Cybersecurity · Data protection · Liability
It is their voice. It is their face. But it is not your boss.
For a sensitive payment, a familiar appearance cannot replace an approval process.
Case status23 September 2026 edition · sources checked on 22 September.
01
A documented risk, not a newly invented alert
On 24 January 2026, Belgium’s federal prosecutor and Centre for Cybersecurity warned about scams impersonating the King and other public figures. Business leaders were among those targeted. The announcement describes video images as likely AI-generated. That wording matters: it is not public forensic confirmation of every individual recording. [1]
The fraud does not always depend on spectacular technology. Safeonweb also describes preparatory research into an organisation, impersonation of a trusted person, and requests for money or information. Urgency and secrecy are used to bypass controls. Convincing video strengthens an appearance; it does not authorise a transaction. [2,3]
02
Recognition, authority and evidence are different questions
A credible request is not necessarily authentic. Even if an identity is verified, the transaction must still be approved through the organisation’s decision-making process. Our practical approach separates three steps: recognising the person, checking the instruction and confirming the necessary authority. Success at one step should not silently replace the others.
If the incident also reveals a personal data breach, a separate GDPR assessment is required. Under Article 33, the controller notifies the supervisory authority without undue delay and where feasible within 72 hours of awareness, unless the breach is unlikely to result in a risk to rights and freedoms. The processor informs the controller without undue delay. Informing affected individuals involves a high-risk threshold and the conditions of Article 34. Not every impersonation call therefore automatically triggers a GDPR notification. [4]
Neither recovery of funds nor reimbursement can be promised merely because impersonation is alleged. The facts, transactions and applicable legal framework require examination. Prevention, reporting and securing relevant information can proceed without prejudging that assessment. An urgent operational response and a legal conclusion are not the same thing.
03
The Law Right approach: a second route before paying
- Call back using an established number obtained independently of the suspicious message. Have any new beneficiary checked and retain the normal approval process for sensitive payments. A request for discretion must not remove the usual control. [2]
- If the transfer has already been made, contact the bank and internal responsible persons immediately. Report the fraud to the police as appropriate. Acting quickly matters, but does not guarantee that the money can be recovered. [2,3]
- Secure relevant incident material: original messages, times, contact details and payment references. Coordinate its preservation with the appropriate person. Avoid circulating sensitive evidence unnecessarily, even when colleagues understandably want to know what happened.
Recognition is not verification.
An urgent request does not remove the need to verify.
Conceptual illustration created with AI assistance — not real data or an automated legal outcome.Even when a request appears to come from a superior, people must be able to pause and verify.
