The CFO on Your Video Call Might Be a Deepfake: How California Businesses Stop AI Wire Fraud

AI has made the fake boss more convincing, but it hasn't changed what the scammer needs from you: a payment, a password reset, or a changed bank account. The fix is a set of verification rules your staff follow every time, no matter how real the voice or face looks. That means calling back on a number you already have, requiring two approvals for money movement, and never resetting a login based on a phone call alone. California businesses have a lot riding on this. The state led the country in both cybercrime complaints and losses in the FBI's 2025 report.

What has AI actually changed about business fraud?

The old scams still work. AI just makes them cheaper to run and harder to catch.

The FBI's April 2026 release on its 2025 data counted 1,008,597 complaints and nearly $21 billion in losses, up 26% from the year before. For the first time, the report broke out AI-related fraud on its own: 22,364 complaints and about $893 million lost. The FBI described scammers using voice clones and believable videos. People 60 and older lost $7.7 billion, a 37% jump.

Business email compromise (BEC) is where most companies feel it. In the 2025 IC3 report, BEC drew 24,768 complaints and $3,046,598,558 in losses, second only to investment fraud. Of those BEC losses, 86% went out by wire or ACH. The same report says AI-enabled BEC topped $30 million in 2025. Criminals used chat tools to copy a CEO's email style and cloned voices to approve transfers.

California sits at the top of both lists. The report shows 116,414 complaints and $3,674,716,305 in losses from California victims, more than any other state. We haven't found a verified deepfake fraud case in Southern California yet, so the statewide figures are the best local measure for now.

FBI IC3 2025 loss figures at a glance

What happened at Arup, and what does it teach?

Arup is the case most people cite, and people often get the details wrong. In 2024, an employee in the engineering firm's Hong Kong office made 15 transfers totaling HK$200 million, about US$25.6 million, after a deepfake video call with people posing as senior executives, including the CFO. Arup said fake voices and images were used and that none of its internal systems were compromised.

One correction to the popular version: Hong Kong officials later said the video was probably pre-recorded, not a live deepfake. That makes the lesson plainer. The attacker didn't need to beat real-time detection. They needed one person to believe a familiar face and a sense of urgency.

What Arup teaches:

• Nobody broke into anything. No malware, no hacked server. The attack went after a person's trust, so firewalls and antivirus never came into play.
• Faces and voices can be faked. Seeing your CFO on screen doesn't tell you who is on the other end.
• Splitting the money didn't slow it down. Fifteen separate transfers means fifteen chances to stop, and none were taken. A rule that forces a second person to approve each one would have given the company those chances.

How are attackers using voice cloning and fake help-desk calls?

Wire requests are one target. Password resets are the other, and help desks get hit hard.

CISA and the FBI's advisory on Scattered Spider, AA23-320A (updated July 2025), describes the group calling help desks while posing as employees. Its goal is to get a password reset and move the employee's MFA to a device the attacker controls. The agencies recommend phishing-resistant MFA, such as FIDO/WebAuthn or PKI-based methods.

Voice phishing, or vishing, is growing fast. CrowdStrike's 2025 Global Threat Report found vishing rose 442% from the first half to the second half of 2024, driven by AI-driven phishing and impersonation. Its 2025 Threat Hunting Report adds a detail every help desk should hear: Scattered Spider callers can give correct employee IDs and answer verification questions. In one case, the group went from first access to ransomware in under 24 hours. CrowdStrike said vishing was on track to double its 2024 total.

If a caller can recite an employee ID, a manager's name and a last-four, knowledge questions tell you almost nothing.

The FBI has also warned about AI voices posing as government officials. A May 2025 public service announcement said that since April 2025, criminals have sent texts and AI-generated voice messages pretending to be senior U.S. officials. The FBI's advice was to call back on an independently verified number and agree on a secret word or phrase with people you trust. A December 2025 follow-up said the scheme dates back to 2023 and now asks victims to transfer money. The FBI also admitted that AI-generated content is often difficult to identify. So don't build your defense around your office manager catching a fake voice.

Is AI phishing really better than human attackers now?

According to testing by Hoxhunt, yes. In 70,000 phishing simulations, its AI phishing agent was 23.3% more effective than elite human red teams as of March 2025. In 2023, the humans had been 44.8% better. That gap flipped in about two years. Microsoft's 2025 Digital Defense Report says AI-driven phishing is three times more effective.

Deepfakes are already common. A September 2025 Gartner survey, reported by KnowBe4, found that 62% of organizations had faced a deepfake attack in the previous 12 months. Deloitte expects the cost to climb. It projects that generative AI could push U.S. fraud losses from $12.3 billion in 2023 to $40 billion by 2027, a 32% annual growth rate.

Your staff may have learned to spot phishing by its spelling mistakes and odd greetings. AI-written messages don't have them.

What red flags does FinCEN tell banks to watch for?

FinCEN's November 2024 alert, FIN-2024-Alert004, says suspicious activity reports tied to deepfakes have been rising since 2023. It was written for banks, but finance staff can use the same warning signs:

• Someone refuses to complete multi-factor authentication or offers excuses to skip it.
• A caller uses webcam plugins or odd video software during a verification check.
• A request doesn't fit the person's usual behavior, timing or amounts.

FinCEN recommends phishing-resistant MFA and live audio or video checks, which ask the other person to prove who they are in a way a recording can't.

The verification playbook

Two groups need rules: people who move money and people who reset logins. Write these down, train on them and make them non-negotiable, even for the CEO.

Part 1: Finance and wire transfers

1. Call back on a number you already have. Never use the number in the email, text or voicemail. Look it up in your vendor file or company directory. The FBI gives this advice in its May 2025 PSA.
2. Require two approvals for wires, ACH and bank-detail changes. With 86% of BEC losses moving by wire or ACH, these are the payments to lock down. A second person who wasn't on the call is your best check against a convincing fake.
3. Set up safe words. Agree on a code word or phrase between executives and finance staff, shared in person and never by email. The FBI recommends a secret word or phrase for exactly this.
4. Confirm urgent video-call requests on a second channel. If someone on a video call asks for money, hang up and reach them another way before you act. Arup's loss came from a deepfake video call. FinCEN's alert also points to live checks a recording can't pass.

Part 2: Help desk and password resets

1. Verify identity before any reset or MFA change. Call the employee's manager back on a known number, and confirm the request matches an open ticket. CISA's Scattered Spider advisory describes this exact attack.
2. Never rely on knowledge answers alone. CrowdStrike found attackers can supply employee IDs and answer verification questions. Treat a correct answer as a starting point, not as proof.

Controls that back up both parts

• Phishing-resistant MFA and passkeys. CISA recommends FIDO/WebAuthn or PKI-based MFA. Microsoft says phishing-resistant MFA can block over 99% of identity-based attacks.
• Train with AI-generated simulations. If attackers use AI to write phishing that beats human red teams, your training should use AI-generated phishing emails and voice calls too. Old-style tests with obvious typos won't prepare anyone.
• Report fast to IC3 and your bank. Call your bank the moment you suspect a bad transfer, then file at ic3.gov. The IC3 report says its fund-freeze effort froze money in 56% of critical-infrastructure incidents.

How AdVran helps

AdVran is a managed IT and security provider based in Anaheim. Our cybersecurity services cover the technical side of this playbook, including phishing-resistant MFA rollouts and security awareness training. Our help desk and end-user support team works from written identity-verification steps before resetting passwords or MFA. If a payment or account has already been compromised, our incident response and remediation service helps contain it and restore access. We can also help you work through the reporting steps with your bank and IC3.

Frequently Asked Questions

Can a deepfake really fool someone on a live video call?

It can fool people on a video call, which is what happened at Arup. In that case, Hong Kong officials later said the video was probably pre-recorded, not generated live. Either way, the fix is the same: confirm any money request on a second channel.

How do I verify a wire transfer request?

Call the requester back on a number from your own records, not one in the message. Require a second approver for wires, ACH and bank-detail changes, and use a pre-agreed safe word for urgent requests. Both steps follow FBI guidance.

What is vishing, and how do I prevent it?

Vishing is voice phishing: a phone call or voice message meant to trick someone into handing over access or money. CrowdStrike saw it rise 442% in the second half of 2024. Prevent it with callback rules, manager verification before password resets and phishing-resistant MFA.

Is business email compromise still a big problem in 2026?

Yes. The FBI's latest report shows $3.05 billion in BEC losses for 2025, second only to investment fraud. AI tools make the emails and follow-up calls more convincing.

What should I do if we already sent a fraudulent wire?

Call your bank right away and ask it to recall or freeze the transfer, then file a complaint at ic3.gov. Fast reporting matters. The IC3's fund-freeze effort froze money in 56% of critical-infrastructure incidents it handled.

References

1. Arup deepfake video call scam in Hong Kong (news report), CNN, May 16, 2024. https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk
2. FBI press release on IC3 2025 data: cryptocurrency and AI scams, FBI, April 6, 2026. https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions
3. 2025 Internet Crime Report, FBI Internet Crime Complaint Center (IC3), 2026. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
4. Public Service Announcement I-051525-PSA on messages impersonating senior U.S. officials, FBI IC3, May 15, 2025. https://www.ic3.gov/PSA/2025/PSA250515
5. Public Service Announcement on ongoing impersonation of senior U.S. officials, FBI IC3, December 19, 2025. https://www.ic3.gov/PSA/2025/PSA251219
6. FIN-2024-Alert004, alert on fraud schemes involving deepfake media, FinCEN, November 13, 2024. https://www.fincen.gov/system/files/shared/FinCEN-Alert-DeepFakes-Alert508FINAL.pdf
7. Cybersecurity Advisory AA23-320A, Scattered Spider, CISA and FBI, updated July 29, 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
8. CrowdStrike 2025 Global Threat Report press release, CrowdStrike, February 27, 2025. https://www.crowdstrike.com/en-us/press-releases/crowdstrike-releases-2025-global-threat-report/
9. CrowdStrike 2025 Threat Hunting Report, CrowdStrike, August 4, 2025. https://www.crowdstrike.com/en-us/blog/crowdstrike-2025-threat-hunting-report-ai-weapon-target/
10. AI-powered phishing vs. human red teams, Hoxhunt, 2025. https://hoxhunt.com/blog/ai-powered-phishing-vs-humans
11. Report on deepfake attacks targeting organizations (citing a Gartner survey), KnowBe4, September 2025. https://blog.knowbe4.com/report-deepfake-attacks-have-targeted-nearly-two-thirds-of-organizations
12. Deepfake banking fraud risk on the rise, Deloitte Insights, May 29, 2024. https://www.deloitte.com/us/en/insights/industry/financial-services/deepfake-banking-fraud-risk-on-the-rise.html
13. Microsoft Digital Defense Report 2025 announcement, Microsoft On the Issues, October 16, 2025. https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/
14. Microsoft Digital Defense Report 2025, Microsoft Security Insider, October 2025. https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025

Related Reading

• Wire Transfer Fraud in Southern California Real Estate
• Phishing Is Still the #1 Attack Vector
• IRS Written Information Security Plan (WISP) for California CPA Firms
• Shadow AI and Copilot: What Your Team's AI Tools Can Leak
• AI Is Now Hacking Servers on Its Own: What It Means for Your Patch Window