'It's the CEO on WhatsApp': how employees caught the fakes
In 2024 criminals cloned the faces and voices of leaders at WPP, LastPass, WiseTech Global, Ferrari and Wiz. Each attempt failed because an employee noticed something small and checked. Here is what they spotted.
Deepfake stories usually end with a loss. These ones end differently. During 2024, criminals impersonated the leaders of at least five well-known companies using cloned voices, borrowed video or fake profiles. Every attempt below failed, and in each case the reason was a person who noticed something and checked.
We only included cases with a reputable public source. For each one, we focus on two questions: what did the employee notice, and what did they do next?
Five attempts that failed
LastPass: the wrong channel at the wrong moment
In April 2024, password manager company LastPass described an attempt on its own blog. An employee received a series of calls, texts and at least one voicemail on WhatsApp from someone impersonating CEO Karim Toubba. The voicemail used an audio deepfake of his voice.
What they noticed: The contact came through WhatsApp, which sits outside the company's normal business channels, and the messages carried the forced urgency typical of social engineering.
What they did: They ignored the messages and reported them to the internal security team. LastPass says there was no impact on the company, and it shared the tactic with industry partners.
WPP: a familiar photo and a meeting that felt off
The Guardian reported in May 2024 that fraudsters targeted WPP, the world's biggest advertising group. They set up a WhatsApp account using a public photo of CEO Mark Read, then used it to arrange a Microsoft Teams meeting that appeared to include Read and another senior executive. In the meeting they used a voice clone and YouTube footage, while "Read" typed in the chat. The target, an agency leader, was asked to set up a new business, which the Guardian describes as an attempt to get money and personal details.
What they noticed: WPP has not said exactly what tipped off the people involved, so this part of the evidence is thin. The company said the attempt failed thanks to the vigilance of its people, including the executive concerned. Read's follow-up email to leaders listed red flags: requests for passports or money transfers, and any secret deal that no one else knows about. He also wrote, "Just because the account has my photo doesn't mean it's me."
What they did: They did not go along with the request, and leadership turned the attempt into a company-wide warning.
WiseTech Global: they asked the real CEO
In May 2024, WiseTech Global founder and CEO Richard White told an Australian shareholder conference that criminals had impersonated him three times in one week, according to Capital Brief. Three employees were each targeted individually with a WhatsApp video call from someone who looked like White and asked for money.
What they noticed: White said the employees were technical and knew immediately it wasn't him.
What they did: They messaged White on Microsoft Teams, the company's normal channel, to ask whether it was really him. This account comes from White's own remarks as reported by a single outlet, so treat the details with some caution.
Ferrari: a question only the real CEO could answer
In July 2024, Bloomberg reported (republished by Fortune) that a Ferrari executive received WhatsApp messages from someone posing as CEO Benedetto Vigna. The messages came from a different number than Vigna's usual one, with a new profile picture, and hinted at a confidential acquisition. A phone call followed, using a convincing imitation of Vigna's southern Italian accent and describing a deal that needed a currency-hedge transaction.
What they noticed: A number that wasn't the CEO's usual one, a story about why he was calling from another phone and slightly mechanical intonation in the voice.
What they did: The executive asked the caller to name the book Vigna had recommended to him a few days earlier. The caller hung up. Ferrari opened an internal investigation and declined to comment to Bloomberg.
Wiz: the voice from the stage
In October 2024, Wiz CEO Assaf Rappaport told the TechCrunch Disrupt conference that dozens of employees had received a voice message that sounded like him, in an attempt to steal their credentials. TechCrunch reported that the attackers built the clone from a recording of him speaking at a conference.
That detail is what gave it away. Rappaport has public speaking anxiety, so his voice on stage sounds different from the voice employees hear in everyday conversation. The clone matched the stage version, and employees noticed it didn't sound like the colleague they knew. The attempt to get their credentials failed. Wiz traced where the audio came from but could not identify the attacker.
What the people who stopped it had in common
Look across these cases and the deepfakes themselves were often good. What failed was the context around them. The common signals were:
A familiar face or voice arriving on an unfamiliar channel or number, usually WhatsApp.
Secrecy, such as a confidential deal, a new business or a request to keep it quiet for now.
Urgency and pressure to act before checking.
A request for money, credentials or personal documents.
Small oddities in the voice, delivery or timing that didn't fit the person.
The responses were simple too. People paused, checked with the real person through a channel they already trusted, asked a question a stranger couldn't answer or reported it to security. None of them needed to prove the video or audio was fake.
Copy these checks for your team
Agree on your official channels for requests involving money, credentials or data, and say plainly that leaders will never use WhatsApp or a new number for them.
When a leader contacts you somewhere unexpected, reply on the known channel instead: a Teams or Slack message, or a call to their directory number.
Use a shared-context question if you are unsure, like the Ferrari executive did. Ask about something recent that only the real person would know, and never about anything posted publicly.
Treat secrecy plus money as an automatic pause, even if the request comes from the very top.
Report every attempt, including ones you ignored. LastPass and WPP turned single attempts into warnings for everyone.
Ask your leaders to say publicly what Mark Read said: a familiar photo or voice is not proof.
These habits work at home too. A cloned voice of a grandchild or parent on a new number deserves the same response: hang up, call the number you already have and ask something only they would know.
Sources
LastPass, "Attempted Audio Deepfake Call Targets LastPass Employee," April 10, 2024: LastPass blog post
The Guardian, "CEO of world's biggest ad firm targeted by deepfake scam," May 10, 2024: Guardian report on WPP
Capital Brief, "Extortion attempt: WiseTech CEO says criminals tried to impersonate him using AI," May 21, 2024: Capital Brief report
Bloomberg via Fortune, "Ferrari exec foils deepfake attempt by asking the scammer a question only CEO Benedetto Vigna could answer," July 27, 2024: Fortune republication of Bloomberg report
TechCrunch, "Wiz CEO says company was targeted with deepfake attack that used his voice," Oct. 28, 2024: TechCrunch report
Or let NimBot handle it
Every one of these saves started with an employee who knew it was OK to check. You can do all of this yourself, and it works. If you'd rather not run it alone, NimBot handles the training, the drills and the reminders for your whole team. Try it at app.nim.bot.