The Boss Didn't Make That Call: How to Stop Deepfake Wire Requests
It sounded exactly like the owner. It wasn't.
Picture a Friday afternoon at a small business in Wesley Chapel. The office manager gets a call. It's the owner's voice, clearly stressed, saying a vendor payment fell through and needs to go out before the bank closes. He's about to board a flight. He'll explain Monday.
The voice is right. The tone is right. The urgency feels real. And the money is gone within the hour.
This is a deepfake voice scam, and it's no longer something that only happens to big corporations.
How voice cloning works
AI voice tools can now produce a convincing copy of someone's voice from a short sample of audio. Business owners put that audio online all the time without thinking about it:
• A video on the company Facebook or Instagram page
• A podcast or local chamber presentation
• A YouTube explainer
• A voicemail greeting
Criminals pair the cloned voice with information from LinkedIn and your website, so they know who handles payments and who the owner is. Some attacks use video calls with a fake face on screen. Others start with an email that looks like it came from the boss, followed by a "confirming" phone call.
Why training alone won't stop it
For years, security awareness training taught people to spot the signs of a scam. That still matters, but deepfakes remove many of the signs. Asking an employee to detect a near-perfect fake by ear is setting them up to fail.
The better answer is a process that works even when the fake is flawless.
Five rules that stop deepfake payment fraud
1. Call back on a known number. Any urgent payment request or change to banking details gets verified by calling a number already on file, never one provided in the request.
2. Use a code word. Agree on a word or phrase that leadership uses for any money request. It's low tech and very effective.
3. Require two approvals. Wires above a set amount need sign-off from two people.
4. Give permission to pause. Tell your team, in writing, that they will never be in trouble for slowing down to verify a request, even one that seems to come from you.
5. Lock down your email. Many deepfake calls follow a compromised email account. Strong MFA or passkeys and email monitoring cut off that first step.
For Florida insurance agencies
Agencies move premium payments, refunds, and sometimes trust account funds. A cloned voice requesting a "quick refund to a new account" is a realistic risk. Documenting verification procedures in your written information security program supports the safeguards expected under Rule 69O-128.032 and gives your staff a clear script to follow.
Start the conversation this week
The most effective step takes five minutes: tell your team today that you will never ask them to skip verification, and that you want them to double-check you. Then set your code word.
Main Event Managed Services helps Tampa Bay businesses build payment verification processes and protect the email accounts these scams depend on. Learn more at maineventmsp.com.
