Your governance can work perfectly and still send the money to a criminal. Rules check that a process was followed. They do not check that the person who started it was real.
A normal Tuesday
The CFO is between two meetings when the phone rings. The display shows the CEO's number. The voice is calm, a little rushed, and exactly right. The CEO is abroad, the line is bad, and a confidential transaction must be approved today. The shareholders already agreed.
Nothing about this is strange. The trip is known inside the company. Urgent decisions have happened before. The CFO checks the documents, gets the second approval, and releases the payment. Every step of the process is followed.
Days later, the company learns that the CEO never called. The voice was generated by software from public recordings. The attackers knew about the trip and knew how the two executives talk to each other.
This scene is the opening case of a recent article by two forensic auditors of Rödl in Der Betrieb (Meinrad/Riexinger, DB 2026, 2408). It is based on a real, publicly reported case.
The process was correct. The premise was false.
Look at what failed. The four-eyes principle did not fail: two people approved. The authority matrix did not fail: the CFO may release this amount. The approval workflow did not fail: every field was filled in and every signature is on file. An auditor would find nothing wrong.
The failure happened before the first step. Every control assumed that the order came from the CEO. Nobody checked that assumption, because nothing in the process asks for it.
The second approver makes it worse. That person did not speak to the "CEO". They approved because the CFO asked them to, and the CFO is trusted. One false identity at the start becomes two real signatures at the end. The four-eyes principle checks the transaction. It does not check the person behind it.
The Rödl authors put it this way: internal control systems ask whether an action was properly authorised. Deepfake attacks work one level earlier, on the assumption that the person you perceive is the person you think. Classic control frameworks do not name this as a control objective of its own. So it often does not appear in risk analyses either.
This is the uncomfortable point for a board. After such a loss, the documentation shows a clean process. Nobody broke a rule, so the question becomes: why did our rules allow this?
What changed: familiarity is no longer proof
CEO fraud is not new. Business email compromise alone caused about USD 55.5 billion in losses worldwide between October 2013 and December 2023, as reported to the FBI, to law enforcement and to banks.
What is new is the tool. A voice, a face in a video call and a familiar writing style used to be good enough evidence. Today, generative AI can copy all three with public material: a keynote on YouTube, a podcast, an earnings call. The attacker needs no special skill and little money.
The Rödl article lists the sentences that show the problem: "I had him on the phone myself." "She was in the video call." In both cases, a feeling of familiarity was treated as a verified identity.
Payments are only the obvious target. The same trick works for a change of bank details, new access rights, confidential information, an M&A decision or a personnel decision.
The authors' conclusion is clear: governance, compliance and internal controls stay necessary, but they must be extended. Verifying identity must become a control objective of its own, in every process where a false identity can cause serious damage. Their proposed guiding question for company culture is "How was the identity verified?", replacing "Why was the order questioned?"
A control nobody uses is not a control
The usual answer is a call-back rule: hang up, look up the number, call back. On paper, it works. In practice, it fails in the exact moments that matter.
Every extra step that takes a person out of the current conversation is an interruption. The CFO must end the call, find a number, reach a busy CEO in another time zone, and explain why. Under time pressure, and facing a senior person, most people will skip that step "just this once". Attackers know this and create the time pressure on purpose.
The Rödl authors say the same: a procedure counts only if people apply it reliably in daily work, however sophisticated it is. Procedures that feel impractical get bypassed. And the rule must apply regardless of rank, role and time pressure, because exceptional situations are the ones attackers create.
So a CEO has two jobs here. First, make identity verification mandatory in the critical processes. Second, make it so simple that nobody has a reason to skip it. When people skip a control, the design is at fault.
Verification inside the conversation
Trusted Codes gives two people, or a whole team, a shared code of three words that changes at a set interval. Only the real members of a connection have it. The check takes one sentence: "What is our code?"
Back to Tuesday. The "CEO" calls. The CFO asks for the code, still on the same call. A real CEO reads three words from the phone. A deepfake has nothing to read. The payment stops before the process even begins.
The check works on every channel, because it happens between two people: on a phone call, in a video call, in a chat, by email and face to face. And the words tell you who is speaking: type in what you heard, and the app shows which connection they belong to, for example "CEO – Treasury approvals". How this differs from an authenticator app is explained in a separate article.
Two examples of how a company uses this:
- An M&A project. The deal team, the lawyers and the bank share one connection. Anyone who calls about the deal is asked for the code. When the deal closes, the connection is closed.
- Payments above €50,000. Finance and everyone who can order or approve such payments share one connection. The company makes the code check a mandatory step in the approval: no code, no release. The verification log shows afterwards that the check happened.
Proof that the check happened
A rule is only as good as the evidence that people follow it. A call-back leaves no trace. Nobody can show, weeks later, who called whom and what was confirmed.
On Business plans, Trusted Codes records each verification in a log: who verified whom, in which connection, when, and whether the code matched. The words themselves are never stored. For a board, this changes three conversations:
- With the auditor. Identity verification becomes a documented control activity, not a promise in a policy document.
- After an incident. The investigation can see at once where an identity was verified and where it was only assumed. The Rödl authors name this as the central question of every investigation.
- On liability. Management must show that its organisation and controls matched the known risks. A log that shows a working, used identity check is that evidence.
What to do this quarter
Keep your governance. Add the one control it is missing.
- List the processes where a false identity is expensive. Payments above a threshold, changes of bank details, access rights, M&A, restructuring, personnel decisions.
- Find the informal shortcuts. Where does a phone call replace a formal confirmation? Where are orders from senior people accepted outside the workflow?
- Make identity verification a required step in those processes. It applies to everyone, the CEO included, and especially under time pressure.
- Choose a method people will actually use. It must work inside the conversation, on every channel, in seconds, and leave a record.
- Say it yourself. Tell your team that you expect to be asked for the code, and that you will never be offended by it. That sentence from the CEO does more than any policy.
Trust between colleagues stays essential. In critical processes, it now needs a second factor.
Sources
- Alexander Meinrad and Jonas Riexinger, "Wenn Identität zur Schwachstelle wird: Deepfakes als Herausforderung für Compliance und Interne Kontrollsysteme", Der Betrieb 2026, 2408 (issue 39).
- FBI Internet Crime Complaint Center, "Business Email Compromise: The $55 Billion Scam", public service announcement, 11 September 2024: ic3.gov