7 min read<\/p>\n
Just a few seconds of audio can be enough to convincingly clone a voice. This makes it possible to impersonate a CEO over the phone, instructing an urgent bank transfer. Antivirus software won\u2019t help here. Protection comes from a fixed verification process before any payment is made. Executives and finance teams need agreed rules that kick in before money changes hands.<\/strong><\/p>\n Key Takeaways<\/p>\n Related:<\/span>AI Voice Cloning: How DACH Companies Are Fighting Back<\/a> \/<\/span> AI Phishing: Mail Filters Are Flying Blind<\/a><\/p>\n What is a deepfake?<\/strong> A deepfake is an AI-generated or AI-altered medium that convincingly mimics a real person\u2019s voice, face or both. For voice cloning, a short audio sample is enough for the system to make the person say sentences they never spoke.<\/p>\n What\u2019s new isn\u2019t the scam-it\u2019s the tool. In the so-called CEO fraud (known in German as \u201cChef-Masche\u201d), an attacker poses as the CEO or CFO and orders an urgent transfer to a new account. In the past, this relied on fake emails. Today, the call comes with the familiar voice, and in advanced cases even a fake video call.<\/p>\n Executives are attractive targets because their voices are publicly available and their instructions carry weight. Lectures, interviews and podcast appearances provide plenty of audio material. A well-known case at a Hong-Kong engineering firm showed how an employee transferred nine-figure sums after a fake video conference. Attackers bank on authority and time pressure, a combination designed to override any review steps.<\/p>\n The obvious hope is a tool that detects fakes. Such deepfake detectors exist and they help. Yet no company should rely on them, because fakes improve as fast as detection does.<\/p>\n Human perception is even weaker. Studies show people can\u2019t reliably spot high-quality deepfake videos, and many can\u2019t distinguish a cloned voice from the real thing. The ear that many hope to fall back on in an emergency is therefore no reliable control. Only a robust process can provide real protection.<\/p>\n Effective protection relies on a few clearly defined rules that every payment instruction must follow. The key is that these rules are established in advance and not up for debate in an emergency.<\/p>\n How to verify<\/p>\n What you can\u2019t rely on<\/p>\n The single most effective step is the callback. Anyone receiving an unusual payment instruction calls back via a self-selected number-not the one provided in the call. This is paired with a pre-agreed code word to separate genuine from fake instructions, and the four-eyes principle, where no critical payment is approved by a single person. Awareness training keeps these rules top of mind, because a process only works if someone applies it at the decisive moment.<\/p>\n Voices and faces are personal data. Processing audio recordings for verification or fraud detection falls under the GDPR umbrella and requires a solid legal basis plus clear deletion rules. Biometric methods demand extra care.<\/p>\n For many organisations, NIS2 adds another layer. The directive obliges affected entities to implement adequate risk management and report significant incidents. A successful deepfake fraud causing major damage can qualify. Protecting against voice clones thus shifts from a purely financial concern to part of security and compliance obligations.<\/p>\n Very little. Reports indicate that just a few seconds of speech can produce a usable clone. Since executives often speak publicly, the material is often publicly available-from interviews, talks, or podcasts.<\/p>\n Hardly. Studies show most people cannot reliably distinguish a well-made voice clone from the real thing. That\u2019s why sound alone must never be the criterion for payment approval; only a defined verification process counts.<\/p>\n The callback via an independent, self-selected channel. When you verify an unusual instruction by calling back on a number you choose-not the one given in the call-you directly counter the time pressure attackers exploit.<\/p>\n Not on its own. Such tools are a useful addition, but fakes keep improving. Only the combination of organisational rules-callback, code word, four-eyes principle-and trained staff provides reliable protection.<\/p>\n In many cases, yes. Processing voice data triggers GDPR obligations, and entities covered by NIS2 must include protection against such attacks in their risk management and reporting duties. Guarding against voice clones is therefore also a compliance task.<\/p>\n\n
Why executives are the prime target<\/h2>\n
Why technology alone isn\u2019t enough<\/h2>\n
The verification playbook for leadership and finance teams<\/h2>\n
\n
\n
Where GDPR and NIS2 come into play<\/h2>\n
Frequently Asked Questions<\/h2>\n
How much audio material does an attacker need to clone a voice?<\/h3>\n
Can you reliably detect a cloned voice by sound?<\/h3>\n
What\u2019s the single most effective measure?<\/h3>\n
Is a deepfake detection tool sufficient protection?<\/h3>\n
Do we need to formalise this from a compliance standpoint?<\/h3>\n
Editor\u2019s Reading Picks<\/h3>\n