An urgent payment request from your boss might sound legitimate, but the voice on the other end could be an AI-generated imitation. Cybercriminals are using deepfake audio and video to impersonate trusted individuals, tricking employees into transferring money, sharing confidential information, or granting unauthorized access to company systems.
For small and medium-sized business owners, managers, and employees, recognizing a fake voice or video isn’t always possible. Protecting your business requires knowing which requests deserve extra scrutiny, how to verify instructions through trusted channels, and what to do when you suspect a scam.
What workplace deepfake scams look like
A deepfake is media created or altered with artificial intelligence to appear authentic. Criminals can use synthetic audio and video, including voice cloning technology that mimics a person’s speech patterns to make fabricated messages sound authentic.
In the workplace, scammers may impersonate a company owner through a phone call, instructing the accounting team to transfer money to an unfamiliar bank account. They could also use a fabricated video of a senior executive to request access to confidential files. Because these instructions appear to come from someone in authority, employees may be more likely to comply without verifying whether the requests are legitimate.
Look beyond how convincing the person sounds
Deepfake scams rely on social engineering tactics that manipulate people into compromising the company’s security. When a request appears to come directly from a company owner or senior executive, employees may feel obligated to comply without questioning its legitimacy.
Scammers may exploit that sense of authority by creating urgency or discouraging employees from seeking confirmation. For example, a supposed executive might demand an immediate payment, insist that the request remain confidential, or instruct someone to bypass the usual approval process. These behaviors should raise suspicion regardless of how convincing the person sounds or how reasonable their explanation seems.
Although deepfake audio and video sometimes contain noticeable flaws, such as unnatural pauses or mismatched lip movements, these aren’t reliable indicators of fraud. Poor connection quality can produce similar issues, while sophisticated deepfakes may appear completely authentic. Rather than relying on visual or audio clues alone, employees should pay closer attention to the nature of the request and independently verify any instructions involving money, sensitive information, or system access.
How to verify requests before you act
When a request involves money or sensitive information, step outside the conversation to verify it. Challenging someone mid-call proves nothing because an impostor will confirm their own identity without hesitation.
Instead, employees should follow a consistent process:
- Pause the action: End the incoming call or leave the meeting before approving the request.
- Contact the person independently: Use an established company directory or vendor record. Avoid numbers and links supplied in the suspicious message.
- Confirm the details: Ask whether they requested the specific action. For instructions to change payments, verify the destination with your established vendor contact.
- Hold unresolved requests: If you cannot reach the person, contact the designated manager and wait for confirmation.
Verifying the requester’s identity is only part of the process. Employees must also confirm the specific action being requested, including payment amounts, banking details, or information to be shared. Even legitimate requests can contain errors or misunderstandings, which is why independent verification should complement your company’s existing approval procedures.
For higher-risk transactions, such as substantial payments or sensitive account changes, require approval from a second authorized person. This additional reviewer should independently check the request and its supporting details rather than relying solely on the first employee’s confirmation.
Make verification the norm
A verification process only works when employees understand what they’re expected to check and how to do it. Managers should establish clear procedures for handling sensitive requests, particularly payment changes, account resets, and access to confidential information. These procedures should identify who can authorize each action and who employees should contact when the usual approver is unavailable.
Employees also need reliable ways to reach the people they’re trying to verify. Keep company directories and vendor contact records up to date, and make sure managers follow the same verification procedures as everyone else. Staff should feel comfortable taking the time to confirm a request, even when it appears to come from senior leadership.
Companies can reinforce these practices through regular security awareness training. Short exercises involving suspicious calls or impersonation attempts can help employees practice following verification procedures. Use their feedback to identify confusing instructions or gaps in the process, then address them before a real incident occurs.
Report suspected scams promptly
If you suspect a deepfake scam, stop the requested action and report your concerns to your manager or IT provider. Preserve the original message and any relevant call details to help with the investigation.
If you’ve already acted on the request, report exactly what happened so the appropriate people can respond quickly. For fraudulent payments, immediately alert your finance team so they can contact the bank and attempt to recover the funds. Alternatively, you should notify IT if you have shared login credentials or confidential information so they can proactively secure affected accounts and assess potential exposure.
Employees should feel comfortable reporting suspected scams, even if they’ve already made a mistake. The sooner an incident is reported, the greater the opportunity to contain the damage and prevent further losses.
Clear verification and reporting procedures can make all the difference when a suspicious request comes through. Contact Spectrumwise to strengthen your workplace security practices and prepare your team to respond to deepfake scams.