A video call. A fake CFO. $25.6 million gone.

When engineering giant Arup lost HK$200 million ($25.6 million) to a deepfake scam, the finance community took notice. An employee in the firm’s Hong Kong office joined a video call populated entirely by digitally cloned avatars of the company’s UK-based chief financial officer and other senior board members. Based on direct instructions given during the meeting, the employee executed 15 individual transactions across multiple accounts before anyone realized the error.

The incident was not a standard cybersecurity breach. Network perimeters were not compromised, credentials were not stolen, and firewalls functioned as designed. The attackers bypassed technical security entirely by exploiting a fundamental flaw in enterprise governance: the reliance on human-to-human recognition as an authorization layer for treasury operations.

For CFOs managing international enterprise operations, this event marks a structural shift in operational risk. Generative AI tools have effectively democratized real-time voice synthesis and video replication, rendering traditional executive verification methods obsolete. Protecting enterprise value now requires restructuring internal controls to remove visual and vocal trust from the payment authorization chain.

The Breakdown of Visual and Vocal Verification

Historically, Business Email Compromise (BEC) relied on domain spoofing, compromised credentials, or high-pressure written communications. Security teams managed these risks by training staff to spot grammatical inconsistencies, verify sending addresses, or request verbal sign-off from management before releasing funds.

Generative AI eliminates the friction inherent in social engineering. Malicious actors no longer need to compromise an email account to build credibility; they can synthesize an executive’s likeness and voice using public conference recordings, earning calls, and media appearances.

The operational risk is further amplified by remote work environments and cross-border management structures. When a finance manager in a regional office receives a direct command from a parent company executive via video, organizational hierarchy discourages skepticism.

Restructuring Treasury Governance

Safeguarding balance sheet integrity against AI-driven fraud requires treating all manual payment requests as inherently untrusted, regardless of the channel through which they arrive. Finance leaders must replace human recognition with cryptographic security protocols embedded directly into enterprise software.

1. Cryptographic Challenge Protocols over Verbal Approval

Visual presence during a video conference or voice recognition on a phone call can no longer serve as an authorization trigger. Any out-of-cycle, high-value, or unusual disbursement request must require out-of-band cryptographic authentication.

• Token-Based Approvals: High-value payment releases must require time-based one-time passwords (TOTP) generated via enterprise multi-factor authentication (MFA) applications rather than verbal confirmation.

• Shared Enterprise Secrets: Manual payment overrides must require pre-shared cryptographic keys managed within isolated corporate access systems, ensuring authority is validated by digital encryption instead of human identity.

  Whitepaper

  AP The importance of UX in accounts payable: Often overlooked, always essential

  AP The power of customisation in accounting systems

  AP 8 Key metrics to measure to optimise accounts payable efficiency

  Banking Spend reporting wastes time - it does not have to be this way

2. Hard-Coded Segregation of Duties (SoD)

The single greatest operational vulnerability in social engineering schemes is an employee’s ability to bypass standard internal controls under perceived executive pressure. Modern Enterprise Resource Planning (ERP) systems, such as SAP S/4HANA or Oracle Fusion Cloud must enforce strict Segregation of Duties (SoD) with absolute administrative rules.

• Strict Role Separation: System permissions must strictly prevent the individual who modifies vendor master files or bank account details from approving disbursements to those accounts.

• Mandatory Hold Times: ERP systems must automatically enforce time-locks (such as a 24-to-48-hour delay) on out-of-pattern wire transfers, granting risk management and internal audit teams clear visibility before funds clear clearinghouse networks.

3. Real-Time Anomaly Detection in Accounts Payable

Legacy accounts payable controls rely on retrospective auditing or fixed threshold flags. Real-time anomaly detection models evaluate transactions prior to execution by continuously scoring behavioral and operational risk factors.

• Payment Velocity and Clustering: Systems must flag unusual transactional patterns, such as the rapid succession of 15 wire transfers seen in the Arup breach.

• Metadata and Geographic Drift: Monitoring tools must automatically analyze changes in beneficiary account locations, newly created supplier domains, and modifications to routing data made shortly before payment requests.

Strategic Action Items for Finance Executives

CFOs must lead the update of internal control frameworks to defend against synthetic identity threats. Recommended executive actions include:

1. Eliminate Executive Overrides: Formally establish enterprise policy stating that no executive, including the CEO or CFO possesses the authority to order manual wire transfers outside standard ERP authorization flows.

2. Automate Vendor Verification: Implement direct API integrations that validate bank account ownership against primary banking records before updating payment details in vendor master files.

3. Update Enterprise Risk Assessments: Incorporate synthetic media risks into formal Enterprise Risk Management (ERM) frameworks, quantifying the maximum potential loss exposure from automated payment manipulation.

4. Expand Security Testing: Advance internal phishing testing beyond standard email assessments to include simulated, AI-generated voice and video scenarios targeting treasury and finance staff.

By shifting from human trust models to cryptographically enforced controls, finance organizations can ensure their treasury operations remain resilient against synthetic fraud schemes.

Comments are closed.