Skip to content

Practical security for real people & small teams

Deepfake calls and fake CEO requests: a payment verification policy for small teams

By , ICT engineer Published

Guide type
Policy template
Risk if skipped
High
Time
20 min to set up
Cost
Free
For
Teams of 2–50 people
Last verified
2026-10-05

The short answer

  • Criminals now fake the voice, and even the video, of a boss or supplier to request urgent payments. You cannot reliably spot a good fake by looking or listening.
  • What stops it is a rule, not a skill: every new payment, change of bank details or gift-card request is confirmed through a second channel you already know, such as calling back a saved number.
  • Fill in the free one-page policy below, print it, and have everyone who can move money sign it.

Why this is now a small-business problem

Business email compromise, where criminals pose as a boss, colleague or supplier to redirect payments, caused $3.05 billion in reported losses in the US in 2025, according to the FBI's Internet Crime Complaint Center, up from $2.77 billion in 2024. The same report counts just over $30 million of BEC losses with a confirmed link to artificial intelligence, counting only cases where that link could be confirmed.

The best-known case shows why "I'd recognise my boss" is no longer a defence. In early 2024, an employee of the engineering firm Arup in Hong Kong joined a video call with what appeared to be the company's CFO and several colleagues, and made 15 transfers worth about $25 million. Everyone else on the call was fake. Arup confirmed that fake voices and images were used.

Small companies are attractive targets because one person often handles payments alone, and the boss is often travelling or busy, which makes an "I'm in a meeting, just do it" message believable.

What these requests look like

RequestTypical wordingRed flags
Urgent payment from "the boss""Are you at your desk? I need a wire done before 3pm, confidential, I'll explain later."Secrecy, urgency, new recipient, boss unreachable by normal means
Supplier changes bank details"Our bank has changed, please update our details before paying the attached invoice."Change arrives by email only, often days before a large payment
Gift cards"I need 10 gift cards for clients, send me the codes."Any request to pay with gift cards is a scam
Payroll change"Please send my salary to my new account from this month."Comes by email from the employee's real-looking address
Voice note or video callA short call or WhatsApp voice message in the boss's voice, followed by written instructionsCall ends quickly, "bad connection", pressure to act before you can call back

The five rules that stop it

  1. Call back on a number you already have

    Any request to pay a new recipient, change bank details or buy gift cards is confirmed by calling the person on a number saved before the request arrived: your contacts, the supplier's original contract, the company directory. Never use a number, link or reply address from the request itself.

  2. Two people for anything above a set amount

    Payments above a threshold you choose need a second person to approve them. Most business banking platforms support dual approval; switch it on.

  3. Bank detail changes wait 24 hours

    A supplier's new bank details are only used after a callback and a cooling-off period. Real suppliers understand; fraudsters push back.

  4. Agree a challenge question for the boss

    Like a family safe word: a short phrase or question only the real person knows, used when a request comes by phone or video. It costs nothing and defeats a perfect voice clone.

  5. Nobody is punished for checking

    Write it down and say it out loud: an employee who delays a payment to verify it will never be in trouble, even if the request was real and the boss is annoyed. Fraud succeeds when staff are afraid to say no.

Your one-page policy

Fill in the fields, then print it or save it as a PDF. Nothing you type leaves this page.

Payment verification policy

[Company] · effective [date]

This policy protects our money and our customers from fake requests, including emails, texts, calls, voice messages and video calls that imitate people we know. It applies to everyone who can pay, order or change payment details.

  1. Any request to pay a new recipient, change bank details, change payroll details or buy gift cards is confirmed by calling the requester on a number from [saved contacts], never a number or link in the request.
  2. Payments of [amount] or more need approval from two people: [approver 1] and [approver 2].
  3. New or changed bank details are used only after a callback and a 24-hour wait.
  4. Requests by phone or video for urgent or confidential payments are confirmed with our agreed challenge question before anything is paid.
  5. We never pay with gift cards, cryptocurrency or wire transfers requested only by email or message.
  6. Anyone may delay a payment to verify it. Nobody will be blamed for checking, even if the request was genuine.
  7. Suspected fraud is reported immediately to [approver 1]. If money was sent, we call our bank at once to request a recall, and report to the FBI at ic3.gov.
Name and signature
Date

If money has already been sent

  1. Call your bank immediately

    Ask them to recall the transfer and to contact the receiving bank. Speed matters: the first hours give the best chance of freezing the money.

  2. Report it to the FBI

    File a complaint at IC3.gov with the amounts, dates, bank details and the messages. The FBI works with banks to freeze funds in some cases. Outside the US, report to your national police fraud unit.

  3. Secure the email account that was used

    If the request came from a real company mailbox, assume it was hacked: change the password, check forwarding rules and sign out all sessions, as in our guide to what to do after a phishing click.

  4. Warn customers and suppliers

    If attackers had access to your mailbox, they may now target your contacts with fake invoices from your real address.

Don't

  • Don't rely on spotting glitches in a video or voice. Fakes improve every month; the callback rule works regardless.
  • Don't reply to the request to ask "is this really you?". The attacker answers.
  • Don't make exceptions for the boss. The policy only works if it applies to the person most likely to be impersonated.

This policy is the "payment verification rule" in our small business cybersecurity checklist. The same idea protects families: see our guide to AI voice clone scams for the family safe-word version.

How we checked this

Written by Ariel, ICT engineer. On 2026-10-05 we took the loss figures from the FBI's 2025 Internet Crime Report (PDF), compared the rules with FBI public service announcements on business email compromise and on generative AI used for fraud, and used Fortune's report of Arup's statement for the Hong Kong case. The template was tested in Chrome on Windows 10: fields update the policy, and printing outputs only the policy. It is a starting point, not legal advice; adapt it to your bank's approval features. This page contains no affiliate links.

Sources