The email will look identical to your finance person's email. The thread will look real, showing the CEO's "just get it done" directive to the team, copying the necessary people. The PDF invoice will look correct, and the account number will be accurate. It may come on a Saturday and the CEO's "I want this DONE before Monday" directive will make you anxious and eager to get it resolved swiftly.
But it's fake. And the voicemail that the "CEO" left will be in her actual voice, but that too is fake. Artificial intelligence tools will scrape her recent interview on YouTube and produce a perfect sounding note. They'll reference you by nickname from social media, and they'll fake the caller-ID to show her actual mobile number.
Your only recourse? Authenticate things on your terms. If "they" call you, tell them "let me call you back." If they say "I'm not at my normal number, call this one instead" don't do it.
These are going to get harder, more devious, more sinister, and nearly impossible to discern from legitimate requests. Can you keep your skepticism and vigilance active every day?