---
title: "Deepfake CFO Fraud: The Payment Controls Every Company Needs Now | Capstone CFO"
description: Fraudsters now fake executives' voices and video to request payments. The payment controls every growing company should have in place to stop them.
---

[Insights | Capstone CFO](https://capstonecfo.com/blog)

# [Deepfake CFO Fraud: The Payment Controls Every Company Needs Now | Capstone CFO](https://capstonecfo.com/blog/deepfake-cfo-fraud-payment-controls)

 Written by [Capstone CFO](https://capstonecfo.com/blog/author/capstone-cfo) | Oct 15, 2026, 11:15:47 AM

**Short answer:** assume any request to move money could be fake, no matter how real the voice, video or email looks. Protect your company with a few firm controls: verify every new payment request and bank-detail change through a separate, known channel; require two approvals for payments above a set amount; never let urgency override process; and train everyone who touches payments.

## Why this is urgent

AI tools can now imitate a person's voice and face convincingly. In one widely reported 2024 case, an employee at the engineering firm Arup transferred about $25 million after a video call in which the "CFO" and other colleagues were deepfakes. Cybersecurity is already one of the top risks cited by middle-market leaders, and smaller companies, with fewer people and less formal controls, are attractive targets.

## How these scams usually work

- An urgent request from the "CEO" or "CFO" to pay a new vendor or close a confidential deal
- A "supplier" asking to update bank details before the next payment
- A video or voice call that seems to confirm the request
- Pressure to skip normal steps because of time or secrecy

## Controls every company should have

1. **Call-back verification:** confirm any new payee or bank change by calling a number already on file, never one provided in the request.
2. **Dual approval:** require two people to approve payments above a set threshold and all first-time payments.
3. **Locked vendor master:** limit who can change vendor bank details, and log every change.
4. **No exceptions for urgency:** make it clear that executives will never ask anyone to bypass the process.
5. **Payment platform controls:** use approval workflows and positive pay features from your bank and AP software.
6. **Code words or secondary checks:** for leaders who approve large transfers, agree on a verification step that a fake could not know.
7. **Training:** brief everyone in finance, operations and executive support at least twice a year.

## If you think you have been targeted

Stop the payment, contact your bank immediately to attempt a recall, preserve the messages and call recordings, and report the incident to law enforcement and your insurer.

## Frequently asked questions

### Does insurance cover deepfake fraud?

Sometimes, depending on your crime and cyber policies. Review coverage, limits and conditions with your broker.

### Are small companies really targets?

Yes. Smaller companies often have fewer controls and faster, more informal payment processes.

### What is the single most effective control?

Independent verification of any new payee or bank change through a known, separate channel.

*Want a review of your payment controls? See our [special projects](https://capstonecfo.com/special-projects) or [talk with our CFO team](https://capstonecfo.com/meeting).*

[View full post](https://capstonecfo.com/blog/deepfake-cfo-fraud-payment-controls)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Capstone CFO"
  },
  "dateModified" : "2026-10-15T12:13:25.553Z",
  "datePublished" : "2026-10-15T11:15:47Z",
  "headline" : "Deepfake CFO Fraud: The Payment Controls Every Company Needs Now",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1260,
    "url" : "https://capstonecfo.com/hubfs/capstone-2026/insights-covers/deepfake-cfo-fraud-payment-controls.png",
    "width" : 2400
  },
  "mainEntityOfPage" : "https://capstonecfo.com/blog/deepfake-cfo-fraud-payment-controls",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Insights"
  }
}
```