An urgent request can sound completely familiar and still be unauthorized. A caller may imitate an executive, supplier, or colleague, using a cloned voice or ordinary social engineering. Staff should not have to settle the technology question before deciding whether to release money or sensitive information.
Verify the request through a known route
A convincing voice still needs the organization's approval process.
The useful control is a verification process that applies to the request, regardless of how convincing it sounds. A recognizable voice, displayed number, video call, or existing email thread should not bypass the organization's approval requirements.
Make verification normal
The FTC's warning about AI voice cloning advises checking a story through a known contact route rather than trusting the voice. The same principle is useful at work: end the incoming interaction and use contact details established independently of the request.
For a payment change, have finance follow the approved supplier verification and authorization process. A second person should verify the instruction where the organization's controls require it. A message saying the executive is unavailable should not make the exception automatic.
Our safe payments guide covers the workflow around purchasing, changed payment details, and unusual requests. Leadership must support it in practice. An employee who checks a senior person's instruction should be following policy, not risking criticism for slowing things down.
Protect more than money
The same tactic can target payroll information, personnel files, authentication resets, and remote support access. Help desk staff need an approved identity verification process for resets. A caller's knowledge of staff names or an ongoing project does not establish authority to change an account.
Build short exercises around the work people actually perform. Ask the finance team how it would handle a new bank instruction during a busy payment run. Ask support staff what they would do if a supposed executive demanded a replacement authentication method. The awareness guide connects those habits with a clear reporting route.
Avoid relying on a checklist of audio defects. A poor connection can make a real caller sound strange, and a convincing recording may contain no obvious defect. A process based on recognizable artifacts is difficult to maintain as tools and call quality change.
Have a response ready
If a suspicious request is received, preserve relevant messages and report through the agreed process. Do not forward sensitive material widely while asking colleagues whether it looks real. The incident response guide covers controlled escalation and evidence handling.
If funds have been sent, act promptly. The FBI's business email compromise guidance advises contacting the financial institution immediately and reporting through IC3. Follow the organization's response arrangements and preserve the payment details for the people assisting.
Review how the request reached the decision point, including any compromised accounts and missing approval steps. The lasting improvement may be a clearer contact list, better absence coverage, or an enforced payment-change check. Staff need a process that remains useful even when an imitation is difficult to recognize.