The Cloned Voice at the Top: Deepfake Executive Impersonation, Authority Bias, and How Leaders Can Build a Culture of Verification
Download the article here:
Listen to a review of this article:
Abstract: Generative AI has made it cheap to clone an executive's voice or face, turning the familiar "CEO fraud" email into live calls and video meetings in which the boss appears to be present. This article argues that the central vulnerability is not technical but hierarchical. Recent survey evidence from Singapore shows that half of office workers are uncomfortable challenging a senior executive's request, and that senior managers, the group most confident in spotting fakes, are the most likely to comply with a cloned CEO voice before verifying. Drawing on research on deepfake detection, obedience, authority gradients, employee voice, and phishing training, together with documented incidents at Arup, WPP, Ferrari, LastPass, Wiz, Retool, a UK energy firm, a Singapore multinational, and the US State Department, the article identifies five evidence-based responses: leaders who license the pause, out-of-band verification protocols, payment controls that do not rely on detection, hardened identity workflows, and role-specific practice with easy reporting. It closes with three pillars for building long-term verification capability.
In January 2024, a finance employee in Arup's Hong Kong office joined a video call with people who looked and sounded like the firm's UK-based chief financial officer and several colleagues. He had been wary of the email that started the conversation, which talked about a confidential transaction. The faces on the screen settled his doubts. Over 15 transactions he sent roughly HK$200 million, about US$25.6 million, to accounts controlled by criminals. Hong Kong police later said that everyone on the call other than the employee was a fabrication (Chen & Magramo, 2024; Magramo, 2024).
The Arup case is often told as a story about astonishing technology. I think it is better told as a story about authority. The employee did not fail because he lacked skepticism. He was skeptical. What overrode his doubt was the apparent presence of senior leaders, the confidentiality of the request, and the implicit cost of questioning people who outranked him. Arup's own chief information officer later described the event not as a hack but as technology-enhanced social engineering: none of the firm's systems were breached, and people were persuaded to do something they believed was legitimate (Elliott, 2025).
New research released in October 2026 makes the authority problem hard to ignore. A KnowBe4-commissioned survey of 500 Singapore office workers, conducted by Censuswide in August 2026, found that 36% were not confident they could tell a genuine message from their CEO from an AI-generated one. More striking, 50% said they would feel uncomfortable challenging a request from a senior executive, and 52% said they would worry about the negative consequences of doing so. Forty-five percent said they would be just as worried about delaying a senior leader's request as about accidentally causing a cybersecurity incident, and 9% said they would rather risk a breach than delay the boss (KnowBe4, 2026).
Those numbers describe a workplace in which the social cost of slowing down is felt more sharply than the security cost of moving fast. That is a leadership problem. It sits squarely in the territory of culture, voice, psychological safety, and the design of decision rights, which is why HR and people leaders belong in this conversation alongside security and finance.
This article makes a practical argument. Because people detect deepfakes poorly and tend to overrate their ability to do so, organizations cannot rely on employees to spot the fake. They need a culture in which verification is expected, rewarded, and modeled from the top, and they need processes in which no single convincing voice can move money or grant access. The sections that follow define the terrain, look at consequences for organizations and people, set out five evidence-based responses with documented examples, and describe how to build verification into the long-term capability of an organization.
The Deepfake Executive Impersonation Landscape
Defining Key Terms
A deepfake is synthetic audio, video, or imagery generated or altered with machine learning so that it convincingly depicts a real person saying or doing something they did not say or do. Voice cloning is the audio branch of this family: software trained on samples of a person's speech produces new speech in that voice. The FBI has warned that criminals now use AI-generated audio to impersonate real people and use AI-generated video in real-time video chats to pose as company executives, law enforcement, or other authority figures (Federal Bureau of Investigation, 2024).
Executive impersonation is the use of a senior leader's identity, real or synthetic, to direct an employee to transfer funds, share credentials, or release confidential information. It is closely related to business email compromise (BEC), a category of fraud in which criminals impersonate executives, colleagues, or suppliers to redirect payments. Deepfakes extend BEC from text into voice and video, adding the sensory cues people instinctively use to confirm identity. FinCEN has noted that criminals have reportedly used generative AI to impersonate executives or other trusted employees and instruct victims to wire large sums to accounts the criminals control (Financial Crimes Enforcement Network, 2024).
Two behavioral concepts explain why these attacks work. Authority bias is the tendency to comply with, and give extra credibility to, instructions that appear to come from someone of higher status. Its most famous demonstration is the obedience research reported by Milgram (1963), in which many ordinary participants continued to follow an experimenter's instructions to deliver what they believed were dangerous shocks. The authority gradient is a term from aviation and medicine for the steepness of the perceived status difference between team members. When the gradient is steep, junior people may not voice concerns even when they see a problem, a pattern that has been implicated in aviation accidents and medical errors (Cosby & Croskerry, 2004).
Finally, out-of-band verification means confirming a request through a separate, independently established channel, such as calling the executive back on a number already on file rather than the number that called you, or confirming through a different platform. The FBI's guidance on impersonation of senior officials recommends exactly this kind of independent call-back (Federal Bureau of Investigation, 2025).
Prevalence, Drivers, and Distribution
The scale of impersonation fraud is large and growing. The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025 with reported losses of about $20.9 billion. Business email compromise alone accounted for 24,768 complaints and more than $3.0 billion in reported losses. For the first time the report also broke out complaints with an AI connection: 22,364 complaints and roughly $893 million in losses, including about $30.3 million in BEC losses where AI was involved. The report notes that voice cloning can be used to request wire payments and that chat generators can produce convincing messages mimicking a company's CEO (Federal Bureau of Investigation, 2026). These figures depend on victims reporting, so they are best read as a floor rather than a full count.
Forward-looking estimates point the same way. Deloitte's Center for Financial Services projected that generative AI could push fraud losses in the United States from $12.3 billion in 2023 to $40 billion by 2027, and estimated that email fraud losses enabled by generative AI could reach about $11.5 billion by 2027 under an aggressive adoption scenario (Lalchand et al., 2024). Financial regulators have noticed the same trend. FinCEN reported an increase since 2023 in suspicious activity reports describing suspected deepfake media, including its use to support BEC and executive impersonation (Financial Crimes Enforcement Network, 2024).
Three drivers explain why executive impersonation in particular is accelerating. The first is raw material. Senior leaders give keynote speeches, earnings calls, podcast interviews, and video town halls, all of which supply the audio and video that cloning tools need. When attackers targeted Wiz, they built the CEO's voice from a conference talk (Perez, 2024). When attackers targeted WPP, they combined a voice clone with publicly available YouTube footage and a WhatsApp profile using the CEO's photo (Robins-Early, 2024).
The second driver is ease. Arup's chief information officer has described trying, after the incident, to build a real-time deepfake of himself using open-source software. It took about 45 minutes. The result was not especially convincing, but the speed surprised him (Elliott, 2025).
The third driver is human. People are poor at detecting synthetic media, and they do not know it. In a preregistered experiment, Köbis et al. (2021) found that participants could not reliably distinguish deepfake videos from authentic ones, that neither raising awareness nor offering financial incentives improved accuracy, and that participants tended to mistake fakes for real videos rather than the reverse. They also overestimated their own detection ability. For audio, Mai et al. (2023) found that 529 listeners identified speech deepfakes correctly only 73% of the time, with similar results in English and Mandarin, and that exposure to examples improved performance only slightly. As synthesis improves, these numbers are unlikely to get better.
Overconfidence is not evenly distributed, and here the KnowBe4 findings are most useful for leaders. Senior managers were the most confident group, with 78% saying they could spot a fake. Yet 35% of senior managers said they would comply with a cloned CEO voice before verifying it, compared with 16% of clerical workers. Training on AI-generated scams involving senior leaders had reached only 26% of respondents and was concentrated among senior managers, and only 10% of respondents named employees trusting senior leaders too readily as their workplace's greatest cybersecurity risk (KnowBe4, 2026).
This pattern fits a broader psychological finding. People readily see bias in others while believing themselves comparatively immune, a tendency Pronin et al. (2002) called the bias blind spot. Senior managers may also be the people most accustomed to fast, informal requests from the very top, and most rewarded for being responsive to them. In that sense the confidence and the compliance come from the same place: proximity to power.
The distribution of attacks across sectors is wide. Documented incidents span engineering (Arup), advertising (WPP), automotive (Ferrari), software and security (LastPass, Wiz, Retool), energy (a UK subsidiary of a German energy group), multinational finance functions (a Singapore case), and government (an impostor posing as the US Secretary of State). Attackers have targeted finance staff, agency heads, senior executives, IT help desks, and foreign ministers. What the cases share is not an industry but a structure: a request that borrows the authority of someone senior, delivered through a channel that bypasses normal controls, framed as urgent and confidential.
Organizational and Individual Consequences
Organizational Performance Impacts
The most visible consequence is direct financial loss, and the amounts can be large. Arup's loss of about US$25 million is the most cited case (Magramo, 2024). In 2019, the chief executive of a UK-based energy firm transferred €220,000 to a supposed Hungarian supplier after a phone call from what he believed was the chief executive of the firm's German parent company. He recognized his boss's slight German accent and the melody of his voice, and the caller said the payment was urgent and should be made within the hour (Stupp, 2019). In Singapore, a finance director at a multinational transferred more than US$499,000 after a Zoom call in which the CEO and other executives were impersonated using deepfakes (Singapore Police Force, 2025).
Direct losses are only part of the cost. Arup was careful to say that its financial stability and operations were not affected and that its internal systems were not compromised (Magramo, 2024). Even so, the incident consumed leadership attention, required police investigation, and made the firm a widely discussed example. For organizations without Arup's scale, a loss of that size could be existential.
Retool's experience shows that impersonation can cause harm beyond the initial transaction. An attacker who used a deepfaked voice of a real IT staff member persuaded an employee to provide a multi-factor authentication code. That access led to the takeover of 27 cloud customer accounts, all in the cryptocurrency industry (Kodesh, 2023). The cost there was not a single payment but damage to customers who trusted the platform.
There is also a quieter performance cost: the erosion of trust in legitimate leadership communication. If employees learn that the CEO's voice on a call, or the CFO's face on a screen, may not be real, every unusual request from the top acquires a shadow of doubt. That can slow legitimate decisions. The answer is not to make verification optional so that work moves quickly, but to make verification fast, routine, and unremarkable so that it adds minutes rather than days.
Finally, there is regulatory and reputational exposure. FinCEN's alert asks financial institutions to watch for deepfake-related red flags and to reference the alert in suspicious activity reports (Financial Crimes Enforcement Network, 2024). NIST's revised digital identity guidelines add controls specifically aimed at injection attacks and forged media (National Institute of Standards and Technology, 2025). Boards and auditors will increasingly ask what controls exist for voice- and video-initiated requests, and "we trained people to listen carefully" will not be a satisfying answer.
Individual Wellbeing and Stakeholder Impacts
The people at the center of these incidents are typically conscientious employees doing what their organizations have taught them to do: respond quickly to senior leaders. When the request turns out to be fraudulent, they may face blame, investigation, and the private burden of having been the one who sent the money. The KnowBe4 data suggest many employees already sense this trap in advance. Fifty-two percent worried about the consequences of challenging a senior executive, and 45% were as worried about delaying a leader as about causing an incident (KnowBe4, 2026). Employees are, in effect, forced to choose between two kinds of personal risk.
Research on employee voice explains why that choice so often resolves toward silence. Morrison (2014) describes upward voice as a calculated act: before speaking up, employees weigh whether it will be effective and whether it will be safe. When the perceived risks to image, relationships, or career are high, people withhold. Kish-Gephart et al. (2009) show how fear at work, especially fear rooted in hierarchy, can produce automatic, self-protective silence rather than deliberate choice. Detert and Edmondson (2011) found that many employees hold taken-for-granted beliefs about when it is dangerous to speak up, such as not challenging a boss in front of others or not questioning ideas a superior owns. A request that claims to come from the CEO and to be confidential activates exactly these implicit rules.
The individual harm also extends to the executives being impersonated. Their voice, face, and reputation are used as tools against their own colleagues. WPP's chief executive, Mark Read, felt the need to email his leadership team to remind them that an account bearing his photograph was not necessarily him (Robins-Early, 2024). Senior leaders may reasonably feel violated by this, and they also carry a responsibility, discussed below, to make it easy for others to check whether a request is really theirs.
Stakeholders outside the organization are affected too. Retool's customers lost control of their accounts (Kodesh, 2023). In the impersonation of the US Secretary of State, an impostor used AI-generated voice and text messages to contact at least three foreign ministers, a US senator, and a governor. The State Department's cable warned that information shared with a third party could be exposed if the people contacted were compromised (Associated Press, 2025). When a leader's identity is weaponized, the people who trust that leader become targets.
Evidence-Based Organizational Responses
No single control will stop deepfake impersonation. The evidence points instead to a layered approach that combines leadership behavior, simple verification protocols, financial controls that work even when someone is fooled, stronger identity processes, and practice that is realistic and aimed at the people most likely to be targeted. Table 1 summarizes the five responses discussed below.
Table 1: Evidence-based responses to deepfake executive impersonation
Response | Evidence Base | Key Practices | Illustrative Examples |
Leaders who license the pause | Employee voice and psychological safety research; authority gradient work in aviation and medicine | Leaders publicly invite verification of their own requests; no penalty for delay; leaders verify too | WPP, Wiz, Ferrari |
Out-of-band verification and challenge protocols | FBI and police advisories; human detection studies | Call back on known numbers; shared-knowledge questions; channel discipline | Ferrari, LastPass, US State Department |
Payment and approval architecture | Segregation-of-duties principles; regulator and police guidance | Dual control; no exceptions for "secret" deals; cooling-off periods; bank partnerships | Arup, UK energy firm, Singapore multinational |
Hardened identity workflows | NIST SP 800-63-4; FinCEN alert; incident analyses | Phishing-resistant MFA; strict help-desk and recovery checks; human review for sensitive actions | Retool, Arup |
Role-specific practice and reporting | Phishing training field studies; workplace phishing research | Realistic voice and video simulations for executives and finance; easy reporting; sharing near misses | LastPass, Wiz, Arup |
Leaders Who License the Pause
The most important lever is also the least technical. Employees hesitate to verify a senior leader's request because they fear it will look like insubordination or incompetence. Leaders can remove that fear, but only if they do so explicitly and repeatedly.
The research base here is strong. Edmondson (1999) showed that team psychological safety, a shared belief that it is safe to take interpersonal risks, predicts learning behavior such as asking questions and raising concerns. Detert and Burris (2007) found that leader behavior, particularly managerial openness to input, shapes whether employees believe speaking up is safe and worthwhile, and that psychological safety helps explain the link. In operating rooms adopting a new cardiac surgery technology, Edmondson (2003) found that the most effective team leaders explicitly minimized concerns about power and status differences so that others would speak up. Aviation learned the same lesson through crew resource management, which trained captains and first officers to flatten the authority gradient so that junior crew members would challenge errors (Helmreich et al., 1999). Cosby and Croskerry (2004) argued that medicine needed similar deliberate methods to counter steep authority gradients.
Translated to deepfake risk, the leader's job is to make it clear that verifying a request that seems to come from them is not disrespect. It is what they want.
Effective approaches:
Explicit permission from the top: Senior leaders state, in writing and in person, that any unusual request from them involving money, credentials, or confidential data should be verified, and that they will never be offended by a call-back.
No penalty for reasonable delay: Policies and performance conversations make clear that a short delay to verify will never be treated as a failure, even when the request turns out to be real.
Leaders verify too: Executives visibly use the same call-back and approval rules for their own requests to peers and subordinates, so verification reads as a norm rather than an accusation.
Pre-commitment on channels: Leaders publish which channels they will and will not use for sensitive requests (for example, never personal messaging apps for payments).
Praise for the catch: When someone verifies and stops an attack, or verifies a legitimate request, leaders recognize it publicly.
WPP faced this test in 2024 when attackers created a WhatsApp account using Mark Read's photo, set up a Microsoft Teams meeting that appeared to include Read and another senior executive, and used a voice clone and YouTube footage to press an agency leader to set up a new business and hand over money and personal details. The attempt failed, and WPP credited the vigilance of its people. Read then wrote to leadership warning about red flags such as requests for money transfers, passports, or secret transactions, and reminding them that his photograph on an account did not mean the account was his (Robins-Early, 2024). The value of that email is not only the information. It is a chief executive telling his organization, in his own name, that doubting a message from him is legitimate.
Wiz's chief executive, Assaf Rappaport, took a similar approach in public. He explained that dozens of employees had received a voice message in his voice seeking their credentials, and that employees spotted the fake partly because the attackers had cloned his voice from a conference talk, where his public-speaking anxiety made him sound different from how he normally speaks (Perez, 2024). By sharing the story openly, he signaled that being impersonated is not embarrassing and that noticing something off about the CEO is welcome.
A common pitfall is treating leader permission as a one-time announcement. A single email does not flatten a steep authority gradient. If, in the following months, an executive snaps at someone who called back to check a request, the original message is erased. Permission has to be reinforced through repeated, consistent behavior, especially by the senior managers who, according to the KnowBe4 data, are themselves most likely to comply without checking.
Out-of-Band Verification and Challenge Protocols
If people cannot reliably detect deepfakes by eye or ear, the defense has to shift from detection to verification. The question changes from "Does this sound like the CEO?" to "Have I confirmed this through a channel the attacker does not control?"
Official guidance converges on this point. The FBI recommends verifying identity by independently finding a known phone number and calling back, treating voice messages with caution because cloned voices can sound nearly identical to real contacts, and never sending money based on an unverified request (Federal Bureau of Investigation, 2025). Its earlier warning on generative AI fraud recommends hanging up and calling a number found independently, and agreeing on a secret word or phrase to confirm identity (Federal Bureau of Investigation, 2024). Singapore police advise companies to set up procedures to verify video calls and messages, especially those claiming to come from senior executives, and to confirm urgent or unusual transfer requests directly through established channels (Singapore Police Force, 2025).
Effective approaches:
Call back on a known number: Any request involving money, credentials, or sensitive data that arrives by voice, video, or messaging app is confirmed by calling the person back on a number already held in the directory, never on the number or link supplied in the request.
Shared-knowledge challenges: Executives and their direct reports agree on simple challenge questions or code phrases, refreshed periodically, that a clone trained on public footage would not know.
Channel discipline: Sensitive requests are only valid through designated channels; a request arriving through a personal messaging app or a new account is treated as unverified by default.
Confidentiality is a trigger, not an exemption: Any request that asks the recipient to keep it secret from normal approvers automatically triggers verification.
Escalation without accusation: Employees are given neutral scripts ("I'm going to call you back on your usual line, per policy") so that verifying does not feel like a personal challenge.
Ferrari offers the clearest example of a shared-knowledge challenge working in real time. In July 2024, an executive received WhatsApp messages from a number other than chief executive Benedetto Vigna's usual line, followed by a call in a convincing imitation of Vigna's voice discussing a confidential acquisition and a currency-hedge transaction. The executive noticed slightly mechanical intonations and asked the caller for the title of a book Vigna had recommended to him a few days earlier. The call ended abruptly, and Ferrari opened an internal investigation (Lepido, 2024). The question was simple, personal, and impossible to answer from public footage.
LastPass learned in April 2024 that one of its employees had received a series of calls, texts, and at least one voicemail on WhatsApp featuring an audio deepfake of its chief executive. The employee noticed that the contact came outside normal business channels and carried signs of forced urgency, ignored the messages, and reported them to the internal security team. The company reported no impact and published an account of the attempt to help others recognize the pattern (Kosak, 2024). Channel discipline did the work here: the employee did not need to judge the voice, only to notice that the CEO was not using a channel the CEO would use.
The US State Department showed the same logic at the scale of government. After an impostor used AI-generated voice and text messages on Signal to pose as Secretary of State Marco Rubio, the department sent a cable to all embassies and consulates warning staff and foreign partners of the attempts (Associated Press, 2025). Alerting the wider network is itself a verification measure, because it tells recipients that an unexpected message in a leader's voice should be checked.
A common pitfall is relying on video as verification. Many organizations moved from "confirm by phone" to "confirm on video" during the pandemic, assuming that seeing a face is stronger proof than hearing a voice. The Arup and Singapore cases show that a video call can be the attack itself (Magramo, 2024; Singapore Police Force, 2025). Verification has to come from an independent channel the requester did not set up, not from richer media on the same channel.
Payment and Approval Architecture That Does Not Rely on Detection
Even the best-trained employee will sometimes be fooled, especially under time pressure and when the request seems to come from the top. Controls should therefore be designed so that a single person's judgment, however good, is never the last line of defense for high-value or irreversible actions.
The underlying principle is old: segregation of duties and dual control, under which no one person can both initiate and approve a payment. What is new is the need to apply these principles explicitly to requests that arrive by voice or video and claim executive authority. Deepfake attackers deliberately frame requests as confidential, urgent, and exceptional precisely so that the recipient bypasses normal approvals. FinCEN lists executive impersonation among the social engineering schemes deepfakes support and recommends layered controls such as multifactor authentication and live verification (Financial Crimes Enforcement Network, 2024).
Effective approaches:
Dual control for high-value transfers: Payments above a threshold, or to new beneficiaries, require independent approval by a second person who also verifies the request out of band.
No executive override by phone or video: Policies state that no executive, including the CEO, can authorize an exception to payment controls by voice or video alone.
Cooling-off for new or changed beneficiaries: New payees, or changes to bank details, trigger a holding period and verification before funds move.
Red-flag rules: Requests involving secrecy, unusual urgency, new jurisdictions, or a lawyer or adviser the team has never dealt with automatically require escalation.
Rapid bank contact: Finance teams have pre-arranged contacts and procedures with their banks so that suspected fraud can be reported and funds frozen within hours.
The Arup case shows what happens when an apparently senior instruction can carry a series of transfers through without independent challenge. The employee made 15 transactions, and the fraud came to light only when he later checked with head office (Chen & Magramo, 2024; Magramo, 2024). Every one of those transactions was an opportunity for an independent check that, by the public account, did not occur in time. Arup's leaders have since emphasized visibility over unusual activity and rehearsed incident response (Elliott, 2025).
The UK energy firm in 2019 is an early warning of the same pattern. The firm's chief executive, the most senior person in the subsidiary, received what sounded like his parent-company boss asking for an urgent payment within the hour (Stupp, 2019). Because the target was himself at the top of the local hierarchy, local approval rules may have offered little protection. This is one reason why controls must bind senior people too.
The Singapore multinational case shows the value of rapid escalation and bank partnerships. After a deepfake Zoom meeting on March 25, 2025, the finance director transferred more than US$499,000 the next day. When the criminals asked for another US$1.4 million on March 27, he alerted the company's bank, which notified Singapore's Anti-Scam Centre. Working with Hong Kong police, authorities froze the funds that had been moved to Hong Kong and recovered the amount (Singapore Police Force, 2025). The second request, which might have deepened the loss, became the trigger that recovered it.
A common pitfall is building controls that senior leaders routinely bypass for convenience. If the CFO regularly phones the treasury team to rush through a payment "just this once," staff learn that executive voice requests override process. That habit is exactly what a cloned voice exploits. Controls only protect the organization if leaders are seen to follow them.
Hardening Identity Workflows Against Synthetic Media
Not every impersonation attack aims at a payment. Many aim at access: a password reset, a multi-factor code, a new device registration. These attacks often target IT help desks and account-recovery processes, where staff are trained to be helpful to colleagues who sound stressed and important.
NIST's revised digital identity guidelines, finalized in 2025, add controls specifically for injection attacks and forged media such as deepfakes, and integrate newer authenticators such as synced passkeys (National Institute of Standards and Technology, 2025). FinCEN recommends phishing-resistant multifactor authentication and live verification checks, while noting that criminals may try to avoid such checks, for example by citing technical glitches and asking to switch channels (Financial Crimes Enforcement Network, 2024).
Effective approaches:
Phishing-resistant authentication: Use hardware security keys or passkeys for privileged and finance roles, so there is no one-time code that a caller can talk someone into sharing.
Strict help-desk verification: Password resets and device enrollment for executives require verification steps that cannot be satisfied by a voice on the phone alone.
Human review for sensitive actions: Changes that grant high privileges or affect customers require a second, independent approval.
Watch for channel switching: Treat requests to move to a personal phone, a new messaging app, or a fresh video link as a red flag.
Limit and monitor executive exposure: Know which leaders have large amounts of public audio and video, and give them and their assistants extra protection.
Retool learned in September 2023 how quickly a voice can undo a control. After an employee entered credentials on a fake login page, the attacker phoned, posing as IT and using a deepfake of a real staff member's voice, and talked the employee into providing another code. Because the employee's authenticator codes were synced to a cloud account, the attacker gained access to internal systems and took over 27 customer accounts. Retool concluded that codes delivered by SMS or authenticator apps remain vulnerable to social engineering, pointed to hardware security keys, and added human verification for sensitive actions (Kodesh, 2023).
Arup's experience points in the same direction from another angle. Its chief information officer noted that attacks against the firm include invoice fraud, phishing, WhatsApp voice spoofing, and deepfakes, and that their number and sophistication were rising (Magramo, 2024). An identity strategy that assumes attackers will always come by email is out of date.
A common pitfall is assuming that detection technology will solve the problem. Deepfake detection tools have a role, and FinCEN lists flags from such tools among its red-flag indicators (Financial Crimes Enforcement Network, 2024). But tools that score media for authenticity are in an arms race with the tools that generate it. The more durable protection is to remove the situations in which a convincing voice or face is enough to authorize action.
Role-Specific Practice, Reporting, and Learning from Near Misses
Training matters, but the evidence on conventional security awareness training is sobering, and leaders should design for what actually works. In a study of more than 19,500 employees at UC San Diego Health over eight months, Ho et al. (2025) found no meaningful relationship between how recently employees had completed annual awareness training and whether they fell for simulated phishing. Embedded training after a failed simulation produced only a small average improvement of about 1.7 percentage points, and most employees barely engaged with it. Interactive training performed better than static content. In a 15-month study of more than 14,000 employees, Lain et al. (2022) found that embedded training did not make employees more resilient and could even have side effects that increased susceptibility, while warnings on suspicious emails helped and crowd-sourced reporting detected new campaigns quickly and kept employees engaged.
Workplace research also suggests that the content of training should address authority directly. In a study of simulated spear-phishing emails sent to about 62,000 employees, Williams et al. (2018) found that emails using authority cues increased the likelihood of clicking. Generic training that focuses on spotting typos or odd links does little for the moment when a familiar senior voice asks for help.
Effective approaches:
Target the confident: Design simulations and workshops specifically for senior managers, executive assistants, and finance staff, the groups that both receive and are most likely to act on executive requests.
Practice the conversation, not just the recognition: Use role-play and interactive scenarios in which people rehearse saying "I'll call you back on your usual line" to someone who sounds like the CEO.
Make reporting easy and rewarded: Provide a simple way to report suspicious calls, messages, and meetings, and thank people quickly when they do.
Share near misses openly: Circulate short, blame-free accounts of attempted impersonation inside the organization so that people learn what real attacks look like.
Include executives as participants: Senior leaders take part in exercises, including ones where their own cloned voice is used, so they understand what their people face.
LastPass learned in April 2024 that its employee's decision to report, rather than simply ignore, the deepfake messages was what allowed the company to investigate, share information with partners, and publish guidance for others (Kosak, 2024). The employee's report turned a single near miss into organizational learning.
Arup's leaders chose openness after their loss. The firm's chief information officer has argued that organizations should be more transparent about attacks to raise awareness, and he has spoken publicly about the incident and about what he learned (Elliott, 2025). Wiz's chief executive did the same in a public forum (Perez, 2024). This kind of disclosure works as training for the wider business community, and it signals internally that being targeted is not shameful.
A common pitfall is concentrating training where it is easiest to deliver rather than where risk is highest. The KnowBe4 data suggest that only about a quarter of workers have had training on AI scams involving senior leaders (KnowBe4, 2026). Yet senior managers, who were more likely to have received such training, were still the most likely to comply before verifying. Training that raises confidence without changing behavior may make the problem worse. Programs should be judged by what people do in realistic scenarios, not by completion rates or self-reported confidence.
Building Long-Term Verification Capability
The five responses above can be launched as a project, but deepfake impersonation is not a one-time threat. The tools will keep improving, and attackers will keep adjusting their stories. Organizations need a lasting capability: a culture and set of routines in which verification is ordinary. Three pillars support that capability.
A request that claims senior authority meets a set of triggers, such as money, credentials, secrecy, urgency, or an unfamiliar channel. Those triggers lead to an independent call-back and, for high-value actions, a second approver, before anything irreversible happens. Leadership modeling makes the pause safe; process architecture makes it mandatory; learning keeps both current.
Leadership Modeling and Permission to Pause
The first pillar is a leadership norm, practiced visibly and repeatedly, that slowing down to verify is the expected response to an unusual request from above. This goes beyond a one-time memo. It means building verification into how senior leaders behave every day.
In practice, leaders can open quarterly town halls by reminding staff that they will never ask for urgent secret payments by phone or messaging app, and by recounting a time someone called them back to check. Executive teams can adopt verification rules for themselves, such as calling a peer back before acting on an unusual request, and talk about doing so. Performance management can reinforce the norm by treating verification as part of good judgment rather than a sign of hesitation. HR can include questions about the safety of challenging senior requests in engagement and culture surveys, and track whether the answers improve.
The aim is to flatten the authority gradient in the specific moments that matter, without flattening the organization. Aviation did not abolish captains. It taught captains to invite challenge and taught crews how to deliver it (Helmreich et al., 1999). The same is possible in business. Leaders keep their authority; they simply make clear that their authority includes the authority to be checked.
Process Architecture That Assumes Deception
The second pillar is a set of processes designed on the assumption that, sooner or later, someone will be completely convinced by a fake. If that assumption is built in, the question becomes not "Will people spot it?" but "What happens next when they do not?"
This means mapping the actions that a cloned executive voice could trigger, including wire transfers, changes to supplier bank details, password resets, data releases, and new vendor onboarding, and ensuring that each requires independent confirmation through a channel the requester does not control. It means binding senior people to the same rules, because attackers target them and impersonate them. It means agreeing on response plans with banks and law enforcement so that a suspected fraud can be escalated within hours, as the Singapore case shows (Singapore Police Force, 2025). And it means periodic review, because processes decay. Exceptions that begin as one-off conveniences become habits, and habits become the gaps that attackers find.
Good process architecture also reduces the burden on people. When the rule is clear ("all payments above this amount require a call-back and a second approver, no exceptions"), an employee who verifies does not need to decide whether the CEO might be offended. The process makes the decision for them, and the conversation becomes routine rather than personal.
Continuous Learning and Collective Sensemaking
The third pillar is an organizational habit of learning from attempts, near misses, and incidents, inside the organization and across industries. Because attacker techniques evolve quickly, playbooks written today will be partly obsolete within a year.
Concretely, this means running regular, realistic exercises that use voice and video, with senior leaders and finance teams as participants rather than spectators. It means maintaining easy reporting channels, which Lain et al. (2022) found can detect new campaigns rapidly and keep employees engaged over long periods. It means circulating brief, blame-free accounts of near misses so that people see what real attempts look like. And it means joining industry information-sharing groups, as LastPass did after its incident (Kosak, 2024).
Collective sensemaking also requires measuring the right things. Training completion and self-rated confidence are weak indicators, as the KnowBe4 findings on senior managers make clear (KnowBe4, 2026). Better indicators include the proportion of simulated executive requests that are verified before action, the time taken to report a suspicious contact, and whether employees say they feel safe challenging senior requests. These measures connect security outcomes to the cultural conditions that produce them.
Conclusion
Deepfake executive impersonation is often presented as a technology story, but the evidence points to an older and more human vulnerability: the reluctance to question the people at the top. Employees cannot reliably detect cloned voices and faces, and they tend to overestimate their ability to do so. Many are uncomfortable challenging senior leaders, worry about the consequences of delay, and in some cases would rather risk a breach than slow the boss down. Senior managers, often the most confident and the most rewarded for responsiveness, may be the most exposed. The response, therefore, has to be led by leaders. It requires executives who make verification safe and expected, protocols that shift the question from "Does it sound real?" to "Have we confirmed it independently?", controls that hold even when someone is fooled, hardened identity processes, and practice that targets the people and moments that matter most. Organizations that build these habits will not stop every attempt, but they can make sure that no single convincing voice can move their money or open their systems.
Make verification a leadership message: Senior leaders should state repeatedly that any unusual request from them involving money, credentials, or confidential data should be verified, and they should thank people who check.
Verify through a channel the requester did not create: Call back on known numbers, use pre-agreed challenge questions, and treat video calls and messaging apps as channels to be verified, not proof of identity.
Design controls that assume someone will be fooled: Require dual approval and out-of-band confirmation for high-value or irreversible actions, with no executive overrides by voice or video.
Treat secrecy and urgency as triggers: Any request that asks to bypass normal approvers, or to move fast and quietly, should automatically trigger escalation.
Harden identity workflows: Adopt phishing-resistant authentication for sensitive roles and tighten help-desk and recovery procedures.
Train the confident, not just the compliant: Focus realistic, interactive practice on senior managers, executive assistants, and finance staff, and measure behavior rather than completion.
Normalize reporting and learning: Make reporting easy and blame-free, share near misses, and treat every attempt as data for improving the system.
Research Infographic
References
Associated Press. (2025, July 9). Impostor uses AI to impersonate Rubio and contact foreign and U.S. officials. Michigan Public.
Chen, H., & Magramo, K. (2024, February 4). Finance worker pays out $25 million after video call with deepfake "chief financial officer." CNN.
Cosby, K. S., & Croskerry, P. (2004). Profiles in patient safety: Authority gradients in medical error. Academic Emergency Medicine, 11(12), 1341–1345.
Detert, J. R., & Burris, E. R. (2007). Leadership behavior and employee voice: Is the door really open? Academy of Management Journal, 50(4), 869–884.
Detert, J. R., & Edmondson, A. C. (2011). Implicit voice theories: Taken-for-granted rules of self-censorship at work. Academy of Management Journal, 54(3), 461–488.
Edmondson, A. (1999). Psychological safety and learning behavior in work teams. Administrative Science Quarterly, 44(2), 350–383.
Edmondson, A. C. (2003). Speaking up in the operating room: How team leaders promote learning in interdisciplinary action teams. Journal of Management Studies, 40(6), 1419–1452.
Elliott, D. (2025, February 4). "This happens more frequently than people realize": Arup chief on the lessons learned from a $25m deepfake crime. World Economic Forum.
Federal Bureau of Investigation. (2024). Criminals use generative artificial intelligence to facilitate financial fraud (Public Service Announcement I-120324-PSA). Internet Crime Complaint Center.
Federal Bureau of Investigation. (2025). Senior US officials impersonated in malicious messaging campaign (Public Service Announcement I-051525-PSA). Internet Crime Complaint Center.
Federal Bureau of Investigation. (2026). Internet crime report 2025. Internet Crime Complaint Center.
Financial Crimes Enforcement Network. (2024). FinCEN alert on fraud schemes involving deepfake media targeting financial institutions (FIN-2024-Alert004). U.S. Department of the Treasury.
Helmreich, R. L., Merritt, A. C., & Wilhelm, J. A. (1999). The evolution of crew resource management training in commercial aviation. The International Journal of Aviation Psychology, 9(1), 19–32.
Ho, G., Mirian, A., Luo, E., Tong, K., Lee, E., Liu, L., Longhurst, C. A., Dameff, C., Savage, S., & Voelker, G. M. (2025). Understanding the efficacy of phishing training in practice. In 2025 IEEE Symposium on Security and Privacy (SP) (pp. 37–54). IEEE.
Kish-Gephart, J. J., Detert, J. R., Treviño, L. K., & Edmondson, A. C. (2009). Silenced by fear: The nature, sources, and consequences of fear at work. Research in Organizational Behavior, 29, 163–193.
KnowBe4. (2026, October 12). KnowBe4 research reveals senior managers in Singapore are twice as likely to comply with an AI-cloned CEO voice [Press release]. Business Wire.
Köbis, N. C., Doležalová, B., & Soraperra, I. (2021). Fooled twice: People cannot detect deepfakes but think they can. iScience, 24(11), Article 103364.
Kodesh, S. (2023, September 13). When MFA isn't actually MFA. Retool Blog.
Kosak, M. (2024, April 10). Attempted audio deepfake call targets LastPass employee. LastPass Blog.
Lain, D., Kostiainen, K., & Čapkun, S. (2022). Phishing in organizations: Findings from a large-scale and long-term study. In 2022 IEEE Symposium on Security and Privacy (SP) (pp. 842–859). IEEE.
Lalchand, S., Srinivas, V., Maggiore, B., & Henderson, J. (2024, May 29). Generative AI is expected to magnify the risk of deepfakes and other fraud in banking. Deloitte Insights.
Lepido, D. (2024, July 27). Ferrari exec foils deepfake attempt by asking the scammer a question only CEO Benedetto Vigna could answer. Fortune.
Magramo, K. (2024, May 16). British engineering giant Arup revealed as $25 million deepfake scam victim. CNN.
Mai, K. T., Bray, S., Davies, T., & Griffin, L. D. (2023). Warning: Humans cannot reliably detect speech deepfakes. PLOS ONE, 18(8), Article e0285333.
Milgram, S. (1963). Behavioral study of obedience. The Journal of Abnormal and Social Psychology, 67(4), 371–378.
Morrison, E. W. (2014). Employee voice and silence. Annual Review of Organizational Psychology and Organizational Behavior, 1, 173–197.
National Institute of Standards and Technology. (2025). Digital identity guidelines (NIST Special Publication 800-63-4). U.S. Department of Commerce.
Perez, S. (2024, October 28). Wiz CEO says company was targeted with deepfake attack that used his voice. TechCrunch.
Pronin, E., Lin, D. Y., & Ross, L. (2002). The bias blind spot: Perceptions of bias in self versus others. Personality and Social Psychology Bulletin, 28(3), 369–381.
Robins-Early, N. (2024, May 10). CEO of world's biggest ad firm targeted by deepfake scam. The Guardian.
Singapore Police Force. (2025, April 7). Singapore and Hong Kong Police Force recover over $670,000 in a digital impersonation scam [News release].
Stupp, C. (2019, August 30). Fraudsters used AI to mimic CEO's voice in unusual cybercrime case. The Wall Street Journal.
Williams, E. J., Hinds, J., & Joinson, A. N. (2018). Exploring susceptibility to phishing in the workplace. International Journal of Human-Computer Studies, 120, 1–13.
Jonathan H. Westover, PhD, Chief Research Officer (Nexus Institute for Work and AI); Co-Founder & Chief Workforce and Learning Officer (Future State University); Founder & CEO (Human Capital Innovations); Professor of Organizational Leadership & Change (UVU). Read Jonathan Westover's executive profile here.
Suggested Citation: Westover, J. H. (2026). The Cloned Voice at the Top: Deepfake Executive Impersonation, Authority Bias, and How Leaders Can Build a Culture of Verification. Human Capital Leadership Review, 40(1). doi.org/10.70175/hclreview.2020.40.1.7
