Deepfake Executive Fraud: The UK CISO’s Action Plan for 2026

Deepfake executive fraud is the fastest-growing financial crime vector targeting UK organisations in 2026, and UK CISOs who do not have a specific defensive framework in place are leaving their organisations exposed to losses that routinely exceed seven figures.

The threat is no longer theoretical. In 2024, a Hong Kong-based finance employee was deceived into transferring HK$200 million (approximately £20 million) to fraudsters using a deepfake video call impersonating the organisation’s CFO and other senior executives. In the UK, KPMG’s 2025 UK Fraud Barometer recorded a significant increase in AI-enabled impersonation fraud reaching Crown Court, with voice cloning and synthetic video now routinely deployed against finance departments, board members, and senior executives. According to the National Cyber Security Centre’s 2025 Annual Review, AI-enabled fraud — including deepfake CEO and CFO impersonation — is now assessed as a Tier 1 threat to UK organisations across all sectors. The NCSC has specifically warned that generative AI is lowering the skill threshold for executing sophisticated executive impersonation attacks, making the threat available to a far wider range of threat actors than previously.

How Do Deepfake Executive Fraud Attacks Work in Practice?

The attack architecture exploits a fundamental organisational vulnerability: the authority of senior executive voice and image. Attackers harvest audio and video of target executives from publicly available sources — earnings calls, conference appearances, LinkedIn videos, media interviews, and corporate communications — to build synthetic profiles capable of generating real-time voice clones or pre-recorded video deepfakes. These are then deployed in three primary attack patterns. The first is the urgent wire transfer call: an employee in the finance function receives a call or video call appearing to come from the CEO or CFO instructing an urgent, confidential payment, often framed around a merger, regulatory requirement, or time-sensitive business need. The second is vendor payment diversion: a deepfake executive approves a fraudulent request to change supplier payment details. The third is credential harvesting: a synthetic executive instructs IT or HR staff to create accounts, reset credentials, or share access tokens under the guise of an emergency.

According to Deloitte’s Centre for Financial Services 2025 analysis of AI-enabled fraud, the financial services sector saw deepfake-related fraud losses increase by over 700% between 2022 and 2024 globally. For UK CISOs, the attack surface extends beyond the finance function — board members, NEDs, and senior leaders are all high-value impersonation targets whose synthetic profiles can be constructed from public-domain content alone. The CISO’s defensive challenge is therefore not only technical but cultural: the fraud exploits human trust in familiar authority, which no firewall addresses.

What Technical Controls Should UK CISOs Implement Against Deepfake Fraud?

Effective technical defence operates across three layers. The first is detection: deploying AI-based deepfake detection tools at the network perimeter and on communication platforms used for executive calls and video conferencing. Several UK-available solutions — including tools from Sensity AI, Reality Defender, and Microsoft’s Azure Content Safety — now provide real-time or near-real-time detection of synthetic media. CISOs should evaluate and deploy detection capability on the channels most likely to be exploited: Microsoft Teams, Zoom, and email-embedded video. The second layer is authentication: implementing out-of-band verification protocols for any financial instruction or system access request received via voice or video call. This means establishing pre-agreed codewords or verification sequences between executive assistants, finance directors, and the executives they serve — a low-cost, high-impact control that directly neutralises the most common attack pattern. The third layer is hardening the executive digital footprint: working with communications teams to limit the volume of high-quality audio and video published publicly, and briefing executives on the specific risk that their public appearances create for the organisation.

According to the NCSC’s guidance on deepfakes and fraud published in 2025, organisations should also review whether their telephony systems display caller ID that can be spoofed, and implement DMARC, DKIM, and DKIM alignment to reduce the risk of domain spoofing that often accompanies deepfake social engineering campaigns.

Review the INFORMD Cyber Resilience Framework for a structured approach to implementing layered deepfake defences across your organisation.

What Process and People Controls Does the CISO Need to Put in Place?

Technical controls alone are insufficient because the attack vector is human trust. CISOs must work with CFOs and COOs to implement mandatory out-of-band verification for all payment instructions above a defined threshold — regardless of how the instruction is received or who it appears to come from. This means a callback to a pre-registered number (not the number provided in the instruction), a confirmation via a pre-agreed secure channel, or a dual-authorisation requirement involving a second senior signatory. According to Action Fraud’s 2025 data, the majority of successful CEO fraud and deepfake impersonation attacks in the UK exploited the absence of exactly this control — the victim assumed the instruction was legitimate and acted without independent verification.

People controls require a specific awareness programme beyond general phishing training. Staff in finance, HR, IT, and executive assistant roles need scenario-based training on deepfake attack patterns, including live demonstrations of how convincing synthetic voice and video can be. According to KnowBe4’s 2025 Phishing by Industry Benchmarking Report, organisations that conduct scenario-specific training on AI-enabled social engineering attacks reduce click-through and compliance rates on simulated attacks by over 60% compared to organisations using generic security awareness content. The CISO should also ensure that incident response playbooks specifically address the scenario of a suspected deepfake fraud attempt in progress — including who to escalate to, how to preserve evidence, and when to involve law enforcement and the NCSC.

What Are the Regulatory and Governance Implications for UK CISOs?

Deepfake executive fraud sits at the intersection of multiple UK regulatory frameworks. Under DORA — the EU Digital Operational Resilience Act, which UK financial services firms with EU operations must comply with from January 2025 — ICT-related fraud incidents including social engineering attacks must be classified, reported within defined timelines, and subject to post-incident review. The FCA’s operational resilience framework requires regulated firms to identify their important business services and ensure they can withstand disruption from any cause, including fraud-enabled disruption. A successful deepfake fraud attack that causes material financial loss or system access compromise may trigger both DORA reporting obligations and FCA notification requirements under the Principle 11 obligation to deal with regulators openly and co-operatively.

Under the UK GDPR and Data Protection Act 2018, a deepfake fraud attack that results in unauthorised access to personal data — for example through credential harvesting or system access granted under a fraudulent instruction — triggers a 72-hour breach notification obligation to the ICO. CISOs must ensure that their incident response procedures capture this reporting chain and that the Data Protection Officer is included in the escalation path for any deepfake fraud incident that results in data access.

Executive Action:

• Implement mandatory out-of-band verification for all payment instructions above threshold — regardless of channel, urgency framing, or apparent sender authority. Brief finance, HR and IT teams on the specific protocol before Q3 2026.
• Evaluate and deploy deepfake detection tooling on your organisation’s primary executive communication channels (Teams, Zoom, telephony) and test detection capability against synthetic media samples before end of Q3 2026.
• Conduct a scenario-based deepfake fraud awareness session with all finance, HR, IT, and executive support staff, and update incident response playbooks to include a deepfake fraud-in-progress scenario with clear escalation, evidence preservation, and regulatory notification steps.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Frequently Asked Questions

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.