> ## Content Index
> Fetch the complete content index at: https://www.backdoor.news/llms.txt
> Use this file to discover other available public pages before exploring further.

# CEO fraud: strong authentication is no longer enough
- URL: https://www.backdoor.news/en/ceo-fraud-strong-authentication-is-no-longer-enough/
- Published: 2026-10-20T08:00:00.000Z
- Updated: 2026-11-12T18:04:37.000Z
- Description: Voice clones and synthetic videos bypass controls designed to verify a device, not an intention.
- Author: Grégory Raymond
- Tags: Cybersécurité, #tribune, #en, #invite, #expert-sofia-benali-en, #pair-t3

*Demonstration op-ed. The author, the company and the situations described are fictional.*

For years, the financial sector’s answer to payment fraud came down to two words: strong authentication. A code sent to a phone, an approval in the app, a fingerprint. These mechanisms have proved effective against credential theft. They are almost useless against the new generation of fraud, which steals nothing: it persuades.

## The target is no longer the password

The scenario is now familiar. An accountant receives a call from the chief financial officer. The voice is his, so is the tone, and he mentions a real matter known to only a few people. A confidential acquisition requires a quick transfer to a foreign account. She logs in, approves the payment on her phone, and strong authentication works exactly as designed. It certifies that she is the one giving the order. It does not certify that the order is legitimate.

At our company, we recorded four attempts of this kind against our business clients in one year. Two relied on a voice clone, one on a short synthetic video shown on a video call, with the camera “failing” after twenty seconds.

## Verify the intention, not the device

The answer is not primarily technological. It lies in procedures that companies often find cumbersome: dual approval by a different person for any unusual transfer, a systematic call-back to a known number rather than the one given in the exchange, and a waiting period for new payees above a threshold.

As payment providers, we can help by flagging unusual transactions at the moment of approval rather than afterwards, by clearly displaying the name of the payee account’s real holder, and by offering companies limits that can be set for each member of staff.

## A question of liability

That leaves the awkward question. When a transfer is correctly authenticated but obtained through manipulation, who bears the loss? Case law increasingly protects individuals. Companies are often left alone with the damage. Until this allocation is clarified, incentives to invest in prevention will remain poorly aligned, and fraudsters will keep targeting the most profitable weak point: trust.