International payment fraud in the age of deepfakes: the controls that still hold

CEO fraud and bank-detail-change fraud are not new. What has changed is the cost of credibility. It used to take a smooth-talking fraudster who knew the org chart and wrote flawlessly. Today a few minutes of recorded voice — an interview, a webinar — and a language model writing in the executive's tone, in any language, are enough.

The case that changed perceptions dates from early 2024: in Hong Kong, an employee of the engineering group Arup made fifteen transfers totalling 200 million Hong Kong dollars, about 25 million US dollars, after a video call in which the CFO and several colleagues were AI-generated imitations. The employee had doubts; the video dispelled them.

Why international payments are the most exposed

Since 9 October 2025, euro-area banks must check, before a euro transfer, that the payee's name matches the account entered, and warn the payer of any mismatch. This verification of payee partly closes the door on fraudulent bank-detail changes — but only for euro transfers.

• A transfer in dollars, yuan or Turkish lira to a supplier outside the SEPA area does not benefit from this check.
• Foreign bank details — account number, bank code, correspondent bank — are less familiar, and a change goes unnoticed more easily.
• Time differences reduce the chances of checking live with the supplier, and provide an alibi for urgency.
• Once executed, an international transfer passes through correspondent banks: recalling the funds is possible but uncertain, and every hour counts.

There is an FX-specific factor too: urgency is easy to manufacture. "The rate is about to move", "the hedge must be unwound before the close" — the market argument is a pressure lever fraudsters know well.

The four scenarios to know

1. The fake executive, by voice or video

A call or video call from the CEO or CFO asks for an urgent, confidential transfer: an acquisition under way, a sensitive matter, tell no one. The voice is right, so is the face. The signal is not in the imitation but in the request: confidentiality, urgency, a bypassed procedure.

2. A foreign supplier's change of bank details

An email from the supplier — sometimes sent from its real, compromised mailbox — announces a change of bank, with a letterhead and a new account number. AI makes these letters flawless, in the usual language and style. The next payment goes to the fraudster's account.

3. The fake banker or fake dealing room

This is the FX-specific variant. Someone introduces themselves as the bank's relationship manager or FX dealer: a hedge must be adjusted, a margin call must be paid, a "preferential rate" expires within the hour. They sometimes know your positions, gleaned from a compromised mailbox. The transfer requested goes to an account that is not the bank's.

4. The fake invoice or fake pro forma

A perfectly imitated down-payment invoice in foreign currency arrives among a supplier's real invoices. It carries the references of an existing order. Only the payment account differs.

Controls that do not depend on the imitation

1. 1
   Call-back on a known number

   Any unusual request and any change of bank details is checked by calling the person back on a number already in your records — never the one in the email or on the screen. It is the most effective and cheapest control.

2. 2
   Dual approval above a threshold

   Above an amount set in the treasury policy, a transfer requires two separate signatories in online banking. A fraudster who has convinced one person must convince a second, who has not been under the same pressure.

3. 3
   Payee list and cooling-off period

   Payments only go to registered payees. Any addition or change is approved by someone other than the person paying, and no payment is made to a new or modified payee in the following days, unless a documented call-back has taken place.

4. 4
   A code agreed out of band

   For genuinely urgent requests from the CEO, a code agreed in advance, never written in an email, confirms identity. An imitation can copy a voice; it does not know the code.

5. 5
   The urgency rule

   No urgency justifies skipping a step. The rule is written, known to all, and the CEO commits never to ask for an exception. It is what protects the employee who hesitates.

If the payment has gone

1. Call your bank immediately to request a recall of funds: on an international transfer, the first hours are decisive.
2. Have your bank alert the beneficiary's bank.
3. File a police report and keep every piece of evidence: emails with their headers, recordings, the bank details used.
4. Check whether a mailbox has been compromised, yours or the supplier's: a fraudster who reads your exchanges will come back.
5. Notify your insurer if you have cover for fraud.

AI works on the other side too

Banks and payment infrastructures also use machine learning to flag abnormal payments: new payee, unusual country, out-of-pattern amount. Swift, the messaging network banks use for international transfers, has offered AI-based anomaly detection in its Payment Controls service since January 2025. These tools stop some fraud, but they do not replace internal controls: a transfer authorised by two legitimate signatories, to an account registered the day before, can look perfectly normal to them.

Sources

• Arup case: CNN, "British engineering giant Arup revealed as $25 million deepfake scam victim", 16 May 2024; Fortune, 17 May 2024.
• Verification of payee: Regulation (EU) 2024/886 on instant payments; European Central Bank and European Payments Council, applicable from 9 October 2025 for euro-area payment service providers.
• Swift, "Swift to launch AI-powered fraud defence to enhance cross-border payments", press release, 16 October 2024.