how it happened
- whofraudstersCEO photo, cloned voice
- the targetan agency leaderasked to set up a business
- how it stoppedattempt failedCEO warned all staff
what everyone assumed
When the face is familiar and the voice matches and the meeting carries the weight of the org chart, the brain stops auditing and starts cooperating. That is not a lapse, it is how meetings are supposed to work. A leader who interrogated the identity of everyone on every call would not last a week, so we extend trust to the people we recognise, and recognition is exactly what was being manufactured.
what happened
The setup did not begin in the meeting. According to the account WPP’s chief executive Mark Read later gave in an email to staff, the fraudsters first built a WhatsApp account using a publicly available image of him, the kind of photo that sits on a corporate site and an investor deck and a hundred news pages. From there they arranged the Teams meeting. Inside it they ran a voice clone of one executive and played YouTube footage to supply the moving face, while impersonating Read himself off-camera through the meeting chat. Every ingredient was something the company had already published or said in public.
step by step
- a WhatsApp account with the CEO's public photo
- a Teams meeting with a cloned voice and YouTube videoThe CEO is impersonated in chat.the assumption breaks here
- the targeted leader does not act
- 2024the CEO warns staffNo money moves.
how it surfaced
The attempt failed. The targeted leader did not act on it, and Read described the scam in an email to leadership, asking colleagues to stay alert to techniques that go beyond email and into virtual meetings, AI, and deepfakes. The figure that matters here is not a loss. It is the count of synthetic elements stacked into one call: a cloned voice, repurposed video, a spoofed messaging account, all assembled from material the public could find. No money moved.
A familiar face and a matching voice are no longer proof of who is on the call.
They are now things that can be assembled from whatever the company has already put into the world.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe fake CEO asks for money and personal details for a 'new venture'.what it costs youThe manager says no, and your process held because someone paused.
- or it goes like thisit happenedArup deepfake fraud, 2024howA video call full of deepfaked executives asks for urgent transfers.what leavesmoney, in several transfers in one daywho ends up with itfraudsters who built the call
- or it goes like thisit happenedFacebook and Google, 2019howInvoices arrive in a real supplier's name with new bank details.what leavesmonths of supplier paymentswho ends up with ita fraudster abroad
sources
your turn
what you can do about it
this week
Find the approval step that does not rely on a call, a chat or a face.
Someone on your team will join a video call this week where a senior person asks, with some urgency, for a payment or a set of credentials or a quiet favour outside the usual process. The call will look right. The one place to look this week is your payment and onboarding approvals: is there a step that does not live inside any meeting, a callback to a known number or a second approver, that an urgent request has to pass through no matter whose face is on screen. WPP's attempt was stopped by a person who did not act on the call alone.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →