The €2.4m trap: How one deepfake nearly brought down a business  

When an accountant in the finance department of a European manufacturing firm received a video call from their CFO asking them to approve a €2.4m payment to a well-known supplier, there was nothing obviously suspicious about it. 

The unannounced call was unusual, but the CFO provided a plausible explanation and stressed that the supplier needed to be paid urgently. The video looked real, and the familiar voice and mannerisms appeared genuine. The accountant believed the request was legitimate and approved the transfer.  

Only later did they discover the truth. The person on screen wasn’t their CFO, but a sophisticated deepfake created using AI-generated audio and video. By then, the €2.4m payment had already been processed and lost to fraud. 

The incident highlights a growing threat for businesses. As deepfake technology becomes more convincing and accessible, fraudsters are using AI to scale increasingly advanced attacks using social engineering tactics, exploiting familiar faces and voices to bypass your fraud controls. 

The scale of the threat is growing. According to Security Today, deepfake-based fraud losses in the US reached  US$ 1.1bn  in 2025,  three times the US$ 360m recorded the previous year. 

Like a hunter laying a trap in the jungle, the fraudsters in this case had created a convincing illusion. The company had fraud protection measures in place, but they weren’t designed to detect a sophisticated deepfake attack that appeared to come directly from a trusted executive. 

The company was a fast-growing manufacturer of automotive parts, headquartered in Germany, and with factories and distribution centres across several countries. It had expanded rapidly over the preceding few years, entering new markets, engaging new customers and working with new overseas suppliers. As a result, the volume of financial transactions the company needed to manage was growing.  

With a larger workforce and more complex international structure, the company was relying increasingly on digital communication to stay connected. Delegation was essential to maintain the pace of growth, and employees were entrusted to be proactive and take necessary steps to keep the business moving.  

But the more growth accelerated, the more tasks needed delegating, and the more disjointed the company’s communications became. Like pathways leading you through the jungle – the more your expedition grows, the bigger your chances are of encountering danger. And the more vulnerable you become to attack. 

Social engineering tactics work by exploiting human psychology. In this case, the fraudsters didn’t succeed by relying only on technology. They used their knowledge of the business and its internal processes to set up a scenario that felt familiar and legitimate to persuade the accountant to approve the payment.  

First, the accountant received an email appearing to come from the CFO – a trusted figure of authority and someone they would normally report to. Next, they were directed to a video call, where the familiar face and voice of the CFO reinforced the legitimacy of the request. Finally, the urgency of the request discouraged any further checks and prompted the accountant to act quickly.  

Crucially, the request didn’t seem to break the company’s normal ways of working. Delegation and employee autonomy were commonplace, so the accountant believed they were simply doing their job. This is why the trap worked so well: because it didn’t look like a trap at all. The fraudsters lured the accountant into a false sense of security so that they felt confident approving the payment, believing they were acting correctly.  

In the jungle, when you get caught in a hunter’s trap, first you assess the level of damage before looking for a way out. It’s the same when a business falls victim to fraud. For a fast-growing, international company, one large fraudulent payment can easily start a chain reaction whose consequences extend far beyond the immediate financial loss.  

In this case, the manufacturer faced serious consequences. €2.4m was a large sum for a company of this size, and the loss immediately put pressure on working capital, threatening payments to its other suppliers.  

Operating costs were also at risk, with the company facing the prospect of being unable to meet salary obligations and office rental costs for the coming months. Its long-term expansion plan was also in jeopardy.  

Perhaps more damaging still was the potential reputational fallout. From suppliers to customers and staff, confidence in the manufacturer was shaken. Left unresolved, that broken trust could have taken years to rebuild.  

Fortunately, the company didn't have to face those consequences alone. Because the manufacturer had our Business Fraud Insurance in place, the financial loss was covered – relieving the immediate pressure on working capital and allowing the business to resume normal operations far sooner than it otherwise could have. As a result, the manufacturer could refocus on its growth plan and on restoring confidence. 

In the business jungle, there are different types of fraud trap. This incident highlights an important distinction between different forms of protection. Trade credit insurance, for example, protects against non-payment by genuine customers, helping you manage the impact when a real buyer fails to pay. Meanwhile, cyber insurance typically focuses on losses from cyber events such as ransomware attacks, data breaches or major disruption to your IT network.  

Neither type of insurance necessarily provides cover for this type of social engineering attack. While the fraudsters in this case did use technology to create convincing deepfakes of the CFO, the loss did not result from a technology failure or a genuine customer failing to pay. Instead, technology was used to manipulate the accountant into approving a fraudulent payment.  

This is where our Business Fraud Insurance can play a crucial role. It covers losses arising from certain types of external fraud, including those driven by social engineering tactics such as CEO fraud, fake buyer fraud or payment diversion. It also covers internal fraud, including theft, embezzlement or sabotage.

Traps are everywhere in the business jungle. To make it through safely, surviving one isn’t enough. The key is to learn from the experience,  read the terrain  more carefully and become better at spotting what lies ahead.    

In this case, the attack taught the manufacturer a valuable lesson: fraud is evolving fast, and traditional protections are struggling to keep pace. In an era when familiar faces, recognisable voices and apparently genuine communications can’t be taken as proof that someone is who they claim to be, companies need to continually reassess the checks and processes they rely on to stay secure.  

This means the answer isn’t simply to ask your employees to be more careful. Even the most well-prepared businesses can be caught out by a carefully targeted deepfake attack. Your goal should be to make it harder for any one incident to become a truly costly mistake, and to build in layers of protection so that when one fails, another steps in to reduce the risk.

The dangers lurking in the jungle are constantly changing. Deloitte  predicts that generative AI could drive fraud losses in the US to US$40bn by 2027, up from US$12.3bn in 2023 – a compound annual growth rate of 32%. 

With fraudsters using the latest technologies to manipulate and exploit human behaviour, businesses need to stay one step ahead. Preparation is the key to surviving fraud traps, whether that’s through strengthening your existing controls, training staff or building internal processes that don’t simply rely on trust. It’s also about having the right insurance in place to protect you when fraud bypasses your safeguards.

Our Business Fraud Insurance is designed to help you mitigate today’s evolving fraud risks. With our support, you can move forward with confidence, knowing you’re protected from hidden fraud traps.