SealfieCEO fraud: why your payment procedures no longer hold.
For a CFO, CEO fraud is a payment order that appears to come from the chief executive. The tools to fake it now cost a few dozen dollars. In the documented cases, procedures existed and appear to have been applied.
Recognizing the voice, calling back, dual approval, MFA, training: each of these controls has a documented workaround.
Each usual control has a documented workaround
These controls remain useful and should stay in place. The victims described below appear to have applied them. They share one limit: they rely on what the person sees or hears, and those signals can now be manufactured.
"I recognize his voice"Appears to holdBypassedReveal the workaroundHide
$30 fake voice message
Ads offer a fake voice message from $30. In the UCL study, listeners spotted only 73% of voice deepfakes, so more than one in four gets through (UCL, PLOS ONE, August 2023).
"Let's do a video call to confirm"Appears to holdBypassedReveal the workaroundHide
$50 video deepfake
The Arup case: every other participant was a deepfake. Kaspersky (2025) found ads offering real-time face swapping during video calls.
Calling the executive back on their numberAppears to holdBypassedReveal the workaroundHide
$10 to $2,000 SIM swap
Effective while the line is clean. After a SIM swap, the call and the texts reach the criminal. The swap costs between $10 and $2,000 depending on source and year.
SMS code or authenticator app (MFA)Appears to holdBypassedReveal the workaroundHide
Dual approval, four-eyes ruleAppears to holdBypassedReveal the workaroundHide
It doubles a control without changing its nature. If the same fake instruction convinces both signers, the order goes through. This is our own analysis, with no public measurement. In one SME accountant's account, a handwritten signature on paper did not stop the transfer from being sent to the bank.
Training and vigilanceAppears to holdBypassedReveal the workaroundHide
+3.8 points after deepfake examples
The 73% rate mixes warned and unwarned participants. Showing examples of deepfakes improves it by only 3.8 points on average. At Ferrari the attempt failed because an employee asked a question only the real executive could answer. An individual reflex is not a system.
Deepfake detection toolsAppears to holdBypassedReveal the workaroundHide
0 of 16 reliable detectors
A CSIRO / Sungkyunkwan study (March 2025) tested 16 reference detectors. None reliably identified real-world deepfakes.
The essentials in four lines
CEO fraud means impersonating an executive to obtain a wire transfer or a bank-detail change. A fake call, message or video meeting is enough. According to Kaspersky (September 2025), ads offer a video deepfake from $50 and a fake voice message from $30. At the FBI, the average loss per business email compromise (BEC) complaint is about $129,000 (losses divided by complaints, IC3 2024 report, Inkan.link calculation). Each usual CFO control (recognizing the voice, calling back, dual approval, MFA, training) has a documented workaround. In the documented cases, procedures existed and appear to have been applied.
An attack unfolds in four steps
1. Reconnaissance
The criminal identifies the executive, the CFO and the accountant who runs the payments, from LinkedIn, the company website and press releases. A few seconds of an interview are enough to clone a voice.
2. Impersonation
They contact the accountant or the CFO by email, WhatsApp, phone or video call, with the executive's voice and sometimes face.
3. Pressure
The order is urgent and confidential: an acquisition, a dispute, a tax audit. The target dares neither to call back nor to talk about it.
4. Transfer
The money goes to an account the criminal controls, often abroad. The funds are scattered within hours.
The FBI counts about $5 billion a year in exposed dollar loss (from reports to the FBI, law enforcement and financial-institution filings) from business email compromise, averaged over October 2013 to December 2023 (Inkan.link calculation from the total the FBI published).
Six documented cases
Video call: Arup, $25M (2024)
An employee of the engineering group Arup in Hong Kong joins a video call where every other participant is a deepfake. He makes the transfers on the instruction of whom he believes is his CFO and only discovers the fraud when he contacts head office.
WhatsApp and a cloned voice: Fideuram, about €95M (February 2026)
The chairman of the private bank Fideuram receives a fake WhatsApp message attributed to the group's CEO, then a call with the cloned voice of a lawyer he knows. The transfers leave within hours for accounts abroad. According to Reuters, €53M was recovered and €36M is still missing. The details.
A call in a minister's voice: almost €1M (February 2025)
Fraudsters clone the voice of Italy's defence minister to ask business leaders for money, claiming to free kidnapped journalists. Only one target, former Inter Milan owner Massimo Moratti, sent money: almost one million euros in two payments. Police froze the sum in a Dutch account (Reuters, 12 February 2025).
A family-owned business: €520,000 wired by an accountant (July 2020)
An accountant hired eight months earlier, at a family-owned industrial manufacturer of about 50 employees, is contacted by a fake lawyer. He gives her a key role in a confidential acquisition. She wires €520,000. The calls and messages keep coming, with a ban on telling colleagues or her employer. She could issue transfers alone, and her management, focused on customers and production, was not closely supervising her (the victim's account, Fraudologie podcast, episode 10, in French).
A small metalworking shop and its nuclear-sector clients: attempt stopped (summer 2020)
A metalworking shop near Bourgoin-Jallieu, which works with Framatome, the CEA, Air Liquide and Michelin, receives a fake email signed by a fake finance-ministry agent. It asks for all details on its three main clients, unpaid invoices included, under threat of a fine. The fraudsters then write to at least one of its clients asking it to pay its invoices into an account at the bank Banco BPM that they control. Warned by Trend Micro, the companies concerned stop the attack. At least 70 French companies received a similar email (Le Monde, 6 October 2020, in French).
A call in the CEO's voice: Ferrari, failed (July 2024)
An executive receives WhatsApp messages from an unusual number, then a call with the CEO's cloned voice. The executive asks for the title of a book the CEO had recommended a few days earlier. The call ends (Bloomberg via Fortune, 27 July 2024). The defense held because of one person's reflex.
Procedures in place, which reassured the people who applied them
In the documented cases, the teams that were hit had controls and appear to have applied them. According to the published accounts, it was the control's answer that dispelled the doubt.
Arup: the three reflexes awareness training teaches
The Hong Kong employee suspects the email, refuses to act on that message alone and looks for confirmation through another channel. That is what every training program teaches. The video call that "confirms" it is a deepfake. The employee then runs fifteen transfers to five accounts, about $25M. The details.
Fideuram: three channels, one source
A message from the group's CEO, the voice of a lawyer he knows, emails from the law firm: the order looked verified three ways. All three channels were in the fraudsters' hands. The chain of command was also respected: the chief financial officer executed the chairman's order. According to the sources, no executive of the bank is targeted by the investigation. The details.
What the two cases suggest
A control that checks the message or the channel can be bypassed as soon as the message and the channel can be manufactured. As long as it answers, it reassures, and the next order goes through more easily. This is our reading of the two accounts.
After the fraud: proving good faith
When the company files a complaint, the accountant or finance officer who executed the transfer is, according to Inkan.link's exchanges with French territorial intelligence services (statements gathered in 2024, not published), treated by default as a suspect at the start of the investigation. They then have to explain what they checked. French lawyers report that courts examine the warning signs that were missed and the controls in place when a dismissal is challenged. Without a dated record of who confirmed what, and when, only their word remains. The Arup and Fideuram accounts report no record of this kind. This reading is our own analysis.
The price of an attack: $30 to $2,000 per building block
The prices below come from published ads and investigations. They are starting prices, not quotes. Kaspersky notes that many ads are probably scams aimed at the buyers themselves. The order of magnitude holds: a few dozen to a few hundred dollars per block.
| Fake voice message (voice cloning) | from $30 (ads). Kaspersky, 23 September 2025 |
|---|---|
| Video deepfake | from $50 (ads). Kaspersky, 23 September 2025. In May 2023 the same company found $300 to $20,000 per minute |
| Phishing kit that bypasses MFA (EvilProxy) | $400 a month. Resecurity via iTnews, 6 September 2022 |
| SIM swap, through a corrupt carrier employee | $10 to $15 per SIM card activated (Kaspersky, 2019), up to $300 offered per swap in 2024 (Bitdefender, 17 April 2024). In a US court case, a former AT&T store employee typically received $1,000 to $2,000 per swap (US Department of Justice) |
| Target gain: average loss per BEC complaint | about $129,000 (about €119,000). BEC losses divided by BEC complaints, IC3 2024 annual report, Inkan.link calculation |
A fake voice message and a video deepfake at starting prices cost $80 in total. These are advertised prices: according to Kaspersky, many ads are probably scams. An average BEC complaint at the FBI represents about $129,000 in losses. The defense has to hold against everyone. The attack only has to work once.
Validate the real requester, not the message
A voice, a face or an email no longer proves who is asking. What stays hard to fake lives in the person and in their phone. Before a sensitive order runs, the real requester confirms with a selfie on their own device. Sealfie then cross-checks several independent sources automatically:
The mobile carrier
Queried in real time: a SIM swap in the last 48 hours blocks the validation.
The device
The hardware fingerprint confirms the validation comes from the requester's usual phone.
The person
Liveness detection confirms a real physical presence, not a photo or a video.
The log
Every validation is timestamped and sealed. An auditor or an insurer sees who validated what, and when.
Sealfie costs €950 excl. VAT per year per user, for 30 simple validations per year per user, pooled across the company. No training is needed.
See where your procedure gives way before a criminal finds it
The 30-minute Challenge: we explain how hackers get around the human procedures that finance teams put in place, and where yours gives way. Written report on request, whatever the result.
Book the Challenge →The fake CEO scam. 5 billion dollars a year. Arup: he verified, and the verification lied. Free BEC risk calculator.