A practical verification process for finance teams facing unexpected payment changes, executive impersonation and convincing voice calls.
Look at the decision being requested
A call arrives shortly before the end of the day. The voice sounds familiar and the caller knows the name of an active supplier. They ask for a payment to be made to a new account. This is an illustrative scenario, but the decision it creates is ordinary: should a convincing conversation be allowed to change where money goes?
The FBI has warned that criminals use synthetic audio and video to support impersonation and fraud. Your team does not need to prove that a recording is AI-generated before following the payment-change procedure. The requested action is enough to justify verification.
Build a second channel before you need it
A separate communication route is only useful if it is trustworthy. Keep supplier and internal contact records through an agreed maintenance process. Do not replace a known number with one included in the suspicious message and then treat the callback as independent.
Write down who may confirm a change and who must approve it. Make the process workable when the usual approver is unavailable. Otherwise, time pressure can turn a missing person into an informal exception that everyone accepts.
Use a repeatable verification sequence
- Pause the requested change without arguing about whether the caller is genuine.
- Contact the relevant person through the established, independently held route.
- Confirm the business purpose and the exact change being requested.
- Obtain the required separate approval through the normal process.
- Record the outcome and report a suspicious approach internally.
Phrase the pause as normal business practice: “We verify payment changes through our recorded contact process.” Staff should not have to accuse a senior colleague of fraud in order to follow a control.
Do not make appearance the deciding factor
A familiar display name, photograph, accent or video image can support a story without establishing authority. Equally, an unusual voice or poor connection does not prove criminal activity. Make the process depend on an independently verified decision rather than an employee’s confidence in recognising a person.
Separate identity verification from permission. Even a genuine employee may not be authorised to approve a particular payment. The team needs both a trustworthy requester and the right approval for the transaction.
Practise the exception that will actually happen
Run a discussion exercise with finance, leadership and the person maintaining supplier records. Use a harmless example: an urgent payment change when the usual approver is travelling. Ask the team to explain the route they would use, what they would record and when they would stop.
Look for friction: outdated numbers, unclear delegation, inconsistent instructions or a senior person who routinely bypasses the process. Agree improvements and repeat the exercise. Do not test staff by sending live payment instructions or collecting real banking information.
If a payment may already have been diverted
Contact your bank promptly using a verified channel and follow its instructions. Inform the responsible internal team. Preserve relevant messages and transaction details through the agreed incident process; avoid circulating sensitive evidence widely.
If an email account may be compromised, use a safe communication route while the response team assesses it. Record what is known, what remains uncertain and who owns the next action. A calm, documented handover helps the people coordinating the response.
Take the next step
Turn these questions into a focused discussion with the people responsible for your systems and business processes. Explore our related guidance or talk to a security specialist.
Further reading
FBI/IC3: Criminals use generative AI to facilitate financial fraud.