Incident Overview
In July 2024, executives at Ferrari and WPP were targeted in separate but similarly sophisticated deepfake fraud attempts. Fraudsters impersonated Benedetto Vigna, CEO of Ferrari, using a cloned voice, and Mark Read, CEO of WPP, through a combination of AI-generated voice cloning, manipulated video footage, and a fake WhatsApp account. Both attempts aimed to extract financial information and funds by exploiting the trust associated with senior leadership positions.
The WPP incident involved fraudsters creating a WhatsApp account using a publicly available image of Mark Read. They then initiated a Microsoft Teams meeting, where they deployed a voice clone of Read alongside YouTube footage of him to simulate a virtual meeting. Off-camera, the scammers impersonated Read through the meeting’s chat window, targeting an agency leader with requests to set up a new business and solicit money and personal details. The Ferrari incident involved a voice clone of Benedetto Vigna, though specific details of the communication method remain unreported.
Both attempts were thwarted when the targeted executives asked verification questions that the impostors could not answer. WPP confirmed the incident in an internal email to leadership, emphasizing the need for vigilance against AI-driven fraud techniques. Ferrari also publicized the attempt to warn its staff about similar risks.
The attacks highlight the growing sophistication of deepfake technology in corporate fraud, where scammers combine AI voice cloning with simpler tactics like using publicly available images or video footage to enhance credibility.
The WPP spokesperson stated that the phishing attempt was unsuccessful due to the vigilance of employees, including the targeted executive. The company has also reported dealing with fake websites and unauthorized communications using its brand name, reinforcing the need for heightened security measures.
Possible Root Cause
The root cause of these incidents lies in the accessibility and sophistication of AI-driven deepfake technology. Voice cloning tools, which can generate highly convincing imitations of a person’s voice using minimal audio samples, have become widely available.
In the WPP case, fraudsters exploited multiple layers of deception: a fake WhatsApp account with a publicly available CEO image, AI-generated voice cloning, and manipulated video footage from YouTube. The use of Microsoft Teams as a platform for the fake meeting added an additional layer of authenticity, as it mirrored legitimate internal communications. The scammers also leveraged psychological manipulation by framing their requests as urgent or confidential, such as setting up a secret acquisition or transaction.
The Ferrari incident, while less detailed, followed a similar pattern of voice cloning, suggesting that fraudsters are increasingly relying on AI to mimic authoritative figures in high-stakes communications. The success of these attempts depends on the target’s inability to verify the authenticity of the voice or the context of the request, often due to the pressure of time-sensitive decisions or the assumption that a CEO would not be impersonated.
The rise of these attacks is also tied to the broader adoption of generative AI tools, which have lowered the barrier to entry for creating convincing deepfakes. Unlike earlier forms of fraud that relied on social engineering alone, modern deepfake scams integrate AI to automate and scale impersonations, making them harder to detect without proactive verification measures.
Takeaways
The incidents at Ferrari and WPP underscore the critical need for organizations to implement multi-layered verification processes for high-value communications, particularly those involving senior executives. Employees should be trained to question unexpected requests for financial transactions, personal information, or urgent actions, even if they appear to come from a trusted source.
Companies must also adopt technical solutions to detect deepfake audio and video. This includes using AI-driven detection tools that analyze voice patterns, cadence, and contextual inconsistencies.
WPP’s internal email to leadership served as an effective warning, outlining red flags such as requests for passports, money transfers, or mentions of secret transactions.
The use of publicly available images and video footage in these scams highlights the need for companies to monitor and control the dissemination of their executives’ likenesses. While it is impractical to remove all public references, organizations should audit their digital footprint and encourage executives to limit exposure of personal audio or video content.
These incidents also reflect a broader industry challenge: balancing the benefits of AI-driven innovation with the risks it introduces. WPP’s partnership with Nvidia to create AI-generated advertisements demonstrates the dual-edged nature of generative AI. As companies integrate AI into their operations, they must simultaneously invest in cybersecurity measures to counter its misuse in fraudulent activities.
For executives and employees, the takeaway is clear: no communication, no matter how authentic it appears, should be trusted without verification. The combination of AI sophistication and human psychology makes deepfake fraud a persistent threat, but proactive measures can significantly reduce the likelihood of success for such attacks.