Deepfake Payment Requests: Build an Independent Verification Rule

01 / Field notes

Executive Summary

The dangerous part of a convincing impersonation is not always whether the voice sounds real. It is whether the request can bypass the process that normally protects money, account details or sensitive records. If one urgent video call can authorize a bank-detail change, the process is fragile even when the call is genuine.

FBI guidance on business email compromise emphasizes independent verification of payment and account changes. Its deepfake-awareness material also warns that realistic media can support impersonation. [1][2] The practical response is a rule that works regardless of whether a message was generated by AI: verify the requested action through a trusted channel and keep approval separate from execution.

This article offers a workplace tabletop exercise. It does not claim a deepfake-detection accuracy rate or provide instructions for creating impersonation media.

02 / Field notes

Prerequisites / Lab Setup

Ask the finance or operations owner to select a fictional supplier and invented payment details. Use no real bank accounts, money transfers or recordings of employees. Tell participants that an exercise is taking place; the objective is to improve the process, not embarrass someone with an undisclosed deception test.

Prepare the current procedure for changing supplier details, the trusted contact record and the escalation route when the usual approver is unavailable. Record who can request, verify, approve and execute a change. In a very small team, identify the compensating review that prevents one hurried person from silently doing all four.

03 / Field notes

Technical Analysis

Move the decision away from appearance

Visual glitches, odd phrasing or an unusual accent can prompt caution, but their absence does not authenticate a request. Equally, poor video quality is not proof of fraud. Focus on the transaction: what is changing, why now, who has authority and how was the destination verified?

Consider a fictional supplier that emails new bank details, followed by a video call apparently from its account manager. Both contacts arrive through channels supplied in the same message chain. They are not independent evidence. The verifier should use the previously established contact route and ask about the requested change without relying on the new contact details.

Design a rule people can actually follow

“Be vigilant” transfers responsibility to an individual without giving them a method. A useful rule names the trigger and the next step: any change to payment details requires verification through the trusted supplier record and approval by a second authorized person before the master record is updated.

Include a route for genuine exceptions. If a supplier has changed its phone number, the team needs a controlled identity and record-update process. Otherwise staff may invent workarounds under pressure. Document the evidence required and who can approve the exception; do not let the requester define that evidence in the urgent message.

Protect the contact directory itself. A trusted callback is only as reliable as the record used to place it. Limit who can edit supplier contacts, retain an audit trail where available and review simultaneous changes to contact and payment information as a combined risk.

Run the tabletop from request to decision

Read the fictional request aloud and ask each participant what they would do next. Follow the process through verification, approval, record update and payment execution on paper. Note the point where someone lacks a trusted number, cannot reach an approver or feels unable to delay an executive request.

A good result is a documented decision with a traceable verification path. A useful failure is a concrete process gap, such as an outdated supplier directory. Do not score staff on whether they guessed “AI” correctly. The protective action should be the same when the attacker uses an ordinary email, a compromised mailbox or synthetic audio.

Prepare for more convincing media

Future improvements in generated media may remove familiar warning signs. They do not remove the value of controlled authorization, independent records and separated duties. Build the workflow around these stable properties rather than a list of artifacts that may become obsolete with the next model release.

04 / Field notes

Mitigation / Defense

Keep evidence without circulating sensitive recordings or payment details broadly. If mailbox compromise may be involved, use the email account recovery guide. Review connected-app permissions too: a mailbox can remain exposed through an authorized integration after a password change.

05 / Field notes

References

Sources checked 28 October 2026. The process and fictional supplier scenario are editorial examples, not financial advice or a report of an actual fraud. The guide does not promise that a callback or second approval eliminates every risk; it explains how to make a sensitive decision more accountable and harder to redirect through one channel.

1. Business email compromise ↗FBI IC3 · accessed 2026-10-28
2. Deepfake scams awareness infographic ↗FBI IC3 / ABA Foundation · accessed 2026-10-28

Questions readers ask