notification dimensions of cyber incidents in our article on incident response in the Cybersecurity Law (Siber Güvenlik Kanunu) era.
- Train through drills. Run regular drills, using realistic scenarios, with teams that are most likely to be targeted, such as finance, procurement and executive assistants. The aim is not to teach people to spot the fake but to make the way the process works at a moment of suspicion second nature.
Conclusion
Official data show that fraud based on executive impersonation is both becoming more widespread and becoming more convincing with AI. Documented cases, in turn, show that the attack most often exploits not a technical gap but trust in a "familiar" request. For this reason, the most effective defense is to trust not in recognizing the person but in the process itself: call-back, dual approval and change controls.
From Orient Global's perspective, the starting point is to identify, one by one, the steps in existing payment and approval flows that "move forward by relying on a single person's voice or face", and to add independent verification to those steps.
Why logistics experience matters here. In a business that moves goods, urgency is part of daily life (a truck at the gate, a shipment waiting to be released), so a "pay today" request can sound routine. That is why the check has to sit in the process rather than in anyone's judgment of a voice or a face. Purchase orders and goods receipts originate inside the operation, not with whoever is asking for the payment, which makes them a natural anchor for the controls above: a payment request, or a change to a payee's bank details, should be checked against what was actually ordered, received and shipped. One of our consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end-to-end, building and leading teams of 100+ people and delivering lasting gains through KPI-driven programs. He has also managed nationwide warehouse and transport operations and large-scale distribution networks. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
#interimmanagement #forwarddeployedengineering