Is That Really Your CFO? How to Stop Deepfake Voice and Wire Fraud
It's late Friday afternoon. Your bookkeeper gets a call. It sounds exactly like your managing partner: same voice, same way of talking. A deal is closing, the client is waiting, and the wire has to go out now. Please don't tell anyone yet.
A few years ago, that voice would have been the proof. Now it isn't. AI tools can copy a person's voice from a short clip, and they can fake a face on a video call. The FBI has warned that criminals use AI-generated audio and video to pose as executives and other people you trust so they can get money moved (FBI IC3).
Here's what small professional firms in Colorado and the Bryan–College Station area can do about it. None of it needs special equipment, just a few habits everyone follows every time.
What is deepfake voice and video fraud?
A deepfake is fake audio or video made with AI to look or sound like a real person. Criminals collect samples from webinars, podcasts, social media, voicemail greetings or recorded meetings. Then they use those samples to "be" someone your staff trusts.
They usually pair it with an older scam called business email compromise (BEC), where the criminal pretends to be a leader, client or vendor and asks someone to send money or change bank details. The FBI has tracked BEC as one of the most costly kinds of online crime for years (FBI IC3 BEC; IC3 2024 Internet Crime Report). A fake voice or video just makes the old scam more believable.
Why are law, financial and A&E firms targeted?
Because they move money and their schedules are easy to guess:
Law firms handle trust accounts, settlements and real estate closings.
Wealth management and accounting firms move client funds and process withdrawals.
Architecture and engineering firms pay subcontractors and vendors and get paid in large progress payments.
Partners at these firms often speak in public, so recordings of their voices are easy to find online. Small teams also trust each other, and a friendly office is easy to rush.
What does a deepfake payment scam look like?
The details vary, but the pattern repeats:
Urgency. "This has to go out in the next hour."
Secrecy. "Keep this between us. The deal is confidential."
A change. New bank account, new wiring instructions, or a new "vendor."
A channel you didn't start. A call, text, voice note or video meeting invite that came to you.
The FBI has also warned about criminals using AI voice messages to pose as senior officials to build trust before they ask for anything (FBI IC3). The lesson is the same for your office: a familiar voice isn't proof of who's calling.
How do you verify a call or video request is real?
Call back on a number you already know. Hang up and call the person on the number in your directory, phone system or client file. Never use a number from the message, email signature or caller ID, because all of those can be faked.
Use a code word. Choose a private phrase for payment requests, shared in person and never written in email. If the caller can't give it, the request stops.
Ask something only the real person would know. Use a detail from inside the office that isn't on social media.
Slow it down on purpose. Real partners and real clients will wait a little while you verify. Pressure is the warning sign.
What payment controls stop wire fraud?
Verification habits work best with a written policy behind them:
Two-person approval for every wire, and for any new payee or change to bank details.
Out-of-band confirmation for bank changes. Confirm by calling a known number, never by replying to the email that asked for the change.
No exceptions for rank. The rule applies even when the request seems to come from the managing partner. Leaders should say this out loud so staff feel safe saying no.
Tell clients your process. Let them know you'll never change wiring instructions by email or phone alone. The wire fraud post for wealth management firms walks through this step by step.
How do logins and Microsoft 365 settings help?
Many deepfake scams start with a hacked mailbox, because a real email thread makes a fake call easier to believe. So lock down your logins:
Use phishing-resistant sign-in such as passkeys or security keys, especially for finance staff and partners. See What is the best phishing-resistant login?
Watch for code-based tricks that get around regular MFA (device code phishing).
In Microsoft 365, alert on new inbox forwarding rules and unusual sign-ins, and flag external senders clearly.
Have trained people review security alerts 24/7, so a suspicious sign-in on a Friday night gets checked before Monday.
How should you train staff to spot deepfakes?
Keep the training short and practical, and repeat it often:
Play a real example of a cloned voice so staff hear how convincing it is.
Practice the callback and code-word steps out loud.
Include fake "IT help desk" calls too. They use the same tricks to get passwords and MFA codes (fake IT help desk calls).
Praise people who pause to verify, even when the request turns out to be real.
CISA's advice still holds: be suspicious of unsolicited contact, check identity directly, and don't share sensitive information under pressure (CISA).
What should you do if money was already sent?
Act fast. Speed matters a lot in getting money back.
Call your bank right away and ask them to recall or freeze the transfer.
Report it to the FBI at ic3.gov. The FBI asks victims to report quickly.
Call your IT and security team to check mailboxes, reset passwords and look for forwarding rules.
Save everything: call logs, voicemails, emails and meeting links.
Contact your insurer and legal counsel about notice requirements.
Frequently asked questions
Can AI really copy someone's voice?
Yes. AI tools can make a convincing copy of a voice from short public recordings. The FBI has warned that criminals use AI audio and video to impersonate trusted people (FBI IC3).
What is the single best way to stop a deepfake wire request?
Hang up and call the person back on a number you already have. Then require a second person to approve the payment.
Should our firm use a code word?
Yes. A private phrase shared in person gives staff a quick way to confirm a caller, and it's hard for criminals to guess.
Does MFA stop deepfake fraud?
MFA protects the accounts criminals use to set up the scam. Phishing-resistant options like passkeys and security keys are the strongest. Payment verification steps are still needed on top of MFA.
What should we do if we sent a wire to a scammer?
Call your bank immediately, report it at ic3.gov, contact your IT and security team, and save all records.
Do clients get targeted too?
Yes. Tell clients you'll never change payment instructions by email or phone alone, and ask them to call you on a known number to confirm.
Talk to 24uNet
24uNet helps law, financial and architecture and engineering firms in Colorado and the Bryan–College Station area set up secure logins, Microsoft 365 protections, staff training, and 24/7 managed detection and response where trained analysts review alerts. Learn more about 24uNet or contact us.
Denver: (303) 468-5515
College Station: (979) 256-5100
Email: sales@24unet.com
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. CMMC-AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments