If the request can be faked, the approval has to come from somewhere the fraudster cannot reach.
Assume any voice note, phone call or video call can be faked. A payment request is only verified when someone calls the requester back on a number already held by the company, a second person approves the payment, and no rule is waived because the request is urgent, secret or comes from a senior executive.
In early 2024 a finance employee at the engineering firm Arup in Hong Kong joined a video call with people he believed were the company's chief financial officer and other colleagues. All of them were deepfakes. He had first doubted an email asking for a secret transaction, but the call convinced him. He made 15 transfers totalling HK$200 million, about US$25.6 million. Arup confirmed the case in May 2024 and said its internal systems were not compromised.
The lesson is not that the employee was careless. It is that seeing and hearing someone is no longer proof that they asked for a payment.
Business email compromise, the wider family this belongs to, accounted for close to $2.8 billion of losses reported to the FBI's Internet Crime Complaint Center in 2024.
Run any unusual request through the warning signs above. Two or more together, such as new bank details plus urgency, should stop the payment until it is verified. See also business email compromise in accounts payable.
UK: victims of authorised push payment fraud can report it to their bank and to Action Fraud. Since 7 October 2024, payment providers must reimburse authorised push payment fraud on Faster Payments and CHAPS for consumers, micro-enterprises and small charities, up to £85,000 per claim. Larger businesses are outside that scheme, so for them prevention is the only protection. US: report to your bank immediately and to the FBI's IC3. Fast reporting gives the best chance of freezing funds.
Score a payment request against the warning signs of fraud. Free to use online.
The Invoice & Payment Fraud Defence Kit puts every payment through a Release, Hold or Pulled-from-run decision, with a bank detail change verification log, supplier checks, an incident log, a staff training record and a Fraud Defence Playbook (PDF). Excel, no macros, one-time price.
Detection is getting harder as tools improve. Training helps people notice the pressure tactics, but the reliable defence is a process that does not depend on recognising a face or voice.
Then the callback and second approval take a few extra minutes. A genuine executive will accept that; a fraudster will push back, which is itself a warning sign.
Some policies cover social engineering fraud, often with a lower sub-limit and conditions such as documented callback procedures. Check your wording before you rely on it.
Last updated 18 October 2026. General guidance for finance teams; check it against your own policies, systems and local rules.