In this guide · 8 sections
Short answer
Treat any urgent payment or confidential request by WhatsApp, voice note or video call as unverified, however real the person seems. Hang up and call back on a number you already have, use a code word for payment requests, and require two people to approve any new payee or unusual transfer.
How deepfake CEO scams work in Singapore
The pattern is consistent across official advisories. A joint SPF, MAS and CSA advisory in March 2025 and an SPF advisory in February 2026 describe the same steps.
A WhatsApp message from "the CEO"
Scammers create a WhatsApp account using the executive's name and public photos, and contact a staff member, often in finance.
A confidential project
The victim is told about a restructuring, acquisition or investment and asked to keep it secret, sometimes signing a non-disclosure agreement.
A video call with familiar faces
The victim joins a Zoom call with apparent senior executives, investors or even MAS officials, whose appearance is altered with digital manipulation.
A fake lawyer adds pressure
A second scammer posing as the company's legal counsel calls or emails documents to the victim's personal email.
Transfers and more requests
The victim is told to send company funds to a local corporate account, often a money mule account, and later asked for more.
What official cases tell us
SPF's April 2025 news release describes one case in detail. A finance director of a multinational was contacted on WhatsApp by someone posing as the company's CFO, joined a Zoom call with a deepfaked CEO and others, and transferred over US$499,000. He realised it was a scam when asked for a further US$1.4 million, and alerted the bank. Singapore's Anti-Scam Centre and Hong Kong police traced and withheld the funds.
CSA's advisory on deepfake scams cites a February 2024 case in the Asia Pacific region where a finance worker paid US$25 million after a deepfake video conference with a fake CFO. MAS's paper on cyber risks associated with deepfakes recommends verifying requests through a separate, trusted channel.
The verification protocol
Write these rules down, brief everyone who can move money or share confidential data, and get the directors to back them publicly. The rules only work if staff know they will never be punished for checking.
- Call back on a known number. For any request to pay, change bank details, buy gift cards or share confidential data, end the chat or call and ring the person on the number in your staff directory or phone contacts, not one given in the message.
- Use a code word. Agree a word or question between directors and finance staff for payment requests, changed regularly and never written in chat.
- Two people approve new payees. Any new beneficiary, changed bank account or payment above a set amount needs a second person to approve in the banking app.
- No secrecy exception. A request that says "don't tell anyone" is itself a red flag. Executives in your company will never ask staff to bypass checks.
- Work channels only. Payment instructions come through company email or your business messaging tool, as SPF advises, never through a new WhatsApp number or personal email.
- Pause on urgency. Any request that cannot wait 30 minutes for a call-back is treated as suspicious.
Set up your bank and systems to back the protocol
Rules are stronger when your tools enforce them.
Payment safeguards checklist
Our guide to corporate bank account scam safeguards covers bank settings in more detail. For scams where callers pose as government officers, see our guide to government official impersonation scams.
Spotting signs during a call
CSA's advisory suggests a "3A" approach: assess the message, analyse audio-visual elements, and authenticate with tools. Use the signs as a reason to stop and verify, not as proof either way.
| Check | What to look for |
|---|---|
| The message | Unsolicited, urgent, secret, unusual payment or data request |
| Faces | Blurring around face edges, uneven resolution, unnatural shadows |
| Eyes and expression | Unnatural or no blinking, inconsistent reflections, stiff expressions |
| Audio | Lips out of sync, flat tone, background noise that does not fit |
| Behaviour | Camera off or frozen when you ask a question; refusal to switch channels |
Asking something only the real person would know, or asking them to do something unexpected on camera, can expose a fake. But the call-back rule is still the decision point. Our summary of the CSA and IMDA generative AI safe-use advisory covers other AI-related risks for staff.
If money has already moved: the first hour
Speed matters. In the SPF case above, the bank and Anti-Scam Centre withheld the funds because the victim reported quickly.
Call your bank's fraud line now
Ask them to recall or block the transfer and freeze further payments to that beneficiary. Have the transaction reference ready.
Make a police report
Report to SPF online or at a police station. Mention any overseas or mule accounts the bank identifies.
Stop further contact
Do not reply to the scammers or pay anything more, whatever they threaten.
Keep evidence
Screenshots of WhatsApp chats and numbers, call logs, emails, documents received and Zoom meeting links.
Check what else was shared
If bank balances, NRIC or passport details or login codes were shared, change passwords, alert the bank and assess whether personal data was exposed.
Tell the team
Warn other staff immediately; scammers often try several people in the same company.
If in doubt at any stage, call the 24/7 ScamShield Helpline on 1799. Add this sequence to your incident response plan.
Do it yourself or get help?
Any business can adopt the protocol above today: write it on one page, set the bank approvals and brief staff in a 15-minute meeting. Repeat the briefing every few months and whenever someone new joins finance.
If you want help, our Security Awareness Training (S$390) includes deepfake and impersonation scams, payment verification rules and short refresher lessons for staff.
Frequently asked questions
Scammers impersonate a company's senior executive, usually on WhatsApp and then in a video call where their appearance or voice is altered with AI, to persuade staff to transfer company funds or share confidential data. Singapore Police Force has warned businesses about this scam variant since 2025.
Sometimes they can see blurred face edges, odd blinking or poor lip sync, but CSA warns deepfakes can be indistinguishable even to the trained eye. The reliable defence is procedural: end the call and verify any payment or confidential request by calling the person back on a number you already have.
Call your bank's fraud line immediately to recall or block the transfer, then make a police report. Keep all chats, call logs and documents as evidence, stop contact with the scammers, and warn other staff. Fast reporting gives banks and the Anti-Scam Centre the best chance to withhold funds.
Yes, as one layer. A cloned voice can copy how someone sounds but not a word only your team knows. Keep it out of chats and emails and change it regularly. It works best together with call-backs on known numbers and two-person approval for payments.