You’d be surprised. Roop isn’t perfect but it can be quite convincing sometimes and it doesn’t require much training at all. It’ll take a single face picture. Same with voice cloning, you only need 15-30 seconds of source audio to make a decent clone. You can use even less, but the quality won’t be as good. Just those two pieces of source material could be easily obtained by anyone working near the CFO’s office/anyone that knows his routine before/after work (e.g. going to a cafe, gym, etc).