A familiar voice isn’t payment authorization. Name backup approvers, verify requests independently, and give employees permission to pause before holiday schedules change.
Key Takeaways
- What does the new deepfake report establish, and what does it not measure?
- Who verifies a payment when the normal approver is away?
- What if the caller sounds like the owner?
- Who can hold a transfer, and what happens if money was already sent?
Picture this: It’s the afternoon before a holiday break. A bookkeeper gets a voice message that sounds like the owner, asking for an urgent vendor payment. The regular approver is already away.
Does the bookkeeper have a process to follow, or just a voice to trust?
That’s the gap deepfake scams can exploit. When coverage is unclear, an employee may feel pressured to treat a familiar voice as permission to move money.
Resemble AI’s H1 2026 Deepfake Threat Report offers a timely reason to review that gap. Its public findings document impersonation risks, but don’t establish a holiday spike in business fraud.
The useful question is whether your approval process still works when its usual people aren’t available.
What’s my action item? Identify the next date when your primary and backup approvers could both be away. Assign coverage before that gap arrives.
Need help preparing your team? Call (855) 965-3231 or contact our team to review the I.T. safeguards supporting your payment process.
Deepfake Scams Still Have to Cross Your Approval Process
Deepfakes use AI-generated or manipulated audio, video, or images to impersonate someone. In a CEO impersonation scam, the goal may be to make an unusual payment request sound routine and authoritative.
The FBI’s May 2025 impersonation alert described attackers using texts and AI-generated voice messages to pose as senior U.S. officials.
They sought access to personal accounts, including through malicious links presented as a move to another messaging platform. The alert illustrates how apparent familiarity can help an attacker gain trust.
A suspicious request doesn’t prove AI was involved or an account was compromised. The immediate payment decision doesn’t require that diagnosis.
Build deepfake fraud prevention around two separate checks:
- Verification: Confirm who made the request, what the payment is for, and whether the recipient and banking details are legitimate.
- Authorization: Confirm that the designated approvers have reviewed the verified request and approved it within their documented authority.
A callback helps verify a request. It doesn’t grant spending authority, replace a second approval, or make changed banking instructions safe by itself.
Put these six fields on a shared payment-coverage card before anyone leaves:
| Coverage | Primary and backup approvers, coverage dates, limits, and escalation route. |
| Verification | Who checks the payee, amount, purpose, and changed banking details. |
| Trusted contacts | Trusted contact record, its owner, and the process for verifying changes. |
| Second approval | Independent approver, review evidence, and approval recorded before release. |
| Payment hold | Who can pause, whom they notify, and the checks required for release. |
| Incident response | Bank fraud number, finance and I.T. leads, evidence owner, and IC3 reporting owner. |
What’s my action item? Complete the coverage card for one payment type. Store it securely and have the backup confirm they can find and use it.
What the New Deepfake Report Does and Doesn’t Establish
Resemble AI’s public summary, published August 12, 2026, identifies 821 verified attacks from 1,760 news reports across multiple deepfake categories.
It identifies 15 corporate-fraud incidents, 14 covered by just one news source. That’s a finding about reported cases, not a measurement of all business fraud or undisclosed losses.
The summary doesn’t establish a seasonal increase around holidays. The operational issue is simpler: absences can leave a business without its usual verification and approval coverage.
What’s my action item? Test whether your payment process works without recognizing the caller’s voice. Fix missing coverage rather than waiting for a prevalence estimate.
1. Name Backups Who Can Actually Approve
Agree on coverage dates, transaction limits, and escalation contacts with each backup. Ask them to confirm the commitment; reliable coverage starts with expectations both sides understand.
Check access as well as availability. A name on a coverage chart won’t help if that person can’t sign in to the approval system or lacks the necessary authority.
Joe Braier, president and CEO of M&A advisory firm Lake Country Advisors, recommends settling coverage before an urgent payment arrives.
“Have a game plan set up before it’s needed in case there is a time sensitive payment that needs to get out the door.”
What’s my action item? Have the backup demonstrate the approved workflow with their own credentials before leave begins. Don’t share access or expand authority informally.
2. Verify Through a Trusted Contact
The FBI’s business email compromise guidance recommends independently verifying payment requests and changes to account details. Those checks also matter when the request arrives by voice.
End the incoming interaction and call using a number already held in a trusted company or vendor record. Don’t use a number, link, or replacement contact supplied with the request.
Braier puts the familiar-voice problem plainly:
“Just because it is coming from a familiar name/voice (real or AI generated) doesn’t necessarily mean that it is a valid request.”
Confirm the payee, amount, business purpose, and any banking changes. Record the verification, then send the request through the normal approval process.
What’s my action item? Check where staff find trusted contact details and who maintains them. Verify changes separately from the payment request.
3. Keep Two Approvals in Place
For payments covered by your dual-approval policy, holiday coverage must preserve two distinct, authorized reviewers.
The first approver checks the payment and its verification evidence, then records an approval within their limit.
The second approver independently reviews the supporting information and authorizes release. A forwarded “looks good” message isn’t a substitute for that review.
Each person uses their own credentials. Don’t let one person create and approve the entire transaction because the usual second approver is away.
What’s my action item? Trace one urgent payment through both backup approvals. Resolve any point where one person could approve their own work.
4. Make Pausing a Payment Part of the Job
Employees need a clear rule they can use even when a request appears to come from the owner: if verification or required approval is missing, pause and escalate.
Make escalation easy to follow: name the person to contact, the evidence they need, and who can release the hold. Clear instructions respect the employee’s time when pressure is highest.
Give staff a simple script: “I’ll get this moving as soon as we complete the payment checks. I need to confirm the details through our usual contact.”
Build trusted relationships by backing employees who follow the rule in good faith. Leaders should welcome a verification call and follow the same checks they expect from everyone else.
“Accuracy is more important than an arbitrary deadline,” Braier said.
What’s my action item? Tell payment staff they may pause an unverified request, even from the owner. Show them whom to contact and what’s needed to release the hold.
5. Know the First Calls If Money Has Left
If a suspicious transfer has already been sent, act without waiting to prove that the voice was fake:
- Contact the bank immediately. Ask about stopping or recalling the transfer and contacting the receiving bank. Speed matters, but recovery isn’t guaranteed.
- Notify finance and I.T. Finance coordinates the payment response; I.T. checks for possible account compromise and preserves relevant technical evidence.
- Report the incident to the FBI’s Internet Crime Complaint Center (IC3). Assign an owner so the report isn’t lost between teams.
Preserve the request, messages, call details, approval records, transaction identifiers, and relevant logs. Don’t delete the suspicious material or keep engaging with the sender.
Own the response through the handoff. Confirm that each person has accepted their next step, and help remove obstacles instead of passing blame.
What’s my action item? Save the bank’s verified fraud number where the backup can reach it. Assign owners for bank contact, evidence, and reporting.
6. Rehearse One Payment Before the First Absence
Run a short practice scenario with the people covering payments: the owner appears to request an urgent vendor transfer, the usual approver is away, and the bank cutoff is approaching.
Ask the bookkeeper to locate the trusted contact and explain when they’d pause.
Ask the backup to show their approval limit, system access, and route to the second approver.
Then change one condition: nobody answers the trusted callback. Does the team hold and escalate, or invent an exception?
Finally, say the money has already left. Who calls the bank, and who brings in I.T.?
Keep the rehearsal low-pressure and invite honest feedback. A confusing step is useful information: make it easier, test the change, and learn from what happens.
What’s my action item? Give each gap an owner and deadline. Repeat any failed step after the correction, before the planned absence begins.
Your managed I.T. services partner can support access, account security, and incident communications. Finance retains authority over payment approvals and release.
Frequently Asked Questions
1. What does the new deepfake report establish, and what does it not measure?
Resemble AI’s public summary documents news-reported deepfake attacks, including corporate fraud. It doesn’t measure all business fraud or establish a holiday increase.
2. Who verifies a payment when the normal approver is away?
A named backup follows the same verification process. Document their approval authority separately, preserve any required second approval, and hold the payment if coverage is missing.
3. What if the caller sounds like the owner?
Use an independently maintained contact record to verify the request. A familiar voice, caller ID, or convincing video doesn’t replace verification and authorization.
4. Who can hold a transfer, and what happens if money was already sent?
The employee handling the request should have explicit permission to pause it. If funds have left, contact the bank immediately, notify finance and I.T., preserve evidence, and report to IC3.
Make the Safe Next Step Easy to Follow
Holiday coverage works when people know what they own. A legitimate payment has a clear route forward; a questionable one has a clear route to review.
That clarity protects relationships as well as money. Employees can question an unusual request respectfully, and leaders can reinforce the same checks they expect everyone else to follow.
What’s my action item? Finish the coverage card, test backup access, and rehearse one payment before holiday leave. Confirm each fix works for the people using it.
Strengthen the I.T. Safeguards Behind Your Payment Process
Attentus can help review the cybersecurity safeguards supporting your team, from account access to incident response.
Your finance leaders keep payment authority; your employees get a clearer support path.