Do not try to catch the fake voice. Adopt a rule under which no call, video or chat message can move money until someone calls back on a number from your own records, and, above a limit you set, a second person approves. The FBI, Singapore's police and Canadian officials all tell businesses to verify through a separate channel instead of trusting their ears. This post is for owners, CFOs and finance teams. It is general information, not legal advice.
On 13 October 2026 the security-training vendor KnowBe4 released a report, based on a Censuswide survey of 500 Singapore-based office workers, that says 36% would not be confident telling a real CEO message from an AI-made one. We read it as published by Bernama, as KnowBe4's own release. That is vendor research, so we treat it as a pointer. The official record is firmer, and thinner than you might expect.
Update, 28 October 2026: We re-checked the FBI's 2025 Internet Crime Report (24,768 business email compromise complaints, 135 mentioning AI), the Singapore Police Force's 2025 scam brief (377 cases), and the FBI, Singapore and Canadian advisories. The figures are unchanged, and we found no new official count of deepfake CEO fraud.
At a glance: what the official record shows about fake-executive payment requests
Complaint and case counts from police and the FBI, not a measure of deepfake fraud.
What do the official numbers say about CEO-voice fraud?
Official figures show business email fraud is a steady crime, and that AI appears in very few reports. In its 2025 Internet Crime Report, the FBI's Internet Crime Complaint Center (IC3) logged 24,768 business email compromise (BEC) complaints. BEC is IC3's term for a scam that targets businesses that regularly make wire transfers, using compromised email accounts "and other forms of communication such as phone numbers and virtual meeting applications". Complaints were 21,442 in 2024. That is a rise of about 15.5%, our arithmetic on IC3's table.
Interactive chart
US business email fraud complaints rose after two flat years
Business email compromise complaints received by the FBI's IC3, by year.
2023: 21,489 complaints. 2024: 21,442. 2025: 24,768.
| Year | Complaints |
|---|---|
| 2023 | 21489 |
| 2024 | 21442 |
| 2025 | 24768 |
The Singapore Police Force (SPF) recorded 377 BEC cases in 2025, up from 368 in 2024, while the total amount lost in those cases fell by 60.1% over the same year, says its Annual Scam and Cybercrime Brief 2025 of 25 February 2026. Scammers "impersonate senior executives (such as a CEO or Chief Financial Officer) through email, WhatsApp messages, or phone calls", and in some instances "digital manipulation techniques are used, including via Zoom meetings".
IC3 tagged more than 22,000 complaints in 2025 as mentioning AI. Of the BEC complaints, 135 carried the tag, about 0.5%.
Interactive chart
AI is mentioned in about 0.5% of business email fraud complaints
Share of 2025 IC3 complaints in each crime type that contain a reference to AI.
Investment 6.0%, extortion 2.0%, real estate 0.9%, business email compromise 0.5%, phishing and spoofing 0.4%. A reference means the complaint text mentions AI, not that AI was proven.
| Crime type | Percent |
|---|---|
| Investment | 6.0 |
| Extortion | 2.0 |
| Real estate | 0.9 |
| BEC | 0.5 |
| Phishing and spoofing | 0.4 |
Read that chart with care. IC3 defines the AI tag as information that "contains a reference to artificial intelligence", so a victim who never learned the voice was cloned is not counted. IC3 says of investment fraud that "many victims do not realize the extent AI may be involved in scams". Treat 0.5% as a floor set by what people noticed, not a measured rate.
What does a fake executive request look like in Singapore?
A fake executive request is a message from someone senior, a call with people you half-recognise, and a reason to move money quietly and soon. In a joint advisory on 12 March 2025, the SPF, the Monetary Authority of Singapore (MAS) and the Cyber Security Agency of Singapore (CSA) described scammers who impersonate executives through "the alleged use of digital manipulation". Victims get unsolicited WhatsApp messages, are invited to a live Zoom call, and are told to transfer company funds. A fake lawyer may send a non-disclosure agreement to the victim's personal email.
On 14 May 2026 the SPF warned of a variant in which "the participants had been fabricated using deepfake AI technology" on a Zoom call, aimed at "business professionals who have had prior interactions with government officials". It is about officials rather than CEOs, but the method is the same: a familiar face, a confidential matter, an account the scammers supply.
We found no official Singapore count of deepfake CEO fraud in the sources we read, so this post gives none. The figures above count complaints and cases of business email fraud in general, not deepfakes.
Other agencies agree. The FBI's December 2024 alert lists "real time video chats with alleged company executives". Its 2025 report says "voice cloning can also be used to request wire payment", and cautions that "not all" BEC tactics "are AI-enabled". Canada's Centre for Cyber Security and Anti-Fraud Centre warned on 23 June 2025 of AI-generated voice messages aimed at business executives.
How a fake executive request becomes a payment, and where each rule cuts it
The top row is the attack. Each green box is one line of the rule.
Why is "it sounded like him" not a control?
Because the thing you would check, the voice, is the thing that can be copied. The FBI's May 2025 alert says AI-generated voice cloning can "sound nearly identical" to a known contact. Canadian officials add that "phone numbers in voice calls and text messages can be spoofed".
The vendor survey points at the human side. The KnowBe4 release, as Bernama carried it, says juniors may hesitate to challenge senior leaders and that senior managers can be overconfident about spotting fakes. We have not seen the full report, and the news item gives no figures behind its "twice as likely" headline, so we do not lean on it. The point stands without it: asking an assistant to challenge a CEO's voice fails on a bad day. A routine call-back asks no one to be brave.
Be mindful of any sudden or urgent fund transfer instructions and verify the authenticity of the instructions with the relevant departments or personnels directly through established communication channels.
Singapore Police Force, Monetary Authority of Singapore and Cyber Security Agency of Singapore, Joint Advisory on Scams Involving Digital Manipulation, 12 March 2025.
The advisory also asks firms to "establish protocols for employees to verify the authenticity of any video calls or messages".
Which payment approval rule can you adopt this week?
Five lines, written down, signed by the CEO, and applied to everyone. The table shows what each line borrows from an official source. The rule is Origin Pi's reading of them, not a regulatory standard.
| Rule line | What an official source says | Source and date |
|---|---|---|
| 1. A message never starts a payment | Verify the instruction "directly through established communication channels" | SPF, MAS, CSA, 12 Mar 2025 |
| 2. New payee, changed details, urgent or secret: call back on your own number | Hang up, find the contact yourself, "call the phone number directly" | FBI IC3, 3 Dec 2024 |
| 3. Over your limit, a second person approves | Origin Pi addition. The alert asks staff "especially those that are responsible for making fund transfers" to stay alert; it sets no approval limit or second-approver rule | SPF, MAS, CSA, 12 Mar 2025 |
| 4. It binds the CEO too | Contact the person through "alternate, previously confirmed channels" | Canadian Centre for Cyber Security and CAFC, 23 Jun 2025 |
| 5. If you cannot confirm, do not pay | "Call the associated bank immediately to report and block" and make a police report | SPF, MAS, CSA, 12 Mar 2025 |
The rule in plain words, ready for a finance policy:
- A voice, a video call or a chat message never starts or changes a payment. Finance keys the request into the normal flow.
- A new payee, changed bank details, or any request that is urgent or secret is confirmed by calling back on a number from your own records. Not the number that called, and not the number in the message.
- Above a limit your board sets and writes down, a second person approves. That person is not the requester.
- The rule binds everyone, including the CEO and the board. The CEO signs it in advance.
- If you cannot confirm, you do not pay. Call the bank to report and block, make a police report, and log what happened.
Illustrative example: a finance executive gets a voice note on WhatsApp that sounds like the managing director. It asks for a payment to a new supplier today and says to keep it between them. Under the rule, the executive says finance will process it once confirmed, then calls the managing director's number from the staff directory. He knows nothing about it.
Test your own situations in the builder below.
Rule builder
Which line of the rule applies to this request?
Up to three questions. A guide, not an audit. Nothing you choose leaves your browser.
- If the request arrived by call, voice note, video call or chat and asks for a new payee, changed bank details, secrecy or speed, hold the payment and call back on a number from your own records.
- If the request came through your normal system but the payee is new or its bank details changed, call the payee back on a number from your vendor file, then get a second approver.
- If the payee is known and the amount is over your limit, get a second approver.
- If the payee is known and the amount is within your limit, pay through the normal flow. If the request came by call or chat, key it in yourself first.
Choose the limit so that a second approver is a rare event people take seriously, not a daily click. Treat a brand-new payee as over the limit whatever the amount.
To adopt it this week, fill in five blanks on the one page. The amount above which a second person approves. The names of two people who can approve, so a holiday does not stall payments. The person who owns the vendor file, with the phone numbers you call back on. The bank's fraud line. And a one-line log for every call-back: date, time, who you spoke to and the number you used. Change the vendor file's phone numbers only with the same call-back, or a scammer can swap the number you trust.
Would you pay it?
Six requests, and one right answer each. Every scenario is labelled Illustrative and invented for this quiz. The answers follow the rule above.
Quick check
Would you pay it?
Six Illustrative requests. Choose what the rule says to do.
Where Origin Pi stands
We treat this as an authority problem, not a detection problem. Origin Pi designs the point where a person, or an AI agent, may commit money or send data: who asks, who confirms, through which channel, and what the log shows. The same five lines apply to an AI agent that prepares payments. See our guides to the confirm step, agent identity, the audit trail and what to log.
The rule lowers the chance of a successful fake-boss request. It does not remove the risk: a compromised vendor file or an insider can still defeat it. This is general information, not legal advice.
Your first step this week: write the limit and the five lines on one page, get the CEO to sign it, and send it to everyone who can release a payment.
Take the data with you
Every figure in this post's charts and at-a-glance card is in one table, with its source, source date and the date we read it. If you reuse either file, please cite this post and link back to it.
