FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Crime and fraud
CEO fraud is when a criminal impersonates a director or senior manager to persuade staff to make an urgent payment, now often using cloned voices or deepfake video. Because staff authorise the payment themselves, banks rarely refund it.
Part of: Commercial crime insurance
In short
CEO fraud, sometimes called fake president or executive impersonation fraud, uses authority and urgency to get money out of a business. Generative AI can let fraudsters clone a director's voice from a few public clips or join a video call as a convincing fake. The payment is authorised by your own staff, so it usually falls outside bank refund rules for anything other than micro-enterprises and small charities. Crime insurance can respond through a social engineering extension, normally conditional on verification procedures. Cover is subject to the insurer's acceptance and the policy terms.
The classic version is an email from the managing director, sent from a lookalike domain or a hacked account, asking the finance team to pay a supplier or fund a confidential acquisition today. The request discourages checking: the director is travelling, the deal is secret, the bank cut-off is near.
Deepfakes add a voice or face. A cloned voice can leave a voicemail or hold a short call. Video calls can include several fake participants, so the junior employee sees what looks like the whole senior team agreeing.
Illustrative: a finance assistant at a recruitment firm receives a video call invitation from what appears to be the finance director, joined by a person presented as the firm's lawyer. They ask for £95,000 to be sent to an escrow account to secure a deal. The voices and faces are convincing. By the time the real finance director returns from leave, the money has gone abroad.
Close cousins include fake supplier bank detail changes, covered in invoice redirection fraud: who pays, and fake requests from a client to release funds held on its behalf. The common thread is that a trusted identity is borrowed to make an unusual payment feel routine.
The impersonator commits fraud by false representation under section 2 of the Fraud Act 2006, which carries up to 10 years' imprisonment on indictment. That rarely helps you get the money back, because fraudsters are hard to trace and funds move quickly.
Your bank's position was set out by the Supreme Court in Philipp v Barclays [2023] UKSC 25: where the customer clearly authorises a payment, the bank's duty is to execute it. A narrower duty can apply where the bank has reasonable grounds to believe an agent giving the instruction is defrauding the customer, but a deceived employee is not the same as a dishonest one.
The statutory reimbursement rules for authorised push payment fraud do not cover international payments, and they protect only individuals, micro-enterprises and charities with annual income under £1 million. See APP fraud reimbursement for businesses.
It can, but rarely by default. Many crime policies exclude losses where an employee voluntarily parts with money after being deceived, because no one stole it in the traditional sense. Cover usually comes from a social engineering, fake instruction or impersonation fraud extension, explained in our social engineering fraud cover entry.
Points that commonly decide a claim:
Some cyber policies include social engineering cover too. Our crime vs cyber comparison sets out where the gaps tend to sit, and cyber insurance and AI risks covers the wider AI angle.
Deepfakes defeat recognition, not process. The controls that work are ones that do not rely on recognising a face or voice.
| Control | Why it matters against deepfakes |
|---|---|
| Call-back to a number held on file before any new payment or urgent request | The fraudster controls the call or email they started, not your internal directory |
| Dual authorisation above a threshold, with no exceptions for seniority | Removes the pressure on one person to obey an apparent director |
| A rule that payment instructions never come by video call, voicemail or messaging app alone | Synthetic media is most convincing in live or recorded audio and video |
| Code words or out-of-band confirmation for directors' urgent requests | Something a clone cannot learn from public recordings |
| Confirmation of Payee checks on every new payee | Flags a name mismatch, though a match does not prove legitimacy |
| Training on impersonation and urgency tactics, with records | Insurers often ask when staff were last trained |
The conditions attached to these extensions are covered in social engineering cover conditions.
The failure to prevent fraud offence in section 199 of the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025. It targets large organisations whose employees or associates commit fraud intending to benefit the organisation. Home Office guidance says an organisation is not liable where it is the victim or intended victim, so a business tricked by CEO fraud is not caught by it. It is still worth reading our guide to the offence, because the fraud prevention framework it encourages overlaps with the payment controls above.
Our guide to insurance after a cyber attack covers the wider incident response.
Apex arranges commercial crime insurance and fraud cover, including social engineering extensions for impersonation of directors, suppliers and customers. A broker reads each enquiry and comes back with options, with no fee for a quote, and cover is subject to the insurer's acceptance and the policy terms. We need your business activities, turnover, location and claims history, plus your payment authorisation limits, call-back procedures, training records and the social engineering limit you want.
Sometimes. Many standard crime wordings exclude money handed over voluntarily after deception, so CEO fraud is usually covered only through a social engineering or fake instruction extension, often with a lower sub-limit. The extension normally requires staff to have followed a verification procedure. Cover is subject to the insurer's acceptance and the policy terms.
It depends on the wording. Many extensions refer to instructions received by email, telephone or other means from someone impersonating an employee, supplier or customer. Some newer wordings mention synthetic media expressly. Check how the policy defines an instruction and who can be impersonated, and ask your broker to confirm in writing.
Usually not if your business is larger than a micro-enterprise. After Philipp v Barclays, a bank following its customer's clear instruction generally owes no duty to refuse it. Statutory reimbursement covers individuals, micro-enterprises and small charities for Faster Payments and CHAPS within the UK, capped at £85,000.
A call-back rule that cannot be overridden by seniority: any urgent or unusual payment request is confirmed by calling the requester on a number already held internally. Combined with dual authorisation, it defeats most impersonation, including deepfakes, because it does not depend on recognising a voice or face.
No. The offence under section 199 of the Economic Crime and Corporate Transparency Act 2023 applies to large organisations where an associated person commits fraud intending to benefit the organisation. Government guidance says an organisation is not liable where it is the victim or intended victim of the fraud.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
