In January 2026, the cantonal police of Schwyz reported a case that could happen in many companies. Over two weeks, a business owner received calls from what he believed was a familiar business partner. The voice had been cloned with AI. The calls concerned a supposedly confidential international deal, and in the end several million francs had been transferred to an account in Asia.
The Federal Office for Cybersecurity (NCSC) received 971 reports of CEO fraud in 2025, up from 719 the year before. Fraudsters increasingly use the phone, WhatsApp and voice messages.
How the fraud works
The pattern is old: someone poses as the managing director, a board member or an important partner and asks for an urgent, confidential payment. In the past the request came by email, often from a domain that differs from the original by a single letter. Today the voice comes on top.
Recordings from interviews, webinars or social media videos are enough to copy a voice. The rest of the information comes from the company website, LinkedIn and the commercial register. That tells the fraudsters who has signing authority, who works in accounting and which partners the company deals with.
Video calls can be faked too
The best-known case involves the engineering firm Arup. In early 2024, an employee in Hong Kong joined a video conference with what appeared to be the chief financial officer and other colleagues. All of them were generated with AI. The employee made 15 transfers totalling HK$200 million, around US$25 million.
According to the NCSC, faked video conferences are still rare in Switzerland because they are costly to produce. Faked voices, on the other hand, are already in use, as the Schwyz case shows.
You can’t rely on your ears
A good deepfake is almost impossible to spot on the phone, especially under time pressure. Some warning signs do keep coming up:
- The matter is urgent and has to be done today.
- You’re told not to discuss it with anyone.
- The payment goes to a new account, often abroad.
- The caller dodges when you offer to call back.
Fixed procedures are more reliable than gut feeling, and they apply even when the boss seems to be calling in person.
Securing payments with call-backs and the four-eyes principle
- Call back on a known number. Every unusual payment instruction is confirmed through a second channel. You call back the number from your own address book, never the one given in the call or message.
- Four-eyes principle. Above a set amount, a second person approves the payment, set up as joint signature in e-banking. A single person who has been deceived cannot transfer money on their own.
- Protect master data. Changes to suppliers’ bank details are checked as strictly as payments. A new IBAN sent by email is a common trick.
- No exceptions for management. Management follows the rules itself and says so clearly within the company. Then nobody in accounting has to worry about annoying the boss by asking a question.
- Agree on a code word. For sensitive calls, an internal code word that never appears in emails or chats helps.
It’s also worth tagging emails from outside the company with an “External” notice. Spoofed senders then stand out sooner.
If the money has already gone
Call your bank immediately and ask them to try to stop the payment. The faster you act, the better the chances. Then report the case to the police and to the NCSC. The numbers you need belong in your IT emergency plan. Also check whether your cyber insurance covers this kind of case. Some policies exclude fraud by deception or cover it only with an add-on.
Training and procedures with A BOT
We give your staff practical training on phishing and fraudulent calls, set up warnings for external emails and help you define approval processes. To learn how to spot fake emails, read our article on spotting phishing. More under IT security.
Frequently asked questions
Can a deepfake call be detected reliably?
No. A monotone delivery or short delays are sometimes noticeable, but you shouldn’t count on it. Only calling back on a known number gives certainty.
From what amount should the four-eyes principle apply?
Each company sets this itself. A threshold of CHF 5’000 or 10’000 works for many businesses. Regardless of the amount, every payment to a new account should be checked by two people.
What should we do if we have already paid?
Contact your bank immediately, then the police. If the bank is informed quickly, it can sometimes still recall a payment.
Do technical solutions help against deepfakes?
Partly. Mail filters, warning notices and multi-factor authentication make the first step harder. Against a convincing phone call, what protects you in the end is a procedure everyone sticks to.
