CEO Fraud: When Even Your Own Voice Can No Longer Be Distinguished from the Real Thing
It looks real. It sounds real. And it feels real. But what if none of that turns out to be true? It’s pretty terrifying how employees are confronted with fraud every day without even realizing it. It happens in both our personal and professional lives. It happened to us, too, and your company could easily be the next victim.
Looking just real enough
Two examples that could very well be real: You’re in the middle of a busy workday when you receive a WhatsApp message from your CEO. “Can you transfer 10,000 euros right away? It needs to be taken care of today.” The profile picture matches, the tone is just like you’d expect, and the urgency—well, that’s typical of him too. Still, something doesn’t sit right. Because why via WhatsApp, and why through you?
Or imagine you’re participating in a short video conference with a manager you can’t see: “The connection is poor, so I turned off the camera.” The voice sounds convincing, the instructions are clear, and time is of the essence. You take action—after all, why would you doubt someone whose voice you recognize? It’s only later that you realize the voice had been cloned.
CEO Fraud
This sophisticated form of fraud is no longer a theoretical risk—it’s an everyday reality. It’s no longer just about suspicious emails or poorly written messages. Criminals imitate people down to the smallest details: their profile picture, writing style, tone of voice, and even the way they text. They use information from LinkedIn, websites, or news articles to construct believable scenarios. Unfortunately, AI is used “all too often” by criminals to mislead people.
CEO Attack
This recently happened to Jo Van Onsem, CEO of OneXillium, as well. On his personal LinkedIn profile, he shared how someone impersonated him on WhatsApp—complete with a photo and his name—and tried to convince colleagues to buy Apple gift cards. “It sounds simple, and it is,” he wrote. But he also added: “No CEO would ever ask anyone via WhatsApp to make a purchase, transfer money, or arrange for gift cards.” Fortunately, we were smarter in this case, and here’s why:
Trust is something you have to actively confirm
What can you do if a fake message—or even your own CEO’s voice—seems trustworthy? It starts with common sense. But is that enough? In this digital age, trust is something you have to actively confirm. Whenever a request comes in—whether via email, chat, or phone—you can require that it always be followed by a second check. Not through the same channel, but through another trusted method: call your manager’s known number, pop into their office, ask a colleague to verify, or agree on a secret code word in advance. It’s important to determine in advance the types of requests that require employees to be extra vigilant. Think of it as the human version of multi-factor authentication.
Establish clear guidelines
As an organization, it helps to establish clear guidelines. For example, if it has been agreed that no one is ever allowed to request a payment or gift card via WhatsApp or email, there will be no debate if a suspicious message is received. If you’re still unsure, it’s important to foster a culture where you feel comfortable asking for clarification and know the proper channels to do so—even if the message ultimately turns out to be legitimate. Colleagues need to understand what constitutes “unusual” behavior. Make that policy visible, reiterate it regularly, and ensure it becomes part of the culture. This creates a sense of calm, even during hectic moments.
Are you sufficiently prepared?
The situation is urgent. Whereas we used to be able to laugh off poorly forged emails full of spelling mistakes, we are now facing attacks that are incredibly realistic. The line between real and fake is blurring at lightning speed. Cybercriminals aren’t just stealing names—they’re stealing faces, voices, and entire identities. The question isn’t if, but when they’ll try to target your organization.
At OneXillium, we know from experience just how real this threat is and how important it is for your colleagues to respond appropriately. They are your last line of defense if it turns out that the technical measures have been bypassed! That’s precisely why we help organizations secure their digital processes through technology, policies, and awareness—so that everyone knows what to do when it counts.
When it comes to CEO fraud, it’s not enough to just be smart; the ones who make a difference are those who act smart and are well-prepared. And that starts today and never ends.