The other face of AI: deepfakes, financial fraud, and the role of management and auditors

When the CFO speaks, but it isn't the CFO

In January 2024, a finance employee at the Hong Kong office of a British multinational engineering firm received a message that appeared to come from the CFO at head office, asking for a confidential transaction. The employee then joined a video call in which the CFO and several colleagues appeared, and made 15 transfers to five bank accounts over one week, totalling HK$200 million (about US$25.6 million). Everyone on the call turned out to be a digital recreation. The real gap was not technical but a gap in internal control: large transfers were made on verbal instructions, with no independent verification through a separate channel.

Common forms of AI-enabled fraud

• Voice or video impersonation: calls or video meetings impersonating the chair or CFO to request urgent transfers.
• Supplier bank detail changes: convincing emails asking to update a known supplier's bank account, diverting future payments to the fraudster.
• Synthetic documents: invoices, bank statements and contracts that are hard to distinguish from genuine ones by visual inspection.
• Tailored phishing: well-written messages imitating real organisations, now that poor grammar is no longer a reliable warning sign.

What has changed in the auditing standard?

In July 2025, the International Auditing and Assurance Standards Board (IAASB) issued ISA 240 (Revised), The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements. It applies to audits of financial statements for periods beginning on or after 15 December 2026, with early adoption encouraged. Its main themes include:

• Stronger professional scepticism, applied more consistently across all stages of the audit.
• A "fraud lens" in identifying and assessing the risks of material misstatement.
• Clearer requirements for responding to identified or suspected fraud.
• Timely communication with management and those charged with governance.
• Greater transparency in the auditor's reports of listed entities.

The standard does not address deepfakes specifically, but stronger scepticism means, in practice, not accepting a document or instruction as reliable simply because it looks genuine.

Whose responsibility?

The primary responsibility for preventing and detecting fraud rests with management and those charged with governance, through well-designed and operating internal controls. The auditor seeks reasonable assurance that the financial statements are free from material misstatement, whether due to fraud or error. Controls within the entity are therefore the first line of defence.

Practical controls every entity needs

1. Verify through an independent channel: confirm any unusual or urgent transfer request by calling a number already on file, not the number in the message or meeting.
2. Segregate duties: no single person should both create and approve payments.
3. Dual approval for large amounts: two independent signatures above a set threshold, whoever is asking.
4. A strict process for supplier bank changes: change bank details only with formal documentation and an independent phone confirmation, and review the change log regularly.
5. An internal verification phrase: senior management can agree a phrase or question to confirm sensitive requests.
6. Ongoing training: keep finance and procurement teams aware of new fraud techniques, and encourage staff to stop and verify without fear of "bothering" management.
7. Treat urgency as a red flag: excessive secrecy and time pressure are among the most common features of fraud attempts.

Questions for those charged with governance

• Do we have a written procedure for verifying unusual transfer requests, and when was it last tested?
• Who can change supplier bank details, and are those changes reviewed?
• Has the finance team been trained on modern impersonation techniques in the past year?

Conclusion

AI has made forgery easier and more convincing, but it has not changed the golden rule of control: no sensitive financial request should rely on a single communication channel. Entities that build their controls on independent verification and segregation of duties remain better able to withstand fraud, however sophisticated the tools become.

Disclaimer: This article is for general information and does not constitute professional advice on any specific situation.

Sources

• IAASB — IAASB Revises Fraud Standard to Enhance Public Trust (July 2025)
• South China Morning Post — Report on the case (May 2024)

This article is for general information only and does not constitute professional advice. Thresholds, rates and procedures change — please contact us or refer to the latest official sources before acting.