A familiar voice can no longer approve a payment

The most famous deepfake payment loss may not have involved a conversation. In a June 2024 reply to its legislature, the Hong Kong government said police believed a fraud costing about HK$200 million²2Government of the Hong Kong SAR, written reply to the Legislative Council, June 26, 2024. Police cases to May 31, 2024. The January 2024 case was still under investigation, and the reply names no company. Read the source used a pre-recorded video conference², with “no interaction”² between the employee and the fraudster. The payment instructions then continued over instant messaging².

The reply names no company; the link to Arup rests on CNN, plus the matching date, amount and fake-CFO pretext. Arup told CNN that “fake voices and images were used”³3CNN, May 16, 2024, quoting an Arup spokesperson and citing Hong Kong police and RTHK. One incident, Hong Kong office, January 2024. No source we read confirms whether the funds were recovered. Secondary report. Read the source and no internal systems were compromised³. CNN, citing police, put the loss at about US$25.6 million across 15 transactions³, sent after the employee set aside his doubts because others on the call “looked and sounded just like colleagues he recognized.”³ Nothing we read says which controls Arup had, so the case cannot show which one was missing.

The FBI has warned of fakes built for “real time video chats,”⁴4FBI IC3 public service announcement I-120324-PSA, December 3, 2024. General guidance on generative AI and fraud, not outcome evidence. Read the source so live versions are a concern too. But if a recording and a chat thread can start a transfer, the question gets simpler: can a recognized face or voice move money at all? It should not. The rules that address this need little technology, and more than 90% of respondents to a 2026 US treasury survey report having the main ones⁵5AFP 2026 Payments Fraud and Control Survey, Key Highlights, p. 12. 465 US treasury practitioners, covering 2025. Self-rated, not measured loss prevention. Ratings appear to be among users of each control (our reading). Read the source. They give way when an urgent request skips a step.

On the record, AI is a sliver of a US$3 billion problem

Complaints to the FBI’s Internet Crime Complaint Center (IC3) reported US$3,046,598,558 in business email compromise (BEC) losses on 24,768 complaints in 2025⁶6FBI IC3, 2025 Annual Report, April 2026. Complaints for calendar 2025; self-reported adjusted losses. Mostly US, with complaints from more than 200 countries. What was reported, not a national total. Read the source, second only to investment fraud⁶. IC3 now defines BEC to include “phone numbers and virtual meeting applications.”⁶ Of those losses, US$30,256,592, on 135 complaints, referenced AI⁷7FBI IC3, 2025 Annual Report, pp. 39-42. Complaints whose information contains a reference to AI: what complainants mentioned, not a forensic finding. About 1% (0.99% of losses, 0.55% of complaints) is our arithmetic. Read the source. That is about 1%⁷.

The Association for Financial Professionals (AFP), surveying 465 US treasury practitioners⁸8AFP 2026 Key Highlights, pp. 7 and 14; 2025 edition, p. 6. 465 US treasury practitioners, fielded January 2026. Base: organizations with payments fraud. The category lists vishing, so it may include plain voice phishing. Read the source, points the same way. Among organizations with payments fraud, 7% named a deepfake attempt in 2025, up from 5% in 2024⁸, and AFP says the technology “has not yet had a widespread direct impact on payment systems.”⁸

Both numbers may run low. IC3 counts what complainants mentioned, and a victim may never learn a voice was synthetic. In AFP’s companion webinar, 6% reported a confirmed deepfake incident and 40% were unsure⁹9AFP article on its companion webinar, July 22, 2026. AFP’s report of the panel’s finding, plus its staff’s view. AFP’s fuller survey section on deepfakes was not read. Read the source. That 40% proves no hidden attacks, but the low figures are not settled either.

So a budget line aimed only at deepfakes would address a sliver of reported losses. Rules that hold against impersonation on any channel cover the deepfake call and the plainer fraud around it, and those are what a board or a lender should ask about first.

Spotting the fake is not a payment control

In a March 2025 Scientific Reports study, listeners comparing recorded clips judged an AI-cloned voice to be the same person as the real speaker about 80% of the time¹. The study did not test colleagues’ voices, so the rate may not carry over to a CFO someone has worked with for years. It still takes most of the comfort out of “I would know.”

A meta-analysis of 56 papers and 86,155 participants¹³13Diel et al., Computers in Human Behavior Reports, 2024. Meta-analysis of 56 papers and 86,155 participants; global lab studies pooling audio, image, text and video. Abstract read via OpenAlex. Read the source, all lab studies, put human deepfake detection at 55.54%, not reliably above chance¹³. Feedback training and AI support lifted accuracy to about 65%¹³, which makes awareness training worth something and still gives nobody grounds to release a wire. The FBI said in July 2026 that a real call and voice cloning “can sound nearly identical.”¹⁴14FBI IC3 public service announcement I-072026-PSA, July 20, 2026. Read the source

Two failed attempts show what helped. LastPass said a deepfake call came “outside of normal business communication channels”¹⁵15LastPass, April 10, 2024. One attempted audio deepfake call, no loss. LastPass called such calls “luckily still rare” at the time. Read the source with “forced urgency,”¹⁵ and the employee ignored it. Bloomberg reported that a Ferrari executive asked a caller imitating the CEO about a book the CEO had recommended¹⁶16Bloomberg, as carried by Gulf News, July 27, 2024; Bloomberg’s own page not opened. Unnamed sources plus messages Bloomberg says it saw. A phone call, no loss. Not confirmed by Ferrari. Secondary report. Read the source, and the call ended¹⁶; Ferrari declined to comment. So doubt is a reason to pause, and its absence is no clearance to pay.

The best-rated rules are already on paper

Nacha, the payments rule body, wants changes to payment details “confirmed outside of the communication method or channel requesting the change,”¹⁸18Nacha (Payments Innovation Alliance), Response Action Plan: Business Email Compromise, 2024. General guidance, not outcome evidence. Its disclaimer says it reflects the individual authors and is not legal advice. Read the source plus “dual controls for approval of certain transactions.”¹⁸ The FBI says to hang up, look up the contact and call that number directly⁴. AFP’s staff: “The defensive move isn’t to out-tech the fraudster.”⁹

AFP’s respondents rated eight controls against BEC. A call-back on a number from official records came top: 94% have it and 63% rate it very effective⁵. Passcodes known only to both parties deserve a second look: used by 42%⁵ and rated very effective by 52%⁵, level with senior sign-off.

Two cautions. These are self-ratings, and we found no study comparing losses with and without the controls. And near-universal adoption sits beside continued loss: among organizations with payments fraud, 74% saw BEC¹⁹19AFP 2026 Key Highlights and press release, April 2026. 465 US treasury practitioners, fielded January 2026. Base: organizations with payments fraud. About 59% at US$1 billion-plus revenue (our sum of AFP’s bands). No margin of error stated. Read the source, and 48% of those under US$1 billion in revenue and 66% of those at or above it took a loss¹⁹. So “do we have a call-back policy?” is the easy question. The harder one is how often it gets waived.

Smaller companies should note that about 59% of respondents work at organizations with at least US$1 billion in revenue¹⁹, and that smaller ones, when fraud succeeds, “are far more likely to absorb the full financial loss.”¹⁹ On cost, no source prices any of this. Our reasoning: little technology, and a real bill in time and friction. The failures below happen when someone skips the friction.

The wording of each rule decides whether it holds

AFP publishes respondents’ anonymous, unverified accounts of 2025 incidents, and they show where a rule gave way. In one, “AP called the number on the email to confirm the banking details.”²⁰20AFP 2026 Key Highlights, pp. 4, 6 and 14. Survey respondents’ anonymous accounts from 2025, with AFP’s own conclusion. Self-reported and unverified. Read the source A call-back took place, to a number the request supplied. In another, a fraudster used a bank’s legitimate phone number²¹21AFP, May 1, 2026, publishing survey respondents’ accounts of 2025 incidents. Anonymous, self-reported and unverified. “May have succeeded” is AFP’s hedge. Read the source, and independent verification with the bank²¹ caught it. So the rule has to name the number’s source: company records, on a call the company places.

AFP also records teams “bypassing callback verification procedures”²¹ or confirming by email, “sometimes using the same thread that initiated the request.”²¹ Another account describes a deepfake video call impersonating a CFO and asking for an urgent payment²¹, which “may have succeeded”²¹ without a “stop, think and ask” policy²¹. AFP’s conclusion: “immediate or emergency payments should be closely examined.”²⁰ Our gloss: anyone should be able to call that pause without penalty, whoever the request appears to come from.

Approval chains fail more quietly. One respondent reported bogus invoices “processed in the normal way with all approval steps,”²⁰ while a bank change was “entered into the system before Treasury could confirm the same.”²⁰ So the second approver has to check the payee and where the request came from, which is our reasoning and untested. Nacha also asks for “delegations of authority”¹⁸ when an approver is out, the clause holiday cover puts to use.

Two signatures on a fake invoice are still two signatures on a fake invoice.

The CFO makes the headline, but the exposure runs wider. AFP reported “classic” executive-impersonation BEC at 49% of respondents in 2024, down from 57% in 2023²²22AFP press release on its 2025 survey, April 15, 2025. Share of respondents reporting executive-impersonation BEC in 2024. Read the source, and U.S. Bank’s summary of the 2026 survey says vendor impersonation is rising²³23U.S. Bank’s own page summarizing the April 2026 AFP report, undated. AFP’s full report was not read. Secondary report. Read the source. Methods vary too: among organizations with payments fraud, BEC ran through wires at 49%, ACH debits at 34% and checks at 33%²⁴24AFP 2026 Key Highlights. Payment methods used in BEC, share of organizations with payments fraud, covering 2025. Respondents could cite more than one, so the figures overlap. Read the source. A rule set written only for the wire desk misses a good part of this.

After a bad transfer, speed helps and promises nothing

If money has left, the order of calls should already be settled.

1. Call the bank immediately and request a recall²⁵25FBI IC3, 2025 Annual Report, pp. 17 and 23. The FBI’s instructions for anyone who discovers a fraudulent transfer, which also cover any necessary indemnification documents. Recall terms differ by institution. Read the source. The FBI notes that bank policies vary²⁵, so ask in advance what the bank will do. Bankers can usefully raise this with commercial customers first.
2. File at ic3.gov with full transaction details, whatever the amount²⁵. Type the address: the FBI says IC3 will never contact people directly¹⁴, so a “recovery” caller using its name is one more impersonator.
3. For wires sent abroad, FinCEN says it is most likely to interdict or recover funds when fraud reaches law enforcement within 72 hours²⁶26FinCEN Rapid Response Program fact sheet, April 15, 2026. Applies to foreign beneficiary accounts referred through law enforcement. A likelihood, not a deadline. Bank requirements vary and are not covered here. Read the source, which is one program’s odds and no promise. Keep the details it asks for²⁶ easy to find: accounts and institutions at both ends, plus date and amount.

In 2025 the FBI’s freeze process covered US$1,163,919,846 in attempted theft and froze US$679,013,183²⁷27FBI IC3 annual reports, 2018 to 2025. Only incidents reaching the Recovery Asset Team. Not like for like: domestic BEC through 2022; domestic and international by 2024; more tech support and takeover cases in 2025. Read the source, a 58% success rate²⁷ against 82% in 2020²⁷. The share has fallen as the caseload has widened, and a freeze is not money returned. In AFP’s survey, 30% of organizations with fraud recovered more than 75% of lost funds and 20% recovered none²⁸28AFP 2026 Key Highlights. Share of lost funds recovered, organizations with payments fraud, covering 2025. 465 US treasury practitioners, self-reported. Read the source.

In Singapore, a finance director sent over US$499,000 in late March 2025 after a video call with a deepfaked CEO²⁹29Singapore Police Force, April 7, 2025. One unnamed multinational, Singapore and Hong Kong. Actual transfer, then recovery. The release does not say whether the video was live or pre-recorded. Read the source. A request for US$1.4 million more on March 27²⁹ tipped him off, and on March 28 police in Hong Kong withheld the funds moved there²⁹. That took cross-border police cooperation and a fraudster who asked twice. Nobody should plan around either.

So the useful test before the next payment run is a count of overrides. NSA, FBI and CISA also recommend “several tabletop exercises.”¹⁷ For a lender, the count says more about a borrower’s controls than a copy of the policy does.

How many payments went out on an override, and who allowed it?