The video call looks completely normal. Your CFO’s face, her voice, even the tired half smile she gets on a Friday afternoon. She says the acquisition needs a same-day wire, and the bank cuts off at 4pm. Nobody on that call was actually her. It was fifteen seconds of her voice pulled from a webinar, run through an AI tool, and layered over a hijacked video link. The wire went out anyway.
What AI-powered CEO fraud actually is
This is the next step past the fake email. Attackers now use generative AI to clone a real person’s voice from public audio, an earnings call, a webinar, a LinkedIn video, and to fake a live video call well enough to fool the person on the other end. Pair that with AI-written phishing emails that read like a real colleague instead of the broken English of ten years ago, and the old advice, “look for typos,” stops working. This isn’t a hacked computer. It’s a hacked trust relationship.
Why small businesses are the target
Small businesses took roughly seven in ten data breaches last year, and the average breach now costs a small business somewhere around $254,000, real money most SMBs never fully recover. Employees at small companies also get hit with social-engineering attempts at several times the rate their counterparts at large enterprises see, because attackers already know something owners don’t like to admit: a 20-person company rarely has a formal step in place to verify a wire request before the money moves. Big banks and enterprises built that step in years ago. Most small businesses never did.
The businesses attackers favor most are the ones that move money and hold sensitive data without a bank’s layered defenses: finance offices, CPA firms, and legal practices all sit high on the list. But any business that wires money to vendors, payroll, or contractors is fair game.
The one habit that stops it cold
The single most effective defense doesn’t cost anything and doesn’t require new software: never approve a wire, a payment change, or a vendor’s new bank details from an email, phone call, or video alone. Verify it on a second channel first. Call the person back on a number you already have on file, not one from the email or the caller ID, and confirm out loud before you move a dollar. For anyone who can authorize a wire, agree on a verbal codeword ahead of time and change it periodically. If a request feels rushed or urgent, that’s not a coincidence, urgency is the whole point of the attack. Slow down and make the call.
How Incognito locks it down
This is the work we do every day for businesses across Southern Arizona. We layer spam and virus filtering and email encryption on top of your inbox so the phishing email that sets up the deepfake call never lands, and we run short, regular security-awareness training so your team recognizes the play; the voice or the video might be convincing, but the request pattern rarely changes.
If you are not sure your team has a verification step in place, let’s find out together. Book a complimentary visit and we’ll walk through where a convincing fake could slip past you, or call us at 520.257.2648. If you think you’ve already been targeted, report it here and we will help you contain it fast.
