To verify a request from your CEO, contact them yourself through a channel you already trust, such as a number from the company directory, and follow your organization's normal approval steps. Don't use the phone number, link or meeting invite that came with the request. This works whether the request arrives by email, text, phone or video, and it doesn't depend on judging whether a voice or face is real.
That matters because people aren't reliable deepfake detectors. In a 2025 online test by the biometrics company iProov, only 0.1% of 2,000 participants in the US and UK correctly identified every real and AI-generated image and video, even though they knew what they were looking for. A check you start yourself doesn't rely on anyone's eyes or ears.
Verification isn't only an individual responsibility. Employees need clear procedures, and leaders need to make questioning an unusual request welcome, whoever appears to be asking. This guide covers both: what any employee can do in the moment, and what security, finance and IT leaders can put in place.
A request from the CEO combines authority with urgency, and that combination shortens the time people take to think. Attackers know employees tend to act quickly on what a senior leader asks.
In Sweden, the biggest individual losses in this kind of fraud are growing. In the Swedish Police Authority's 2025 report on fraud proceeds, CEO and business email compromise (BEC) fraud cases where one victim lost more than 1 million kronor added up to 161 million kronor, up from 34 million in 2024 and 19 million in 2023. Reported attempts in the category fell over the same year.
AI makes impersonation cheaper. Most executives have hours of voice and video online from interviews, webinars and conference talks. In April 2026, Finland's National Cyber Security Centre at Traficom warned of fraud using video calls where a CEO's face and voice were faked. It noted that criminals refer to urgent deals, ask victims to sign confidentiality agreements and sometimes blame a poor connection to move the conversation to text.
In several public cases, attackers combined channels: a WhatsApp message from an account using the CEO's photo, then a voice call or a Teams meeting with a cloned voice, often framed around a confidential deal the employee mustn't discuss. Each step makes the next feel more legitimate, and the request for secrecy cuts the employee off from the colleagues who could have checked it.
Sometimes the clearest warning sign is something only a colleague would notice. In this episode of Stronger Together, Marcus Örvén, head of customer success and support at Nimblr, tells the story of a customer’s phishing simulation that impersonated their CEO and reached every inbox in the company. One employee saw through it in about four seconds because of a single line at the bottom of the email, the kind most of us read straight past. No email filter could have caught it, since it depended on knowing the CEO himself. Watch the video tofind out what she spotted and how her observation made her whole organization a little harder to fool within a week.
A deepfake call won't announce itself. As Martin Karlqvist, behavioral specialist at Nimblr, puts it: "It just looks like Tuesday." The warning sign is often in what you're being asked to do, not in the voice, face or message.
Watch for these signs in the request:
Any one of these is a reason to pause, whatever the message looks or sounds like.
The strongest check is one you start yourself, through a contact you already have, combined with the approval steps your organization already uses.
Some checks feel safe but aren't enough on their own. Asking a personal question can expose an impersonator, but an attacker may know or guess the answer. Confirming the amount or recipient only checks the details of the request, not who is asking. And a call that seems to come from the right number proves nothing, because caller ID can be faked.
Arup shows why the channel matters. In 2024, a finance employee there doubted an email from the CFO and asked to check. The fraudsters set up a video call with deepfaked colleagues, the check ran through their meeting, and the employee made 15 transfers.
Confirm payment changes by calling back. New payees, changed bank details and urgent transfers are confirmed through a contact already on file, never one given in the request.
Split who asks and who approves. The person who requests a payment doesn't approve it. FBI fraud investigators also recommend one named person who can stop any payment before money leaves, and who never requests or approves payments themselves.
Verify identity before resetting access. The service desk follows an established identity check before approving MFA resets or password changes. A callback to the number on file can be part of it, but shouldn't be the only safeguard, since an attacker may have changed that number.
Tell employees how leaders make requests. When people know which channels leaders use, a request through any other channel stands out. That's how Wiz employees recognized the fake voice messages.
Thank people who check. Say thank you for every report, even when the request turns out to be real.
Employees need to verify, and leaders need to make verification welcome. When a request seems to come from a senior leader, questioning it can feel like questioning the person. A CEO who says openly that checking a request is never questioning their authority removes that pressure.
Employees can only verify if the organization's routines make it easy. A few practices help most:
Practice the routine before you need it, for example by walking finance, the service desk and executive assistants through a made-up CEO request.
Norway's DNB is a good example. In January 2025, criminals targeted the bank's offices in Singapore and London with a live deepfake Teams meeting impersonating its CFO and CEO. The bank's verification routine caught it.
A short written rule helps everyone act the same way:
Our callback rule. If a request involves a payment, a change of bank details, an MFA reset, remote access or confidential information, we confirm it through a contact we already have before acting. This applies to requests from anyone, including the CEO and the board. Nobody will ever be criticized for making a verification call, and everyone who reports a suspicious request is thanked. Payments above [amount] also need approval from [named role], who can stop any payment and never requests, approves or makes payments themselves.
Act within minutes. Contact your bank right away and ask them to try to stop or recall the transfer, since the chance of getting money back drops quickly once it moves on. Then report it to the police, tell your IT or security team and keep every message, call log and meeting invite as evidence.
If you shared a password, approved an MFA request or gave someone remote access, contact your IT or security team immediately so they can secure the affected accounts and devices.
Warn colleagues as well. After the attempt on WPP, the CEO wrote to employees describing how it worked so others would recognize it. Treat the person who was deceived as someone who helps you learn from the incident. That response is what makes the next person willing to report quickly.
Knowing what to do is one thing. Remembering to do it when a convincing voice is asking you to act now is another. That's why training needs to go beyond explaining threats and give employees practice making safer decisions.
Nimblr's phishing simulations are built on real attack data, including lures from our own honeypot network. When someone clicks a simulated attack, Instant Learning gives them immediate feedback and a short lesson in that moment. Micro Training keeps lessons under five minutes, in more than 30 languages. Phishing simulations
Every employee receives our Deepfakes course, and Role-Based Learning adds deeper courses for the roles attackers single out, including Deepfake Voice and Video Fraud for executives and Phone Fraud Targeting Finance for finance teams. Instant Learning
Help your employees turn awareness into action. See how Nimblr combines short, relevant training with realistic simulations and immediate feedback to build safer security habits. Book a 30-minute demo.