The CFO on the screen was not the CFO. He almost wired the money anyway.

The man on the screen had the right shirt on.

Blue oxford, top button open, the same one he wore on Thursday's all-hands. The same bookshelf behind him. The Stanford diploma at the same angle. The same way he tilted his head when he was about to ask for something.

The employee on the other end of the call was sitting at his desk on a Tuesday afternoon in April. Two monitors. A coffee that had gone cold an hour ago. A headset he had been wearing so long he forgot it was there. The wire portal was already open in the second tab because the CFO had said, on Slack, fifteen minutes earlier, that this was urgent and he would explain on the call.

The CFO was explaining now.

A vendor in Singapore. A contract that had to close before end of business their time. A hundred thousand dollars that had to leave the operating account in the next half hour or the deal was dead. The CFO was apologetic about the rush. He was always apologetic about the rush. That was one of the things the employee liked about him.

The employee had the wire instructions in front of him. New beneficiary. Domestic receiving bank. He had the routing number typed in. He had the amount typed in. $100,000. Six zeros and a one.

His finger was on the trackpad.

I want you to picture it. Not the fraud in the abstract. The chair. The headset. The face of a man you have worked under for three years, looking at you through a screen, asking you to do a thing you have done a hundred times before. The training video did not prepare you for this. The training video was about emails with bad grammar. This man's grammar was perfect. It was his grammar.

It was not him.

I.

Here is what we know about the machine that was running on the other end of the line.

Generative AI tools that can clone a human voice from less than thirty seconds of audio are now free or near-free. Tools that can puppet a still photograph into a live video feed, mouth moving, eyes blinking, head tilting in real time, are available to anyone with a credit card and a laptop. The footage to train them is everywhere. Earnings calls. LinkedIn videos. Conference panels uploaded to YouTube. The CFO of a mid-sized American company has more public video of his face than most actors did in 1995.

The FBI's Internet Crime Complaint Center issued a public warning on April 14, 2026 about a surge in AI-generated voice and image scams. FinCEN, the financial crimes arm of the Treasury, issued an alert in November 2024 specifically about deepfake media used against financial institutions. The numbers behind those warnings are not subtle. Industry trackers reported deepfake fraud attempts rising over 1,300% year over year in 2024. The average cost per successful incident in the financial services sector was over $603,000 USD per company. Deloitte projects generative AI-enabled fraud losses in the United States will reach $40 billion USD by 2027.

Read those numbers slowly. Then remember that every one of them started with a person at a desk with a finger on a trackpad.

II.

I sold things over the phone for twenty years before I ever ran a real business. I know what the inside of a pitch sounds like. I know the rhythm. The hello. The warm-up. The pivot. The urgency. The close.

What I am telling you is that the machine on the screen that day was running the same script I used to run on retirees from a metals room in Chicago in the 1980s. Authority. Urgency. Scarcity. A small ask that becomes a big ask. A trusted voice that does not give you time to think.

The only thing that changed is the trusted voice is now anyone they want it to be.

In January 2024, a finance worker at the engineering firm Arup, in their Hong Kong office, sat through a video conference with what appeared to be the company's chief financial officer and several colleagues. He had doubts about the request. The doubts went away when he saw the faces. He wired $25.6M USD in fifteen separate transactions before anyone in the real Arup learned the meeting had happened. The case was reported by Hong Kong police and confirmed by the company.

Every face in that meeting was a file.

That is the new shape of the room.

III.

Back to the desk on Tuesday.

The employee did one thing right. He did not do it because of training. He did it because something in his stomach was off and he could not name what.

He asked a question.

He asked the CFO about a thing that had happened the previous week. A small thing. A joke from a meeting. Nothing important. Nothing a stranger would know.

The face on the screen paused.

Not long. Maybe a second. Maybe two. The mouth kept moving for a fraction of a beat after the audio caught up. The eyes did the thing eyes do when a model is generating instead of remembering. The CFO laughed and changed the subject and asked if the wire was ready to go.

The employee said his connection was bad. He said he would call back in five.

He hung up. He picked up his phone. He called the CFO's actual cell.

The CFO was in a meeting two floors away and had not been on Slack in an hour.

IV.

Here is what almost happened, in the order it almost happened.

A spear-phishing email to harvest credentials. A compromised Slack token, or a spoofed channel that looked like Slack. A scraped library of the CFO's voice and face from earnings calls and the company About page. A real-time puppet running over a video call platform. A receiving account at a domestic bank, opened in the name of a shell vendor with paperwork good enough to clear KYC. A wire instruction that looked, on the form, exactly like a hundred other wire instructions that had cleared without incident.

If the employee had clicked confirm, the money would have left in seconds. It would have moved from the domestic receiving bank within minutes. By the time the real CFO heard about it, the funds would have been on a second hop, then a third. The recovery rate on these wires, once they leave the country, sits in the single digits.

A hundred thousand dollars. Gone in the time it takes to refill a coffee.

V.

I want to be careful here. The story I am telling you came from a Reddit post in r/Scams. One employee. One near-miss. No filing, no police report I can point to, no court docket. I cannot tell you the company. I cannot tell you the city. I cannot verify the shirt was blue.

But the machine I am describing is not a Reddit story. The machine is in the FBI advisory. The machine is in the FinCEN alert. The machine is in the Arup case. The machine is in the 1,300% year-over-year increase. The machine is running right now, somewhere, on a laptop, generating a face that someone at a desk is about to trust.

If we got the shirt wrong, we got the shirt wrong. The puppet we got right.

VI.

The thing I want you to take from this is not that you should be afraid of video calls. You will not stop taking video calls. Your boss will not stop being your boss. The face will keep being the face.

The thing I want you to take is this.

The old fraud signals are dead. Bad grammar. Weird email addresses. Stiff phrasing. Cultural slips. A foreign accent where there should not be one. All of it. Dead. The machine fixed all of that. The machine speaks in the exact voice of the person you trust most in the building.

What is left is process.

A second channel. A phone number you already have in your contacts, dialed independently, before the wire goes out. A code word agreed on in person months ago. A rule that says no wire over a threshold leaves on the same call that requested it. A pause. Even a thirty-second pause. The machine cannot afford a pause. The machine needs the wire to leave inside the urgency window because the urgency is the only thing holding the lie up.

The employee in the story did not have a code word. He had a stomach.

He got lucky. He happened to remember a small joke from a meeting the puppet had not been trained on.

Luck is not a control.

VII.

He sat at his desk for a while after he hung up the phone. The wire portal was still open. The amount was still typed in. $100,000. The confirm button was still lit.

He closed the tab.

Then he opened it again. He stared at the form. He thought about the version of the afternoon where he had clicked. He thought about the email he would have sent at 5 p.m. saying the wire was done. He thought about the morning he would have walked in to find out what he had actually done.

He told his manager. His manager told the real CFO. The real CFO told the security team. The security team will write a report. The report will go in a folder. The folder will join thousands of other folders this year, in companies all over the country, that say the same thing.

We almost sent it. We did not send it. This time.

The man on the screen had the right shirt on.

He just was not the man.