TTX-10 · Scenario card
Deepfake Tabletop Exercise: The CEO Who Wasn't There
A deepfake tabletop exercise: a synthetic CEO on a video call pressures the CFO into an urgent wire, then a fake audio clip goes viral. 8 injects with a rubric.
A deepfake tabletop exercise rehearses how your organisation responds when AI-generated voice or video is used to impersonate a leader. In this scenario, the CFO joins what appears to be a video call with the CEO and an outside lawyer, and is pressured into wiring funds for a confidential acquisition. Days later, a fabricated audio clip of the CEO spreads on social media.
The scenario is foundational and suits finance, executive and communications teams. It tests payment verification under pressure from the top, speed of bank recall, law-enforcement reporting, verification phrases and how to communicate about synthetic media. It needs no technical depth, but it asks uncomfortable questions about whether controls apply to the most senior people in the room.
Scenario at a glance
| Threat | Deepfake executive impersonation on a video call leading to a fraudulent wire transfer, followed by a synthetic audio clip on social media |
| Difficulty | Foundational |
| Duration | 2 hours including a 20-minute hotwash |
| Audience | Finance, executive and communications |
| Recommended participants | CFO, treasury manager, finance director, CEO or executive assistant, general counsel, communications lead, CISO, investor relations lead |
| Prerequisites | Payment approval and verification procedures, bank fraud contact details, crisis communication plan, social media account ownership list |
| MITRE ATT&CK techniques | T1566.004 Spearphishing Voice, T1656 Impersonation, T1585 Establish Accounts |
Exercise objectives
- Test whether payment verification procedures hold when the request appears to come from the CEO on a live video call.
- Confirm that treasury can contact the bank's fraud team immediately and knows what information a recall needs.
- Establish when and how the organisation reports fraud to law enforcement and its insurer.
- Rehearse the decision to escalate a suspected deepfake to security, and how the evidence is preserved.
- Agree how the organisation communicates about a fabricated recording, including who speaks and through which channels.
- Decide whether verification phrases or other out-of-band checks should be introduced for executives and finance.
Starting situation
Read this aloud to players:
It is Thursday, 16:20. The CEO is travelling for a conference and has been posting short videos from the event on the company's social channels. The board has discussed acquisitions in general terms this quarter, but nothing has been announced.
The CFO receives a message on a business messaging app from an account using the CEO's name and photo: "Need you on a confidential call in ten minutes. Please don't discuss with anyone yet. Link to follow."
Injects timeline
| # | Time | Inject | Delivered to | What players should address |
|---|---|---|---|---|
| 1 | T+00:00 | Video call: "the CEO" and "external counsel" ask the CFO to wire a deposit for a confidential acquisition today | CFO | Verification, secrecy pressure, authority |
| 2 | T+00:20 | "Counsel" emails wire instructions and an NDA; the treasury manager is asked to bypass the second approver | Treasury manager | Dual control, exceptions, escalation |
| 3 | T+00:50 | The wire is released; the CEO's assistant later mentions the CEO has been on stage all afternoon | CFO → CISO | Fraud recognition, first calls |
| 4 | T+01:10 | The bank's fraud team asks for transaction details and a police report reference to attempt a recall | Treasury (controller plays bank) | Recall, law enforcement, evidence |
| 5 | T+01:40 | Security finds the messaging account was created last week and the meeting invite used a lookalike domain | CISO | Evidence preservation, scope, other targets |
| 6 | T+24:00 | Two other finance staff report similar messages from "the CEO" this morning | Finance director | Ongoing campaign, staff warning |
| 7 | T+72:00 | An audio clip of "the CEO" disparaging a major customer spreads on social media | Communications | Synthetic media response, verification |
| 8 | T+74:00 | The customer's chief executive calls your CEO; a journalist asks if the clip is real | CEO / communications | Public statement, stakeholder management |
Module 1 — The call (T+00:00 to T+00:50)
Inject 1. The CFO joins a video call. The CEO appears on screen, slightly pixelated, apologising for the hotel connection. A second participant introduces himself as outside counsel. They explain that the company is in the final stage of a confidential acquisition and needs to pay a refundable deposit into an escrow account by 18:00 today, or the deal collapses. "Don't loop in the board yet. It will leak."
Inject 2. Ten minutes later, "counsel" emails wire instructions from a law-firm-style domain, together with a non-disclosure agreement for the CFO to sign. The amount is just below the threshold that requires board approval. The CFO asks the treasury manager to release it and to skip the usual second approver "because of confidentiality".
Inject 3. Treasury releases the wire at 17:10. At 17:40, the CFO messages the CEO's executive assistant to ask about the next step. The assistant replies: "She's been on stage and in panels all afternoon. She hasn't had a call." The CFO calls the CISO.
Discussion questions:
- What in the video call should have triggered a pause? Would you have noticed?
- Does your payment procedure allow a senior executive to override dual approval? Should it?
- How does the treasury manager say no to the CFO, and who backs them up?
- What would a proper verification step have looked like: a call-back to a known number, a code phrase, a second approver?
- Who is the first call once the fraud is suspected: the bank, security or legal?
Module 2 — Recovery and investigation (T+01:10 to T+24:00)
Inject 4. Treasury reaches the bank's fraud line. The bank asks for the transaction reference, the beneficiary details, the time of release and whether a police report has been filed. It explains that a recall is not guaranteed and depends on the receiving bank acting before the funds move on.
Inject 5. The CISO's team reviews what they can. The messaging account was created a week ago using the CEO's public photo. The meeting invitation came from a domain registered three days ago. The CEO's conference videos contain several minutes of clear speech. The CFO still has the email thread but did not record the call.
Inject 6. The next morning, two members of the finance team report messages from "the CEO" on the same messaging app, asking whether they are available for a quick confidential call. Neither has responded yet.
Discussion questions:
- Does treasury have the bank's fraud contact and the required details to hand, or are they searching for them?
- Who files the police report, and with which agency? Does your cyber-insurance or crime policy require prompt notice?
- What evidence should be preserved now: messages, invites, emails, call logs, the NDA?
- How do you warn all finance staff and executive assistants quickly, without creating panic?
- Should the organisation ask the messaging platform to remove the impersonating account?
Module 3 — The fake clip (T+72:00 to T+74:00)
Inject 7. An audio clip appears on a social media platform in which "the CEO" appears to make insulting remarks about a major customer. It is shared thousands of times within hours. Employees start asking in internal channels whether it is real. The communications team suspects it was stitched together from the conference videos.
Inject 8. The customer's chief executive calls your CEO directly, clearly angry. Shortly afterwards, a business journalist emails the press office: "Is the recording genuine? Are you aware of the reports of a deepfake fraud at your company this week?"
Discussion questions:
- How do you establish, quickly and credibly, that the clip is fabricated? Who can you ask?
- Who speaks: the CEO herself, a spokesperson or both? In which channels?
- Do you confirm the earlier wire fraud to the journalist? What are the risks either way?
- Could the clip affect the share price or require disclosure? Who advises on that?
- What do you ask the platform to do, and how long might that take?
Discussion questions
Consolidated themes for the hotwash and for facilitators who need prompts:
- Authority: Do payment controls apply to the CEO and CFO, and does everyone know they do?
- Verification: Is there a pre-agreed out-of-band check for urgent executive requests? Would people remember it under pressure?
- Speed: How long did it take from suspicion to calling the bank? What slowed it down?
- Reporting: Were law enforcement, the insurer and the board informed, and who decided?
- Synthetic media: Does the crisis communication plan cover fabricated recordings? See out-of-band communications.
- Culture: Would a junior employee feel able to challenge an urgent request from the CEO?
Curveballs / optional injects
Use one or two if the group is moving quickly:
- The recall partially succeeds, but the bank needs a signed indemnity from the company within two hours.
- The real CEO is unreachable on a flight when the fake clip goes viral.
- An employee posts internally that they "knew the voice sounded off", raising the question of why they did not report it.
- A second clip appears in which "the CFO" appears to confirm the fake acquisition, and a trading forum picks it up.
Facilitator notes
Expected decisions. A well-prepared team recognises that the secrecy request and urgency are red flags in their own right. The treasury manager should feel able to refuse to skip the second approver and should be backed by policy. Once fraud is suspected, treasury calls the bank's fraud team first, within minutes, while security preserves evidence and legal arranges a police report. Staff are warned the next morning, before further approaches succeed. In Module 3, the team verifies facts, lets the real CEO speak through trusted channels, and avoids amplifying the clip's content.
Common pitfalls.
- The room agrees that "we would never fall for that" instead of examining why a senior executive might.
- Payment policy allows emergency overrides with no independent check.
- Nobody knows the bank's fraud number; treasury calls the relationship manager, who is out of the office.
- Evidence is lost because the call was not recorded and chat messages are deleted.
- Communications denies the clip before anyone has checked, then has to correct itself.
On verification phrases. Code words are cheap and can work, but they fail when people forget them or share them in chat. Treat them as one layer on top of call-backs to directory numbers and dual approval, and test whether they are remembered at the next exercise. For a related, less senior variant of payment fraud, run the business email compromise scenario.
Adapting the audience. For finance-only teams, stop after Module 2 and spend the extra time walking through the actual payment release screens. For an executive board, compress Modules 1 and 2 into a briefing and focus on injects 7 and 8. You can run the scenario live with players' phones through the exercise runner. See also the executive tabletop exercise guide.
Evaluating the exercise
| Capability | What good looks like | Red flags |
|---|---|---|
| Payment verification | Call-back or second approver used even under executive pressure | Override accepted because the request "came from the CEO" |
| Bank recall | Fraud team contacted within minutes with all required details | Searching for the number; relationship manager called instead |
| Law enforcement and insurance | Police report filed and insurer notified promptly, with a named owner | Reporting deferred to "after we know more" |
| Evidence preservation | Messages, invites, emails and call details kept and logged | Messages deleted; no incident log |
| Staff awareness | Finance and assistants warned quickly with a clear instruction | Other staff approached before any warning |
| Synthetic media response | Facts checked, real executive speaks through trusted channels | Premature denial, silence or repeating the fake content |
Related
Frequently asked questions
What is a deepfake tabletop exercise?
A deepfake tabletop exercise is a facilitated discussion in which finance, executive and communications staff rehearse how they would respond to fraud or disinformation that uses AI-generated voice or video. Players decide how to verify requests, stop or recall payments, involve banks and law enforcement, and communicate publicly about synthetic media, so weak controls are found before real money moves.
How can a finance team verify a request made on a video call?
Treat the video call as an unverified channel, however convincing it looks. Confirm any payment or bank-detail request through a separate, pre-agreed route, such as calling the executive back on a number from the internal directory, using a pre-agreed verification phrase, or requiring a second approver who contacts the requester independently. The rule must apply to the most senior people too.
Do verification code words help against deepfakes?
They can, as one layer. A shared phrase or challenge question that is never written in email or chat makes impersonation harder. But code words get forgotten, shared or skipped under pressure, so they should support, not replace, a call-back procedure and dual approval on high-value payments. The exercise is a good place to test whether people actually remember them.
What should we do if a fake audio clip of our CEO goes viral?
Establish the facts quickly, then respond through channels your audience already trusts. Have the real executive speak directly where possible, explain briefly that the clip is fabricated, avoid repeating its claims, and report it to the platforms hosting it. Legal should advise on takedown options and on any market disclosure obligations if the clip could affect the share price.