Problem: A Deepfake CEO Hands You to a “Lawyer.” Finance Wires the Money.

Here is a sentence no finance team wants to read in an incident report: the employee joined a video call with the CFO and several colleagues, everyone looked and sounded right, and the money went out the same day.

The problem

In February 2024, Hong Kong police described a case in which an employee at the local office of a multinational transferred about HK$200 million, roughly US$25 million, after a video conference in which every other participant was an AI-generated fake, including a person presented as the company's UK-based chief financial officer. The target was later confirmed to be the engineering firm Arup, which said no financial systems were compromised.

That last part is the uncomfortable bit. Nothing was hacked. The attackers did not need credentials, malware or a zero-day. They needed a face, a voice and a reason to hurry.

The FBI's Internet Crime Complaint Center warned in December 2024 that criminals are using generative AI, including cloned audio of executives and AI-generated video, to make fraud and social engineering schemes more convincing and harder to spot.

Now follow the logic one step further. If you are building a story that justifies a large, urgent, secret payment, the most natural supporting character is not another finance person. It is a lawyer. "Our outside counsel at a large international firm will send you the wiring instructions" is a sentence that closes down questions rather than inviting them.

The fraud doesn't need to break anything. It borrows two things people trust without checking: the boss's face and a law firm's name.

The diagnosis

You have this problem if any of the following is true, and most legal departments can tick at least two.

• "Confidential deal" is legal's vocabulary. Secrecy is the hook. Your people are trained to keep M&A quiet, so "don't discuss this internally, work only with counsel" sounds normal instead of alarming.
• Nobody outside legal knows who your real outside counsel are. Ask your accounts payable lead to name three firms you currently have on a live matter. If they can't, they can't spot a fourth one that doesn't exist.
• Payment instructions arrive through too many doors. Email, phone, a PDF on convincing letterhead. If any channel can change where money goes, every channel is an attack surface.
• Verification is slower than the fraud. If checking whether a request is real takes two days and the request says "today," the process loses.

The solution: six fixes, mostly boring, all effective

1. Publish one rule everyone can quote

Legal never changes payment instructions by phone, email or chat. Put it in writing, send it to finance, treasury and executive assistants, and repeat it quarterly. A rule people can say out loud beats a 40-page policy nobody opens.

2. Make your outside counsel list a system, not a memory

Keep approved firms, engaged lawyers and active matters in a matter management system. Then give finance a one-question path: "Is this firm engaged on a live matter?" Legal answers yes or no without revealing anything about the deal itself.

3. Route law firm payments through e-billing only

If outside counsel payments only ever flow through your e-billing and spend management platform, with bank details verified at firm onboarding, then an invoice or wire request arriving any other way is a red flag by definition. You have turned "does this feel legitimate?" into a process check, which is a much better question.

4. Call back on a known number, every time

Any urgent request involving money, a new counterparty or a confidential deal triggers a call-back to a number from your own records, never one supplied in the request. For executive-level requests, add a second approver or an agreed verbal challenge phrase. Synthetic voices are good at sounding like your CFO. They are bad at knowing something only your CFO knows.

5. Build a confidential-deal verification lane

Give employees a sanctioned way to check a secret deal without breaking the secret: a named person in legal, or a short intake form, that answers "yes, proceed" or "stop." A compliance hotline works if it is fast. If verification takes three days, people will skip it and apologise later.

6. Run the tabletop

One hour with treasury, accounts payable and two executive assistants. Play the scenario out loud: urgent call, familiar voice, confidential acquisition, a partner at a firm nobody has worked with before, wire today. Watch where the process bends. Fix that. Repeat in six months, because the fakes will be better by then.

Rollout tips

• Start with the rule, not the tooling. The one-line payment rule can go out this week and costs nothing.
• Co-own it with finance and security. Legal supplies the counsel data and the verification lane; they supply the payment controls.
• Make the yes/no check fast. Name a backup so the answer doesn't depend on one person's calendar.
• Train the assistants. Executive assistants field the urgent calls first and are rarely in the fraud briefing.
• Log the near misses. The attempt that failed tells you more about your weak point than the ones that never reached you.

The bottom line

Fighting AI-assisted fraud does not require buying AI. It requires legal to make its own relationships verifiable: who our firms are, what they are working on, and how they get paid. Get those three facts into systems other departments can query, starting with matter management tools in the CorporateLegal.tech directory, and the script stops working.

This article is general information, not legal advice.

Sources

1. cnn.com
2. cnn.com
3. ic3.gov