Short answer: assume any request to move money could be fake, no matter how real the voice, video or email looks. Protect your company with a few firm controls: verify every new payment request and bank-detail change through a separate, known channel; require two approvals for payments above a set amount; never let urgency override process; and train everyone who touches payments.
Why this is urgent
AI tools can now imitate a person's voice and face convincingly. In one widely reported 2024 case, an employee at the engineering firm Arup transferred about $25 million after a video call in which the "CFO" and other colleagues were deepfakes. Cybersecurity is already one of the top risks cited by middle-market leaders, and smaller companies, with fewer people and less formal controls, are attractive targets.
How these scams usually work
- An urgent request from the "CEO" or "CFO" to pay a new vendor or close a confidential deal
- A "supplier" asking to update bank details before the next payment
- A video or voice call that seems to confirm the request
- Pressure to skip normal steps because of time or secrecy
Controls every company should have
- Call-back verification: confirm any new payee or bank change by calling a number already on file, never one provided in the request.
- Dual approval: require two people to approve payments above a set threshold and all first-time payments.
- Locked vendor master: limit who can change vendor bank details, and log every change.
- No exceptions for urgency: make it clear that executives will never ask anyone to bypass the process.
- Payment platform controls: use approval workflows and positive pay features from your bank and AP software.
- Code words or secondary checks: for leaders who approve large transfers, agree on a verification step that a fake could not know.
- Training: brief everyone in finance, operations and executive support at least twice a year.
If you think you have been targeted
Stop the payment, contact your bank immediately to attempt a recall, preserve the messages and call recordings, and report the incident to law enforcement and your insurer.
Frequently asked questions
Does insurance cover deepfake fraud?
Sometimes, depending on your crime and cyber policies. Review coverage, limits and conditions with your broker.
Are small companies really targets?
Yes. Smaller companies often have fewer controls and faster, more informal payment processes.
What is the single most effective control?
Independent verification of any new payee or bank change through a known, separate channel.
Want a review of your payment controls? See our special projects or talk with our CFO team.