Singapore office workers vulnerable to AI CEO scams

KnowBe4 has published research on deepfake vulnerability among office workers in Singapore. It found that 36% of respondents were not confident they could distinguish a genuine message from their Chief Executive Officer from an AI-generated one.

The findings are based on an online Censuswide survey of 500 Singapore-based office workers who use email or computers for work.

The report highlights a gap between confidence and behaviour in the workplace. Senior managers were the most likely to say they could spot a fake message or voice, with 78% saying they would be able to do so. Yet they were also the most likely to comply with a cloned Chief Executive Officer voice before verifying it.

The compliance rate among senior managers was 35%, more than double the 16% recorded among clerical workers. The data suggests that perceived familiarity with executive communications does not necessarily reduce the risk of deception.

Across the workforce, the research found a reluctance to challenge authority. Half of respondents said they would feel uncomfortable challenging a request from a senior executive, while 52% said they would worry about negative consequences if they did so.

Another 45% said they would be as worried about delaying a request from a senior leader as they would be about accidentally causing a cybersecurity incident. A further 9% said they would rather risk a breach than delay the boss.

Training gap

The study also found limited preparation for this type of threat. Only 26% of respondents said they had received training specifically on AI-generated scams involving senior leaders.

According to the report, that training was concentrated among senior managers, even though this group also showed the highest stated likelihood of complying with a cloned executive voice before checking it. The figures suggest that training exposure has not yet translated into stronger verification habits.

KnowBe4 said the issue may be underestimated inside organisations. Only 10% of respondents identified employees trusting senior leaders too readily as the greatest cybersecurity risk facing their workplace.

The report describes the problem as a combination of workplace hierarchy and increasingly realistic AI-generated impersonation. Voice cloning and synthetic messages can exploit internal reporting lines and deference to senior staff, particularly in fast-moving situations where employees feel pressure to respond quickly.

The risk extends beyond junior staff. The survey indicates that senior personnel may also be exposed because confidence in their own judgement can lead to early compliance before checks are completed.

Dr Kawin Boonyapredee, CISO Advisor at KnowBe4, said the issue was rooted as much in workplace behaviour as in technical deception.

"In Singapore, hierarchy works like a trust shortcut, one that AI-enabled scams are now designed to exploit," said Dr Boonyapredee. "A cloned voice or a convincing message from 'the boss' doesn't need to fool the technology. It only needs to activate an instinct not to question authority. Closing that gap requires training and simulations to change behaviour at every level of seniority, not just awareness at the top."

The research comes as businesses face a growing volume of fraud attempts using generative AI to imitate trusted contacts, including senior executives. These attacks can be delivered through email, voice messages and phone calls, and often rely on urgency or confidentiality to discourage verification.

For employers, the findings highlight a governance issue as well as a security one. Verification processes may exist on paper, but employees may hesitate to use them if they believe questioning a senior figure could carry professional risk.

The survey covered office workers in Singapore who use digital tools in their jobs, offering a broad view across corporate roles. The results suggest organisations face two points of exposure at once: staff who are uneasy about challenging leadership, and leaders who may overestimate their ability to detect impersonation.