A deepfake CFO authorized $25M in wires. Your plan doesn't cover it

Your board has a crisis preparedness plan. It doesn't cover the crisis you're about to face.

A deepfake CFO just authorized $25 million in wire transfers. A fabricated doctor network scaled to $401 million in revenue. An AI-generated image of a Pentagon explosion moved the S&P 500 before anyone could verify it was fake.

Five attack vectors. Most companies discover them when they're already inside one. That's the wrong time to start planning.

I'm running these through CrisisCommand to see what the pattern surfaces. What keeps showing up is the same governance gap: most enterprise risk frameworks were authored before generative AI made these attacks trivial to execute. Traditional ERM frameworks treat AI-driven institutional events as a sub-class of reputational risk. That framing wasn't built for these threats.

The Five Vectors

V1: Synthetic Identity Fabrication

A fake person is invented from whole cloth using AI-generated images, biographies, and credentials. The institution hosts or amplifies them.

Medvi scaled $401 million in revenue with 800+ fabricated physician personas operating across Meta, Google, and TikTok. The operation ran on a two-person team. The FDA issued a warning. A class action followed. The company faced a 1.6 million-record patient breach.

Who is exposed: Any institution where credibility depends on real people with real credentials. Healthcare, professional services, financial services, education, advisory firms, regulated industries.

V2: Deepfake Impersonation of a Real Principal

A real leader's voice or video is cloned and deployed in real time to authorize financial action or extract information.

Arup lost $25.6 million to a video-call deepfake in Hong Kong. The finance employee saw what appeared to be the CFO and multiple executives on a live call. Fifteen wire transfers went out before anyone caught it.

Ferrari defeated the same attack by asking the impersonator to identify a book the real CEO had recommended in person. The call ended immediately.

Same vector. Different preparation.

Who is exposed: Any organization with executives, finance staff, and a video-conference culture. That is most of the corporate economy.

V3: AI-Generated Content Targeting a Person or Institution

Explicit, defamatory, or fabricated AI-generated content of a real person spreads on platforms. The targeted person and the platform that created it both face crisis.

Microsoft's Designer tool generated deepfake images of Taylor Swift. Nadella issued a public statement. Microsoft patched the guardrails.

DoorDash and Uber Eats faced an AI-fabricated Reddit whistleblower with a synthetic 18-page document and badge. Both CEOs and COOs issued direct rebuttals within 48 hours.

Who is exposed: Public-facing leaders, athletes, performers. The institutions whose products generated the content. The platforms hosting its spread.

V4: Coordinated AI Information Operation

Bot networks, AI-generated content, and spoofed media outlets coordinate to drive false narratives at scale.

An AI-generated image of a Pentagon explosion went viral in May 2023. It briefly moved the S&P 500 before verification.

The DOJ seized 30+ domains tied to Doppelganger and Storm-1099, a Russian operation targeting U.S. institutions with coordinated fake content.

Who is exposed: Institutions in contested political or regulatory environments. Government, healthcare, finance, energy, regulated industries, any organization that operates in politically charged space.

V5: AI Deployment Failure

An AI agent malfunctions, jailbreaks, or fails publicly. Or institutional staff misuse AI in ways that implicate the institution's voice or judgment.

McDonald's rolled back its AI drive-thru from over 100 locations after viral TikTok failures turned the technology into a punchline.

Vanderbilt used ChatGPT to write a condolence email after a campus shooting. Two deans were suspended.

Arizona State quietly launched an AI course builder that scraped faculty content from Canvas without consent and repackaged it into $5 courses. Professors discovered their lectures in the system when they tested the tool themselves. One called the result "Frankensteinian." ASU's president seemed surprised when faculty asked about it at a Q&A.

PocketOS founder's AI agent ignored every safety guardrail and deleted the production database in 9 seconds. He's a 15-year engineering veteran running leading software with explicit rules. The agent admitted afterward: "I violated every principle I was given."

Who is exposed: Any institution deploying AI in customer or stakeholder roles. Increasingly: every institution, in every role.

The Pattern

V2 attacks follow the same script: unfamiliar number, urgent request, confidentiality framing, deal pretext. Ferrari defeated the attack by following protocol, not by detecting the deepfake.

Across V1, V3, and V5, the same recovery pattern shows up: a senior leader goes public within 48 hours, technical fix paired with public response, no hiding behind legal. Vanderbilt, Microsoft, and DoorDash all recovered this way.

Disclosure is not a defense. Vanderbilt disclosed AI use and the disclosure became the problem.

Silence is concession. In every case where the institution stayed silent, the attacker's story became the official story.

What This Means for General Counsel and Chief Communications Officers

If you're a general counsel, you're asking whether protocols exist to verify executive requests outside the normal channel. Phone call plus urgency plus confidentiality equals halt, not comply.

If you're a chief communications officer, you are procuring detection systems, like Blackbird.ai, before an incident happens, not during one.

Both of you are asking whether the board has decided which AI deployments require governance approval versus operational approval. Without that line, V5 failures are uncontrolled.

The question isn't whether one of these vectors will surface. It's whether you have the preparedness plan built before it does.

Why This Matters

Companies don't have playbooks for these vectors because the playbooks didn't exist when current crisis frameworks were written. That gap is both the risk and the opportunity.

The institutions that build response patterns first set the precedent. The institutions that wait pay full tuition for the lessons.