Short answer
If you receive an urgent payment request that appears to come from your CEO, a client, or a vendor, do not act on it directly. Deepfake voice technology can clone a person's voice from a short audio sample, so hearing a familiar voice is not proof of identity. Instead, apply this rule: confirm the request through a separate channel that the caller cannot control. Hang up, then call back on a number you already have on file, or reach the person through another independent method such as a different phone line, email, or in person. Also require a second person to approve any urgent payment. This practice aligns with due diligence principles recommended by the U.S. International Trade Administration for verifying business partners and transactions. While deepfake fraud is relatively new, the basic verification habit remains your strongest defense.
Why Deepfake Voice Fraud Is a Growing Risk
Deepfake voice fraud is an evolution of the classic fake-boss scam. Attackers obtain a short audio clip of a real person, often from social media, voicemail, or recorded meetings, and use AI tools to create a convincing voice clone. They then call an employee, pretend to be the executive or a trusted partner, and urgently request a wire transfer or a payment to a new bank account. Because the voice sounds exactly like the real person, even trained staff may lower their guard. The International Trade Administration notes that performing due diligence is essential when dealing with partners and buyers; it involves verifying identities and reputations. That principle applies internally as well: never assume an incoming call is genuine just because it sounds familiar.
Fraudsters exploit urgency and authority, two powerful pressures that bypass normal safeguards. They create a scenario that demands immediate action, often claiming a confidential deal or a time-sensitive invoice. The average employee may not know that modern voice cloning requires only seconds of audio, so they treat the call as authentic. Awareness of the risk is the first step toward building a protection protocol.
- Attackers can obtain voice samples from social media, recorded meetings, or even phone calls.
- Urgency is their main weapon: they pressure you to act quickly before you verify.
- Anyone with authority to request payments can be imitated, not just executives.
The Verification Rule: Confirm Through a Separate Channel
The core rule is simple: if a payment request comes via phone, email, or text, confirm it through a different channel that the requester cannot simultaneously control. For example, if you receive a call from your CEO, do not reply directly. Hang up and call back using the CEO's number from your own directory, not one provided by the caller. If that number goes to voicemail, try another known line, such as the main office switchboard, or reach the person via a colleague they work closely with. The goal is to use a path independent of the original communication.
Additionally, set up a pre-arranged code word or phrase with your team and key partners. This password must be exchanged before any urgent payment instruction is accepted. Even if the voice sounds right, the absence of the code word is a red flag. Such a protocol is a practical application of due diligence, as described by the U.S. International Trade Administration for exporters verifying foreign partners. It adds a layer of authentication that fraudsters cannot easily bypass.
- Always call back on a known number-never the one the caller provides.
- Ask a question only the true person would know, like a project detail or a personal fact.
- If the request involves a new vendor, a changed bank account, or a large sum, demand written confirmation and a second approval.
Five Immediate Steps to Verify Urgent Payment Requests
When you face an urgent payment request, follow these steps in order. First, note the caller's claim: who they say they are, the amount, and the reason. Second, politely end the conversation, saying you need to check something in your system. Third, verify the person's identity through a known-good channel. Use your own directory, not any contact details they provided. Fourth, confirm the payment details and amount with an authorized second person in your company, such as your CFO or another manager. Fifth, if you suspect fraud, stop the payment immediately and report it to your bank and internal security.
This procedure is a form of due diligence, a practice highlighted by trade.gov for evaluating partners and transactions. By treating every urgent request as a potential threat, you minimize the risk of falling victim to a scam. Even if a transfer has been initiated, immediate reporting may allow your bank to reverse it.
- Keep an updated list of emergency contacts with official numbers for each executive and supplier.
- Enforce a dual-approval rule for any wire transfer over a set threshold.
- Instruct your team to treat any unexpected urgent request as a red flag, not a reason to skip checks.
Building a Fraud-Prevention Habit for Your Team
Verification is not a one-time activity but a continuous habit. Organize a short training session to role-play a mock deepfake call, so your team can practice responding without panic. Write a one-page policy: no payment is made solely on the basis of a phone call; all urgent payments require callback verification and approval from at least two people. Place this policy near phones and in email signatures. The World Bank's Business Ready methodology emphasizes that a robust business environment includes efficient regulatory and public services, but companies must also adopt internal controls to protect themselves.
Review your policy quarterly, because fraud techniques evolve. Log every suspicious request, including the supposed caller, amount, and verification steps taken. Encourage employees to report anything out of the ordinary without fear of blame. A proactive culture is your best defense, as scammers often target those who are not paying attention.
- Review your policy quarterly, since fraudsters adapt quickly.
- Log every request for payment, including the requested amount, the supposed caller, and the verification steps you took.
- Encourage employees to report suspicious calls without fear of blame-this culture helps catch scams early.
What to Do If You Suspect Fraud or Have Already Paid
If you suspect fraud or realize you have sent money to a fraudster, act without delay. Call your bank immediately using the official fraud emergency number, not any number you received from the caller. Request a recall or freeze on the transfer. Then file a report with your local law enforcement and any national cybercrime unit. If you shared sensitive information, such as bank details or passwords, change them at once. Preserve all records of the communication-time, number, and content-as they may help investigators and possibly aid in fund recovery.
The World Bank's Business Ready framework discusses how regulatory frameworks and public services can support business operations, but the first step in fraud cases is always reporting. Yourself. Ensure your team knows these steps in advance, so they can respond rationally in a stressful situation.
- Contact your bank at the emergency number for fraud, not the one provided by the caller.
- Report to your national fraud authority and any relevant cybercrime unit.
- Change passwords and security codes if you shared any sensitive information.
What to verify
- Specific fraud reporting procedures vary by country; check with your local authorities and financial institution for exact steps.
- This article provides general guidance, not legal or security advice. Consult your legal and IT security teams to tailor a policy to your company's risk profile.
- The World Bank source discusses the business environment broadly and does not provide specific fraud prevention measures; it is cited only for context on regulatory and public services.
Questions and answers
How does deepfake voice fraud work?
Fraudsters collect a short audio sample of a person's voice from social media, recorded calls, or voicemail. They use AI tools to clone that voice, then call you pretending to be that person. Because the voice sounds exactly like the real person, you might be tricked into believing an urgent payment request is legitimate. The essential defense is not to trust the voice alone but to verify through an independent channel. [1]
What is the separate-channel verification rule?
The rule is: if a payment request comes in via phone, email, or text, you must confirm it using a different communication method that the requester does not control. For example, after receiving an urgent call, hang up and call back on a known number from your directory, or use another channel like a personal visit. This ensures that the request is genuinely from the person you think it is. [1]
Are there tools to detect deepfake voices?
Some software exists to analyze audio for signs of deepfake generation, but it is not always reliable and may be unavailable to small businesses. The most effective defense is procedural: always verify identity through a separate, known-good channel, and require a second approval for urgent payments. This approach works regardless of the technology used by fraudsters. [2]
Sources and verification date
- Official source: trade.govtrade.gov · Checked
- Official source: worldbank.orgworldbank.org · Checked