AI Phishing and Deepfakes: The New Face of CEO Fraud

CEO fraud is a social engineering attack in which the attacker impersonates an executive to ask employees for a money transfer or sensitive information. AI has made these attacks faster, more convincing and more personal. Attackers can now write emails that copy an executive's writing style, and can even clone their voice to speak like them on the phone or in a video call. In this article we explain how AI-assisted phishing and deepfake attacks work and how companies can protect themselves.

Phishing emails full of mistakes are a thing of the past

For years employees were told to "watch out for spelling mistakes". That advice no longer works. The phishing emails seen today are grammatically flawless, match the company's internal tone and are tailored to the individual.

The numbers show how quickly things have changed:

• In a 2023 experiment by IBM's X-Force team, writing a phishing email with AI took 5 minutes. A team of human experts took 16 hours to write a similar one. In that test the human-written email was slightly more successful, but the gap was closing.
• According to KnowBe4, 82.6 percent of phishing emails now contain AI-generated content.
• The gap closed within a year: in an academic study published in 2024, fully AI-generated personalised phishing emails achieved a 54 percent click rate, the same as those written by experts. Generic phishing emails reached 12 percent.
• According to Cofense's report published in early 2026, a malicious email was detected every 19 seconds in 2025.

As speed grows, so does scale. A targeted attack used to need a team and time. Now a single attacker can send thousands of personalised messages in a short time. If your employees still judge emails by their grammar, it is time to refresh the training.

How has AI changed CEO fraud?

By modelling an executive's voice, writing style and decision-making habits, attackers can contact employees directly. A short public video, a conference talk or LinkedIn posts can be enough to produce convincing, personal requests.

A typical scenario runs like this:

1. An employee in the finance team receives an urgent message from an address very similar to the CEO's.
2. The message mentions a confidential acquisition and a payment that must be made quickly.
3. If the employee hesitates, a phone call or voicemail arrives in the CEO's imitated voice.
4. Under pressure from urgency, authority and secrecy, the payment is approved.

In attacks like these the problem rarely lies in technical systems. The gaps are in approval processes and in decisions employees make under pressure.

New attack channels: quishing, vishing, smishing

AI-assisted social engineering goes well beyond email:

• Quishing: a harmless-looking QR code that takes you to a fake login page.
• Vishing and deepfakes: AI-generated executive voices or video calls.
• Smishing: fake text messages that appear to come from your bank, a courier or your own company.

Attackers succeed because they play on urgency, authority and fear. AI-assisted attacks can be personalised to the point of referring to a post on your LinkedIn profile.

How can companies protect themselves?

1. Secure your processes independently of technology.
Money transfers, changes to supplier bank details and sharing of sensitive data should require verification through a second channel. If the request came by email, call back on the number you have on record. Never call a number given in the message.

2. Apply separation of duties.
For critical payments, the same person should not both initiate and approve the request.

3. Make "urgent" and "confidential" alarm signals.
Teach employees that verifying an urgent, confidential request from an executive is the expected behaviour, and a sign of respect for the process. Management should say so openly.

4. Practise with realistic scenarios.
For employees in critical roles, conversation-based phishing scenarios can be used. Here the AI plays a role such as HR or IT, exchanges messages and adapts the scenario to the replies it receives. The aim is to see how employees react to interactions they could meet in real life, and to measure the risk.

5. Train executives too.
The raw material for deepfake attacks is executives' publicly available voice and video. Senior management also needs to be aware of this risk and follow the verification procedures.

Frequently asked questions

---
InfoLore designs conversation-based, AI-assisted phishing scenarios for critical roles. Get in touch to measure your exposure to executive impersonation.