Deepfake CFO Fraud in Australia: Governing Synthetic BEC Risks Under APES 110

Deepfake CFO fraud in Australia converts a familiar business email compromise into a more convincing treasury attack. A finance employee may receive an urgent email, followed by a video call or telephone instruction apparently delivered by the CFO, director or trusted adviser. Synthetic audio and video can imitate tone, appearance and organisational context. If the organisation treats recognition of the person as authentication, the attacker may be able to redirect a supplier payment, replace bank details or initiate an exceptional transfer.

This is not merely an IT problem. It is a financial-control, professional-ethics and board-governance issue. APES 110 requires members to apply professional competence and due care, maintain objectivity and use a conceptual framework to identify, evaluate and address threats to compliance with the fundamental principles. It does not prescribe a particular deepfake control, but known impersonation risks should inform how a professional accountant designs and follows payment procedures [APESB: APES 110 Code of Ethics for Professional Accountants].

Principal Advisor Graham Chee, FCPA, CPA, leads Local Knowledge’s principal-led practice in Mascot, NSW. This guide explains how synthetic media BEC works, why familiar approval methods fail, how to separate banking-token powers, and how directors and finance leaders can establish evidence-based, out-of-band verification. The objective is not to identify every fake. It is to prevent an unverified communication from becoming an irreversible movement of money.

APES 110 applies to members and establishes fundamental principles including integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. For accountants involved in treasury, accounts payable or control design, synthetic impersonation is relevant because it can create pressure, intimidation, self-interest and familiarity threats. A familiar-looking executive may cause an employee to place personal recognition above contradictory evidence.

Professional competence and due care under section 113 includes maintaining the knowledge and skill required for competent professional service and acting diligently in accordance with applicable technical and professional standards. It does not mean an accountant guarantees that fraud will never occur. It does mean that emerging threats should not be ignored where they are relevant to the work [APESB: APES 110, Section 113 Professional Competence and Due Care].

The conceptual framework in section 120 requires a member to identify, evaluate and address threats to compliance with the fundamental principles. In practice, safeguards may include mandatory call-backs, segregation of duties, transaction limits, independent beneficiary verification and documented exceptions. If pressure from a director or executive would require a member to override a control without adequate evidence, the member should escalate the matter and document the professional judgement applied.

Confidentiality also matters. A verification process should not expose passwords, token responses, payroll data or sensitive transaction information unnecessarily. APES 110 supports disciplined judgement; it should not be represented as prescribing particular software or making a business immune from AI wire fraud.

Effective dual authorisation is a design principle, not simply a bank setting. It requires two genuinely independent people to review defined transaction attributes before release. Their authority should be appropriate to the amount and risk, and neither should be able to complete every critical step alone.

A practical model uses risk tiers. Routine payments to established beneficiaries may follow standard maker-checker controls. A first payment, changed bank account, unusual jurisdiction, amount outside normal patterns or executive-directed exception should move to enhanced verification. High-risk transactions may require a director-level approver who is not the requester, plus bank release by another authorised officer.

A control sequence for AI voice-clone scams is:

1. The preparer matches the payment to the invoice, contract, purchase approval and supplier master record.
2. A separate person verifies new or changed bank details through a known contact using independently sourced details.
3. The first approver reviews the beneficiary, amount, purpose, timing and exception flags.
4. The second approver independently reviews the same transaction in the banking platform rather than approving from an email summary.
5. The bank releaser uses an individually assigned token or secure banking credential and confirms the transaction shown on the trusted device.
6. Evidence of verification, approvals and any exception is retained with the payment record.

Delegations should specify limits, prohibited self-approval, temporary coverage and emergency procedures. Dormant users and former employees should be removed promptly. These measures also support reliable financial records under section 286 of the Corporations Act 2001 [legislation.gov.au: Corporations Act 2001, section 286].

No control framework is literally audit-proof or fraud-proof. The defensible objective is an audit-ready system that shows how the organisation identified the risk, assigned accountability, implemented controls, tested operation and remediated deficiencies. Minutes, policies and system logs should agree with actual practice.

Directors should oversee material cyber-enabled financial risks as part of their broader governance responsibilities. Section 180 of the Corporations Act requires directors and officers to exercise care and diligence. Whether conduct satisfies that duty depends on the circumstances; installing software alone does not discharge it [legislation.gov.au: Corporations Act 2001, section 180]. Boards should obtain enough information to challenge concentrated payment powers, repeated exceptions, shared credentials and unresolved audit findings.

An audit-ready governance file should include the payment-authority matrix, supplier master-data procedure, banking-user register, token allocation, training records, exception log, incident plan and periodic control-test results. Sample testing should trace transactions from obligation to bank release and verify that both approval and beneficiary checks occurred.

Management should also decide how a suspected loss will be escalated, investigated and reflected in the accounts. Material events arising after the reporting period require assessment under AASB 110, while possible insurance or recovery assets require careful analysis rather than automatic recognition [AASB: AASB 110 Events after the Reporting Period].

At least annually—and after a banking, personnel or system change—the control owner should test whether a convincing executive impersonation could still cause payment without independent verification.

In principal-led practice, the most useful question is not whether an employee should have recognised a fake voice. It is whether the transaction could move from request to release without independent evidence. Controls should remain effective when the message is persuasive, the apparent executive is senior and the deadline feels genuine. That means giving employees authority to stop, verify and escalate without being penalised for delay. It also means reviewing the actual banking permissions and token custody rather than relying only on written policy. APES 110 supports this disciplined, evidence-based exercise of professional judgement [APESB: APES 110 Code of Ethics for Professional Accountants].