Between 2023 and 2025, deepfake fraud attempts targeting financial institutions increased by more than 2,000%. The average loss per successful attack now exceeds $500,000, with individual incidents reaching as high as $25 million.

Yet when we examine the actual attack vectors, we find something striking: Nearly every successful deepfake fraud exploited gaps in basic verification protocols, not sophisticated technical defenses. The Arup employee who lost $25 million didn't fail because of inadequate cybersecurity technology, Arup's systems were never breached. The failure happened because standard business processes had no defense against technology-enhanced social engineering attacks.

This checklist provides eight critical questions every CFO should answer to assess their organization's vulnerability to deepfake fraud. These aren't theoretical security concerns, they're the specific protocol gaps that criminals have successfully exploited in documented cases.

Take 15 minutes today to work through these questions. The gaps you identify could save your organization millions.

In the Arup case, a single employee had the authority to execute 15 separate wire transfers totaling $25 million without requiring a second signature. While this may have been appropriate for business velocity, it created a single point of failure that criminals exploited.

Dual authorization serves two critical functions:

Current State:

Deepfake-Resistant Standards:

Critical Gap to Address:
If your current thresholds allow single-person authorization above $50,000, you have a vulnerability. The cost of dual authorization (slight delay in transaction processing) is trivial compared to the risk of a six- or seven-figure fraud.

☐ Document current authorization thresholds
☐ Identify gaps where single-person authority exceeds safe limits
☐ Establish new thresholds with no exceptions policy
☐ Configure treasury/payment systems to enforce dual auth automatically
☐ Train staff on new protocols and rationale
☐ Audit first 30 days of implementation for compliance

The WPP(world’s biggest advertising group) deepfake attempt failed because the executive was suspicious of the unusual communication method, a WhatsApp invitation to a Microsoft Teams call from the "CEO". The Arup attack succeeded partly because the video call appeared legitimate enough that the employee didn't question the platform.

Corporate communication platforms provide:

When attackers move conversations to personal platforms, they deliberately choose channels that lack these protections.

Current State:

Red Flag Scenarios:

☐ Document which platforms are authorized for financial communications
☐ Establish clear platform requirements by transaction types
☐ High-value transactions: In-person or corporate video only
☐ Routine requests: Corporate email + corporate video/voice only
☐ Emergency requests: Must verify through corporate-controlled callback
☐ Train staff to recognize corporate vs. personal platform invitations
☐ Create a standard response: "Our security policy requires business transactions to occur on corporate platforms. Can we schedule this on [corporate Teams/Zoom/etc.]?"
☐ Enable platform usage reporting to identify deviations

When Arup Firm discovered the fraud, they needed to reconstruct what happened. Having comprehensive logs of communications allows:

FinCEN's guidance on deepfake fraud explicitly notes that financial institutions should maintain detailed records of verification attempts and suspicious activity.

Current State:

Regulatory Baseline:

☐ Audit current logging capabilities across all communication platforms
☐ Enable comprehensive logging for platforms that support it
☐ Establish retention policies meeting regulatory requirements
☐ Test log retrieval process (can you actually find and review past communications?)
☐ Document any gaps where logging is unavailable
☐ For gaps, implement alternative verification (such as manual documentation)

A 2024 Medius survey found that over half of finance professionals in the US and UK had been targeted by deepfake-powered financial scams, but 43% reported they had fallen victim to such attacks. The problem isn't that finance staff are careless, it's that they haven't been trained to recognize these sophisticated threats.

Traditional cybersecurity training focuses on phishing emails and suspicious links. Deepfake attacks exploit different vulnerabilities:

Current State:

Specific Indicators to Train:

Module 1: Real Cases (30 minutes)

Module 2: Recognizing Red Flags (20 minutes)

Module 3: Response Protocols (30 minutes)

Module 4: Hands-On Simulation (30 minutes)

☐ Schedule mandatory training for all finance staff (next 30 days)
☐ Include actual audio/video examples of deepfakes in training
☐ Role-play scenarios with simulated urgent requests
☐ Establish clear escalation procedures for suspicious requests
☐ Create quick-reference cards with red flags and response protocols
☐ Implement quarterly refresher training
☐ Track metrics: % staff who can identify red flags in simulation

The single most important technical defense against deepfake fraud is out-of-band verification: confirming requests through a completely separate communication channel that the attacker doesn't control.

If someone requests a wire transfer via video call, and you verify by asking them to confirm on that same video call, you've accomplished nothing. The deepfake can simply say "yes, confirmed."

True out-of-band verification means:

Current State:

Deepfake-Resistant Verification:

Scenario: You receive a video call from the CFO requesting an urgent $500K wire transfer.

Inadequate Response:

Proper Out-of-Band Response:

☐ Define what constitutes "out-of-band" for your organization
☐ Establish corporate directory of verified contact numbers for all executives
☐ Create decision tree: "If request comes via [channel], verify via [different channel]"
☐ Train staff on why same-channel verification is ineffective
☐ Implement "pause and callback" protocol for high-value transactions
☐ Document verification steps in transaction records

AI can perfectly clone your voice and appearance, but it cannot access information about recent specific events or private conversations. Challenge questions exploit this limitation.

The key is asking questions that:

Current State:

Effective Challenge Question Examples:

Ineffective Challenge Questions:

Rather than pre-establishing specific questions (which could be compromised), train staff to ask contextual questions about recent events:

If the person is really your CFO, they will:

If it's a deepfake, it will:

☐ Train staff on the concept of challenge questions
☐ Provide examples of good vs. bad questions
☐ Emphasize that questions should be spontaneous and contextual
☐ Role-play scenarios where staff practice asking executives challenge questions
☐ Establish cultural acceptance: Real executives expect and appreciate verification
☐ Document that staff will not face repercussions for questioning unusual requests

Every successful deepfake fraud case involves urgency. Attackers create artificial time pressure to prevent the careful verification that would expose the fraud.

The critical question isn't whether you have verification protocols, it's whether those protocols have exceptions for "urgent" requests.

Current State:

Red Flag Responses:

Deepfake-Resistant Approach:

Principle: Urgency doesn't eliminate verification, it changes the timeline.

For Legitimate Urgent Transactions:

Protocol Override Requirements:

☐ Review past 90 days of transactions for "urgent" bypasses
☐ Identify patterns: Who requests urgency? How often? For what amounts?
☐ Eliminate blanket urgency exceptions from procedures
☐ Establish the protocol override process requiring dual executive approval
☐ Document that verification delay is acceptable for even legitimate urgent requests
☐ Train staff with confidence: "Real executives understand security protocols"

In the Arup’s Firm case, the employee discovered the fraud "after following up with the company's headquarters". The delay between the fraudulent transfers and discovery gave criminals time to move the money, making recovery extremely difficult.

Rapid response can significantly improve fund recovery outcomes. According to fraud recovery specialists, funds reported within hours of transfer have a much higher recovery rate than those reported days later.

Current State:

Immediate Response Checklist:

Within 1 Hour of Discovery:
☐ Contact your bank(s) immediately to attempt transaction reversal or freeze
☐ Contact receiving bank(s) to request temporary hold on funds
☐ Notify internal Legal and Compliance teams
☐ Preserve all communication records (emails, call logs, video recordings)

Within 4 Hours:
☐ File report with local law enforcement
☐ File report with FBI Internet Crime Complaint Center (IC3.gov)
☐ If financial institution: File Suspicious Activity Report (SAR) with FinCEN referencing "FIN-2024-DEEPFAKEFRAUD"
☐ Notify cyber insurance carrier

Within 24 Hours:
☐ Conduct internal investigation of how security was compromised
☐ Identify and secure any other potential vulnerabilities
☐ Brief executive leadership and Board (for material losses)
☐ Engage forensic cybersecurity firm if needed
☐ Review public relations/disclosure obligations

Critical Point: Every hour of delay reduces recovery probability. The Hong Kong police investigation of Arup began after the employee "later checked with head office" but by then the money had been moved through multiple accounts.

☐ Create "Suspected Fraud" emergency contact list (internal and external)
☐ Establish 24/7 contact protocol for urgent fraud reporting
☐ Build relationships with FBI cybercrime unit and local authorities before you need them
☐ Document step-by-step response procedures
☐ Conduct tabletop exercise: simulate discovering a deepfake fraud and practice response
☐ Review cyber insurance coverage for deepfake fraud scenarios

For each question, rate your organization:

Total Your Score:

14-16 points: Low Vulnerability
You have strong defenses against deepfake fraud. Focus on maintaining these controls and staying updated on evolving threats.

9-13 points: Moderate Vulnerability
You have some protections but significant gaps remain. Prioritize addressing the 0-point and 1-point items within 60 days.

0-8 points: High Vulnerability
Your organization has critical exposure to deepfake fraud. This requires immediate executive attention and rapid implementation of basic controls.

Regardless of your score, implement these items within 30 days:

Week 1:

Week 2:

Week 3:

Week 4:

The deepfake threat landscape evolves rapidly. What works today may be inadequate in six months. Quarterly reassessment of these eight questions should be part of your standard risk management process.

Remember: Nearly every successful deepfake fraud exploited gaps in basic verification protocols, not sophisticated technical failures. The Arup employee who lost $25 million wasn't careless, they were operating in a system without adequate deepfake defenses.

The questions in this checklist aren't exhaustive, but they address the specific protocol gaps that have been successfully exploited in documented cases. Answer them honestly, address the gaps you find, and train your team thoroughly.

The investment in these controls is measured in hours and modest process changes. The potential loss from not having them is measured in millions of dollars and damaged careers.

Take the 15 minutes today to work through these questions. The gaps you identify could save your organization from becoming the next deepfake fraud case study.