Deepfake Voice and Video Scams: Verification Rules That Protect Your Business

Criminals now clone voices and fake video calls to pose as executives and vendors. Learn the call-back, code word and dual-approval rules that stop these scams.

M By Max October 27, 2026 · 6 min read

Deepfake Voice and Video Scams: Verification Rules That Protect Your Business

AI tools can now imitate a person's voice from a short audio sample and produce convincing video of a face that is not really on the call. The FBI has warned that criminals use these tools to pose as executives, relatives and officials in order to get money or account access. For a business, the defence is not trying to "hear" whether a voice is fake. It is a set of simple verification rules: any request to move money, change bank details or share access is confirmed through a second channel you already trust, approved by two people, and never rushed because the caller says it is urgent.

What the warnings actually say

Several U.S. agencies have published warnings about AI-generated impersonation. They are worth reading in full, because they describe the patterns your staff are likely to see:

FBI / IC3, December 3, 2024 ("Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud"): criminals use AI-generated audio to impersonate people, including to gain access to bank accounts, and AI-generated video to pose as company executives, law enforcement or other authority figures during real-time video chats.
FBI / IC3, May 15, 2025 ("Senior US Officials Impersonated in Malicious Messaging Campaign"): since April 2025, actors sent text messages and AI-generated voice messages claiming to come from senior U.S. officials, built rapport, then moved targets to another messaging platform and tried to steal credentials. The FBI's advice is to verify identity by calling a number you find independently and to never send money based on an unverified request.
FinCEN Alert FIN-2024-Alert004, November 2024: FinCEN reported an increase, starting in 2023, in suspicious activity reports that describe suspected deepfake media used in fraud against financial institutions and their customers, and it lists red flags for banks.

The common thread is not the technology. It is the old social engineering playbook (authority, urgency, secrecy and a request for money or access) with a more believable voice or face attached.

How these scams reach a business

The schemes described in these advisories tend to fall into a few patterns. Knowing them makes the request easier to spot, even when the voice sounds right.

The "CEO" who needs a transfer today

A call or voice note that sounds like the owner or a senior manager asks the bookkeeper to send a payment, buy gift cards or pay a "confidential" vendor before the end of the day. The caller may say they are boarding a flight or in a meeting and cannot talk long.

The vendor with "new bank details"

A familiar supplier contact calls (or leaves a voicemail) to confirm a change of bank account, often right after an email with the same request. The voice call is there to make the email look legitimate. This is the voice version of business email compromise.

The video meeting with a fake participant

A short video call where a known executive appears briefly, asks for a transaction and leaves. Low video quality, a "bad connection" or a camera that turns off are convenient excuses.

The help desk call

Someone who sounds like an employee calls IT or a manager to reset a password, re-register an MFA device or grant access "because I'm locked out and the client is waiting."

Team on a video call reviewing a payment request before approving it

The verification rules that stop it

These controls work whether the impersonation is AI-generated or just a good actor on a phone. Write them down, get the owner to sign off, and make them apply to everyone, including the owner.

1. Call back on a number you already have

Never verify a request using contact details supplied in the same call, voicemail, text or email. Hang up and call the person back using a number from your own records: the vendor master file, a signed contract, the company directory or your phone's saved contact from before the request. The FBI gives the same advice in both PSAs above.

2. Use a verification phrase for money and access

Agree on a code word or challenge question with the people who can authorise payments, and keep it out of email, chat and shared documents. The FBI recommends a secret word for families; the same idea works for a small leadership team. Change it if anyone leaves or if you suspect it has been shared.

3. Require two people for payments and bank changes

Any new payee, change of bank account or payroll direct-deposit change needs approval from two people, one of whom performs the call-back.
Wire transfers and ACH payments above an internal threshold need a second approver in the banking portal, not just a verbal "yes."
Ask your bank which dual-control and payee-approval features your business account supports, and turn them on.

4. Payroll and direct-deposit changes go through a fixed process

Employees change bank details only through your HR or payroll system while signed in with MFA, or in person, never by phone, text or email to a manager. Notify the employee at their known address after any change.

5. Urgency and secrecy are a reason to slow down

Make it policy that no legitimate request will be punished for being verified. If someone says "don't tell anyone" or "this can't wait for the call-back," the process still applies. Leadership has to say this out loud, because staff will not delay a "CEO" otherwise.

6. Protect help desk and MFA resets

Password resets and MFA re-enrolment requests should be verified the same way: call back on the number in the directory, or confirm through a manager on a separate channel. Prefer phishing-resistant MFA where possible (see our multi-factor authentication guide).

A script your staff can use

Give front-desk, accounting and IT staff words they can say without feeling rude:

"Thanks. Our policy is that I confirm every payment or account change by calling back on the number we have on file. I'll call you right back."

If the caller pushes back:

"I understand it's urgent. I can't make an exception, but I'll call you back within a few minutes on the number in our system."

Then actually follow through. A real executive or vendor will answer the call-back; a scammer usually will not.

Reduce what attackers can copy

You cannot remove every voice sample of your leadership from the internet, and you should not stop marketing. But you can make the scam harder:

Keep the names of who approves payments and how your approval process works out of public posts and job ads.
Review which staff details are visible on the website and social profiles, and whether personal phone numbers are listed.
Encourage leadership to keep personal social accounts private, as the FBI suggests.
Train staff with real examples from the advisories, alongside the phishing red flags every employee should know.

What to do if a payment already went out

Call your bank immediately and ask them to recall or freeze the transfer. Speed matters.
File a complaint at ic3.gov with transaction details.
Preserve the voicemail, call log, messages and emails; do not delete them.
Reset passwords and review MFA for any account the caller may have learned about.
Follow your incident response steps (our first 24 hours after a breach checklist is a good starting point).

Detection tools for synthetic media exist, but none of the advisories above treats them as a replacement for process. A call-back and a second approver work no matter how good the fake becomes.

If you would like help writing payment verification rules, setting up dual approval and MFA, and training your team, request a free IT assessment. Core Florida IT works with businesses across Miami-Dade and South Florida on cybersecurity and managed IT support, in English and Spanish.