Deepfake Executive Impersonation on Earnings Calls: A Regulatory Response Playbook for Public Companies and Their IR Teams

The voice on the earnings call sounds exactly like your CFO. The cadence, the vocabulary, the slight pause before discussing guidance — all unmistakably familiar. But it isn't her. It's a deepfake, and by the time your investor relations team realizes what's happened, the market has already moved.

This is no longer a hypothetical. Deepfake executive impersonation is an emerging and rapidly escalating threat vector for public companies. In 2024, a multinational firm lost over $25 million after a finance employee was deceived by a deepfake video call impersonating the company's CFO. As generative AI tools become cheaper, more accessible, and more convincing, the attack surface for publicly traded companies — where executives regularly appear in recorded, streamed, and broadcast communications — grows exponentially.

For investor relations (IR) teams, legal counsel, and boards of directors, the question is no longer if this will happen — it's when, and whether you'll be ready when it does.

Understanding the Threat Landscape

Deepfake impersonation in the context of earnings calls represents a convergence of several risk categories: cybersecurity, securities law, market manipulation, and reputational damage. Threat actors — whether financially motivated, nation-state affiliated, or activist in nature — can synthesize convincing audio or video of a CEO or CFO making false statements about earnings, guidance, M&A activity, or regulatory matters.

The downstream consequences are severe. False statements made under the guise of an executive can trigger SEC disclosure obligations, investor litigation, stock price volatility, and regulatory investigations — even when the company is the victim, not the perpetrator. The SEC's enhanced focus on material cybersecurity incident disclosure under its 2023 rules adds another layer of urgency: a deepfake attack that influences market behavior may itself constitute a reportable event.

Step 1: Conduct a Pre-Incident Risk Assessment

Before building a response playbook, IR teams must first understand their exposure. This means auditing how much publicly available audio and video exists of your key executives — earnings calls, conference presentations, media interviews, and investor day footage. Every clip is potential training data for a voice or face clone.

Engage your CISO and a third-party threat intelligence provider to assess your organization's deepfake risk profile. Identify which executives are most exposed, which communication channels are most vulnerable, and whether any threat actor has already begun collecting or weaponizing executive media assets. This assessment should feed directly into your incident response plan.

Step 2: Establish Authentication Protocols for Live Executive Communications

Authentication is your first line of defense. Public companies should implement layered verification procedures for any live or pre-recorded executive communication that reaches investors or media.

For earnings calls specifically, consider working with your IR platform providers to introduce multi-factor authentication for dial-in hosts, real-time watermarking of audio streams, and cryptographic verification of pre-recorded segments. IR teams should develop internal challenge-response protocols — known only to a small circle — that can be used to verify executive identity before a live session begins. Some organizations are beginning to explore blockchain-anchored content provenance tools that can verify the authenticity of recorded media at the point of distribution.

Step 3: Build a Cross-Functional Incident Response Team

When a deepfake attack occurs, the clock starts immediately. You need a pre-designated, cross-functional response team that includes your General Counsel, CISO, Head of IR, Chief Communications Officer, and an external securities law firm with crisis experience. Each member must know their role before an incident happens.

The response team's first priority is containment and verification — confirming the attack is real, identifying the scope of distribution, and determining whether any material false statements were disseminated to investors. This assessment will drive every subsequent decision, from whether to issue a corrective public statement to whether SEC disclosure is required under Item 1.05 of Form 8-K.

Step 4: Navigate SEC Disclosure Obligations with Precision

This is where many public companies will find themselves in uncharted territory. The SEC's 2023 cybersecurity disclosure rules require registrants to disclose material cybersecurity incidents within four business days of determining materiality. A deepfake attack that causes market disruption, investor confusion, or requires a corrective statement may well meet that threshold.

Work closely with your securities counsel to evaluate materiality in real time. Consider proactive communication with your SEC Enforcement liaison if there is any risk of market manipulation allegations. Document everything — your timeline, your verification steps, your response decisions, and your communications. This documentation will be critical if the incident results in an SEC inquiry, shareholder litigation, or FINRA review.

Step 5: Prepare a Rapid Public Communications Strategy

Silence is not a strategy. If a deepfake of your CEO circulates before or during an earnings call, your IR team must be prepared to issue a rapid, clear, and factual public statement that: (1) confirms the communication was fraudulent, (2) clarifies what was and was not actually stated by company leadership, (3) directs investors to official company channels, and (4) signals that law enforcement and regulators have been engaged.

Pre-draft template statements now, while there is no crisis. Identify your approved spokespersons and ensure your IR team, PR agency, and legal counsel are aligned on approval workflows that can be executed in under two hours.

Step 6: Engage Law Enforcement and Preserve Digital Evidence

File a report with the FBI's Internet Crime Complaint Center (IC3) and notify the Secret Service if market manipulation is suspected. Simultaneously, engage your digital forensics team to preserve all evidence of the deepfake — source files, metadata, distribution pathways, and any associated social engineering attempts. This evidence chain will be essential for both criminal prosecution and civil litigation.

Building a Culture of Deepfake Vigilance

Beyond incident response, public companies must invest in ongoing education. Your IR team, executive assistants, board members, and communications staff should be trained to recognize the signs of synthetic media — unnatural blinking patterns, audio latency, inconsistent lip sync, and contextually unusual statements. Annual tabletop exercises that simulate a deepfake earnings call attack will harden your team's muscle memory before it's needed.

The Regulatory Horizon

Regulators are beginning to catch up. The SEC has signaled interest in AI-generated misinformation as a market integrity issue, and legislative proposals at both federal and state levels are targeting malicious deepfake use in financial contexts. Public companies that demonstrate proactive governance — documented policies, trained teams, and tested response plans — will be better positioned with regulators and institutional investors alike.

Deepfake executive impersonation is not just a cybersecurity problem. It is a governance problem, a securities law problem, and a trust problem. The companies that treat it as such — and build response capabilities today — will be the ones that protect their investors, their reputations, and their regulatory standing when the threat arrives.