Fraud in the Age of AI: Deepfakes, Synthetic Identities and What CFOs Should Do
Anslem Oshionebo, Certified Fraud Examiner, on deepfake payment scams, synthetic identities and the controls CFOs should put in place now.
Fraud has always followed technology. Generative AI has simply lowered the cost of a convincing lie. Deloitte has projected that fraud losses enabled by generative AI in the United States could rise from about $12 billion in 2023 to $40 billion by 2027. As a Certified Fraud Examiner, I see the same pattern in Nigeria, the United States and every market in between: the attacks are more polished, faster and aimed at the people who can move money.
The new playbook
Deepfake executives. A cloned voice on a phone call, or a convincing video call, instructs a finance officer to make an urgent, confidential payment. Staff who would question an email trust a familiar face and voice.
Synthetic identities. Fraudsters combine real and invented data, plus AI-generated photos and documents, to open accounts, borrow and disappear. Because there is no real victim to complain, the losses surface late, often as bad debt.
Polished phishing and invoice fraud. Business email compromise no longer has spelling mistakes. AI writes in the supplier's tone and inserts new bank details at the right moment.
Controls that still work
- Call-back verification on any change to supplier bank details, using a number already on file, never one supplied in the request.
- Dual authorisation for payments above a threshold, with no exceptions for urgency or seniority.
- Code words or out-of-band confirmation for instructions from executives.
- Stronger onboarding with liveness checks, document verification and data consistency tests to stop synthetic identities.
- Continuous monitoring of transactions and journal entries, so anomalies are caught in days, not at year end.
Culture is a control
The most effective defence is an organisation where a junior employee feels safe saying "I will call you back to confirm" to the CEO. Train for it, reward it and model it from the top.
A real-world pattern
A finance officer receives a video call invitation from what appears to be the chief financial officer, with several familiar colleagues on screen. The CFO explains that a confidential acquisition requires urgent transfers. Everyone on the call looks and sounds right. The officer makes several payments. Days later, the company discovers that every participant on the call was generated by AI. Cases like this have been reported publicly, with losses running into millions of dollars.
The lesson is not that staff were careless. It is that verification cannot depend on recognising a face or voice any more.
A 30-day action plan for CFOs
- Week 1: map every way money can leave the business: payments, supplier changes, payroll changes, refunds and card spending.
- Week 2: set verification rules for each path, including call-backs to known numbers, dual approval thresholds and cooling-off periods for new payees.
- Week 3: train finance, procurement, HR and executive assistants with realistic examples, including deepfake audio.
- Week 4: test the controls with a simulated attack, then fix the gaps you find.
Insurance, reporting and recovery
Review whether your crime and cyber insurance policies cover social engineering fraud, and what conditions apply. Agree in advance who calls the bank, who preserves evidence and who notifies insurers and law enforcement. When an incident happens, those first hours are too valuable to spend deciding who does what.
When prevention fails
Speed decides recovery. Notify the bank immediately to attempt a recall, preserve evidence, report to the authorities and engage specialists who can trace where the money went. At Tenaza, tracing funds across borders is our daily work, and the first 48 hours are almost always the most valuable.
Common questions
What is a deepfake fraud?
A deepfake fraud uses AI-generated audio or video to impersonate a trusted person, often an executive, to persuade staff to transfer money or share information.
How can companies prevent deepfake payment fraud?
Use controls that do not rely on recognising a person: call-backs to known numbers, dual approval, code words and cooling-off periods for new or changed payees.
What should I do if my company is defrauded?
Contact your bank immediately to request a recall, preserve evidence, notify insurers and law enforcement, and engage asset tracing specialists quickly.