- 29 June, 2026
- No Comments
Artificial intelligence has handed cybercriminals a formidable new weapon: the ability to clone a CEO’s voice in minutes and place a convincing phone call to the CFO authorising a ₹5 crore wire transfer. No phishing link, no malicious attachment—just a call that sounds exactly like the boss. Welcome to the era of AI-powered vishing and deepfake fraud, a threat that is already striking Indian enterprises and is set to accelerate sharply through 2026 and beyond.
This post breaks down how these attacks work, what the real-world exposure looks like for Indian organisations, and the concrete defensive layers that stop them—including how PJ Networks’ 24/7 SOC, FortiMail email security, and ZTNA framework interlock to create a resilient defence.
What Is Deepfake CEO Fraud?
Traditional Business Email Compromise (BEC) relies on spoofed email addresses and social engineering. Deepfake CEO fraud layers AI-generated audio (and increasingly video) on top of that foundation:
- Voice cloning: Attackers harvest as little as three minutes of a target executive’s voice from earnings calls, YouTube interviews, LinkedIn videos, or conference recordings. Open-source and commercial AI tools can then synthesise a near-perfect clone in real time.
- Real-time AI voice morphing: More sophisticated kits allow a live attacker to speak normally while an AI engine transforms their voice into the target’s in under 300 ms—indistinguishable on a standard phone call.
- Deepfake video calls: Emerging tooling extends the same technique to video, letting attackers “appear” as the CFO, CISO, or Board member in a Microsoft Teams or Zoom session.
The fraud chain is typically: reconnaissance → voice/video clone → urgent pretext call → finance/HR action (wire transfer, credential reset, payroll change). The entire operation can be run remotely, scaled across dozens of targets simultaneously, and leaves almost no forensic trail in the victim organisation.
Why Indian Enterprises Are Especially Exposed
Several structural factors amplify the risk for Indian companies:
High-Value Targets with Increasing Global Visibility
Indian conglomerates, IT services majors, and unicorn startups have senior executives who speak frequently in public forums—earnings calls, CII/FICCI conferences, startup events—generating rich audio libraries for attackers to harvest.
Hierarchical Culture and Urgency Bias
In many Indian organisations, a call from the MD or Group CFO still carries enormous authority. Employees are culturally conditioned to act swiftly on senior directives, reducing the likelihood that a recipient will pause to verify through a second channel.
Hybrid and Remote Finance Teams
Post-pandemic hybrid work means finance executives and treasury teams are routinely approving transactions over voice calls and video links rather than in-person—removing the natural “walk down the corridor to confirm” check.
Gaps in Multi-Factor Verification for Transactions
While Indian banking rails (NEFT/RTGS/IMPS) require dual authorisation, the voice call that triggers that authorisation is rarely verified independently. Attackers exploit this gap: the bank sees a legitimate dual-authorised transfer; the problem is upstream.
The Attack Playbook: A Step-by-Step Look
Understanding the attacker’s workflow is the first step to dismantling it:
- Passive OSINT (weeks before the call): Collect the target executive’s public audio/video. Map the organisational chart via LinkedIn, annual reports, and press releases. Identify the most likely authorising employee (CFO, Group Treasurer, Head of HR).
- Pretext construction: Create a plausible urgent scenario—an overseas acquisition that must close today, a regulatory penalty that must be paid before EOD, an emergency vendor payment to prevent a supply chain halt.
- Warm-up email (optional): A spoofed email from the executive’s domain sets the stage, referencing the “call you’re about to receive.” This primes the target and increases compliance.
- The call: AI-synthesised voice places the call from a spoofed caller ID. The victim hears exactly who they expect to hear, with the same cadence, accent, and verbal tics.
- Mop-up: A follow-up spoofed email with wire instructions lands immediately after the call. The target, already committed, transfers funds.
Real-world context: The UK-based energy firm’s widely reported 2019 incident—where the CEO was voice-cloned and €220,000 was transferred to a fraudulent account—was the proof-of-concept. By 2025, the tooling costs have collapsed to near-zero, and India-specific incidents are being reported privately by Indian banks and RBI-regulated entities, even when they do not make headlines.
Defending Against AI-Powered Social Engineering: A Layered Approach
No single control stops deepfake fraud. Effective defence requires interlocking layers across people, process, and technology.
Layer 1: Policy and Process Controls
- Verbal call-back verification: Mandate that any financial instruction received by phone or video must be independently verified by calling back on a pre-registered number—never the number that called in. This single control defeats the majority of vishing attempts.
- Out-of-band confirmation for high-value transactions: All wire transfers above a defined threshold (e.g., ₹50 lakh) require a separate email or chat confirmation from the authorising executive, sent from their corporate account, plus a second approver.
- Code-word systems: Finance teams and C-suite can agree on rotating daily code words for emergency authorisations—an old diplomatic technique that AI cannot easily replicate without access to the internal communication.
- No-bypass policy for “urgent” overrides: Explicitly train staff that urgency claimed by the caller is a red flag, not a reason to skip controls. Legitimate executives understand and support verification procedures.
Layer 2: Email Security (FortiMail)
Deepfake vishing almost always uses a spoofed email as a precursor or follow-up. FortiMail, deployed and managed as part of PJ Networks’ MSSP stack, provides:
- Advanced anti-spoofing: Strict DMARC/DKIM/SPF enforcement, including reject policies for look-alike domains (e.g., pjnetwork5.com vs pjnetworks.com). FortiMail’s domain impersonation detection uses fuzzy matching to catch homoglyph and typosquatted sender addresses.
- AI-based BEC detection: FortiMail’s built-in ML model scores email tone, urgency signals, and impersonation patterns—flagging messages that use language typical of wire-transfer fraud even when the domain passes SPF checks.
- Executive impersonation protection: Display-name spoofing (e.g., “Sanjay Kumar <attacker@gmail.com>”) is caught and quarantined before it reaches the inbox.
- FortiSandbox integration: Attachments and URLs in suspicious mails are detonated in a sandboxed environment before delivery—blocking the weaponised Word documents that sometimes accompany vishing calls.
Layer 3: Zero-Trust Network Access (ZTNA)
If an attacker does compromise credentials via social engineering, ZTNA limits the blast radius:
- Continuous identity verification: Under a ZTNA model managed by PJ Networks (FortiGate + FortiClient ZTNA), every access request is validated against device posture, user identity, location, and time-of-day policy—not just a username and password.
- Micro-segmentation: Finance systems, ERP modules, and treasury portals are isolated. Even if an attacker harvests credentials during a social engineering call, they cannot pivot laterally to payment systems without triggering policy violations.
- MFA enforcement: ZTNA enforces MFA at every application layer, not just VPN login. A voice-cloned “reset my MFA” request to the helpdesk cannot unlock payment access without additional, separate verification.
Layer 4: 24/7 SOC Monitoring
PJ Networks’ 24/7 NOC/SOC team provides the human and automated detection layer that catches anomalies no policy checklist anticipates:
- Unusual transaction-pattern alerts: SIEM correlation rules trigger on after-hours ERP access, large outbound wire initiation outside normal windows, or concurrent logins from geographically improbable locations.
- Behavioural analytics (UEBA): FortiSIEM’s UEBA engine baselines each user’s normal ERP and financial application behaviour. A CFO account that suddenly accesses the payment module at 11 PM on a Sunday generates an immediate alert to the SOC.
- Threat intelligence feed: The SOC correlates IoCs from FortiGuard Labs against live traffic—flagging C2 communications, spoofed domains, and attacker infrastructure associated with active BEC/vishing campaigns targeting Indian enterprises.
- Incident response playbooks: When a potential social engineering incident is flagged, the SOC’s IR playbook kicks in: account suspension, session invalidation, finance team notification, and forensic log capture—all within minutes, not hours.
Layer 5: Employee Awareness and Simulation
- Vishing simulation exercises: Run quarterly tabletop exercises where the security team places AI-voice-cloned calls to finance staff. The goal is not to punish failure but to build muscle memory for verification procedures.
- Executive digital footprint audit: Periodically audit how much public audio/video exists for key executives. Where possible, reduce unnecessary exposure and ensure that public content does not contain personally identifying information that aids OSINT.
- Deepfake awareness training: Train staff to recognise tell-tale signs of AI voice synthesis: unnatural pacing, slight audio artefacts, inability to answer spontaneous off-topic questions, reluctance to video-confirm. Modern deepfakes are good—but not yet perfect.
The DPDP Act and CERT-In Angle
India’s Digital Personal Data Protection (DPDP) Act 2023 and CERT-In’s April 2022 cybersecurity directions add a compliance dimension to social engineering defence:
- CERT-In 6-hour reporting: A successful deepfake-driven wire fraud that compromises employee credentials or accesses personal data triggers CERT-In’s mandatory 6-hour reporting obligation. Organisations without a 24/7 SOC will almost certainly miss this window.
- DPDP data breach obligations: If the social engineering attack results in access to employee or customer personal data (common when HR is targeted for payroll fraud), DPDP notification obligations to the Data Protection Board apply.
- Board-level accountability: DPDP and SEBI’s cybersecurity circular place explicit accountability on Boards and CISOs. “We didn’t know deepfakes were being used against us” is not a defensible position after 2025.
A Practical Checklist for Indian CISOs
- ☐ Implement mandatory call-back verification for all financial instructions above threshold
- ☐ Deploy FortiMail or equivalent with DMARC-reject + executive impersonation detection
- ☐ Enforce ZTNA / application-level MFA for ERP, treasury, and HR systems
- ☐ Conduct at least one AI-vishing simulation per quarter
- ☐ Audit executives’ public audio/video exposure annually
- ☐ Ensure 24/7 SOC with UEBA and SIEM correlation for after-hours financial anomalies
- ☐ Map deepfake-fraud scenarios into CERT-In 6-hour reporting incident response runbooks
- ☐ Brief Board/Risk Committee on deepfake fraud risk and confirm it is in the enterprise risk register
How PJ Networks Can Help
PJ Networks is a trusted managed-security partner for Indian enterprises seeking to build multi-layer defences against AI-powered threats:
- FortiMail managed deployment — end-to-end email security including anti-BEC, sandbox detonation, and executive impersonation protection, fully managed and tuned by our security engineers.
- FortiGate NGFW + ZTNA — next-generation perimeter and application-layer zero-trust access, ensuring that even successful credential theft cannot translate into financial system access.
- 24/7 NOC/SOC services — round-the-clock monitoring, UEBA-driven anomaly detection, and rapid incident response aligned to CERT-In timelines.
- MSSP advisory — helping CISOs build the right mix of policy, technology, and awareness controls mapped to DPDP, CERT-In, and RBI/SEBI cybersecurity frameworks.
Deepfake CEO fraud is not a future risk—it is an active threat. The question for Indian enterprise IT leaders is not whether their organisation will be targeted, but whether their controls are strong enough to catch it before the wire transfer goes out. PJ Networks is here to make sure they are.
To discuss a deepfake-readiness assessment or to learn more about our FortiMail, ZTNA, and 24/7 SOC services, contact PJ Networks today.
