Friday, a quarter past six in the evening. Someone in treasury receives a voice note on WhatsApp. It is my voice. The way I say their name, the rush I have when I am leaving a meeting, even my filler word. I ask them to send a payment to a law firm today, say it is confidential, and that I will explain on Monday.
That person does nothing wrong. They recognize their boss and obey. That is exactly the problem.
It has not happened to us yet. I am writing this so that, if it happens one day, the response will already be decided.
Why does my voice no longer prove anything?
For years, hearing the boss was the best possible confirmation. An odd email could be doubted. A call in their voice could not.
That is over. Copying a voice takes material. I have given it away without thinking: interviews, videos, presentations, voice notes in groups with people I do not even know. In May 2025, the FBI published an alert about voice messages generated with artificial intelligence impersonating senior officials. It warned that a cloned voice can sound almost identical to the real one. The European Union Agency for Cybersecurity says the same thing from another angle: in its 2025 threat landscape notes that AI is used especially in fraudulent calls and impersonation scams.
So I will say it plainly: sounding like me does not prove it is me.
How much does a message nobody verified cost?
This scam has a name, CEO fraud. It belongs to a family the FBI measures every year. In 2025, its complaint center recorded 24,768 business email compromise complaints and $3,046 million lost, according to its annual report. Among online frauds, only investment fraud caused more money to be lost. And in Europe, ENISA estimates that around 60% of the intrusions it analyzed started with phishing, including fraudulent calls.
These are figures from other countries and other companies. The one that keeps me up at night is smaller: a transfer made on a Friday afternoon that by Monday can no longer be reversed.
The most uncomfortable part is that none of this breaks a system. There is no virus to detect and no stolen password. There is a loyal person doing what their boss asks.
What does the CEO need to do?
Much less than it seems, but without any exception.
It is not my job to learn to detect fake voices. It is my job never to ask anyone to skip the procedure. Every time an executive says “send it this time, we'll formalize it later,” they teach their team that the boss's urgency is a valid exception. And that is exactly what the attacker will imitate.
It is also on me to be grateful when people verify me. If someone in finance calls me to confirm a payment I did request, that is not distrust or bureaucracy. It is the system working. Whoever gets annoyed by the check is training their people not to do it next time.
And it is on me to say it out loud, in front of everyone, before it is needed. Hence this piece.
The agreement
At ZetTateK, the rule is this: no transfer goes out on the strength of a message, however urgent it sounds and however much it sounds like my voice. It is confirmed through a second channel, one not chosen by the person asking for the money. If the message says “call me at this number,” you call the one that was already in the contact list.
Technology helps you see the blow coming. A SOC 24/7 can detect the unusual access to the CFO's email before the voice note arrives. But the last line of defense is a person with permission to say “let me confirm that.”
If you want to know the current state of the executive and finance mailboxes at your company, start with the free security assessment.
And if one day you receive a message from me asking for money in a hurry, do what I say here, not what the voice note says.
