Stop training staff to spot the fake
Someone in your business can move money. Maybe it is one person, maybe three. At some point this year, one of them will take a call asking for something urgent: pay this invoice today, the supplier has changed banks, the director is in a meeting and needs it done before close. The voice will be familiar. Increasingly, so will the face on the video.
The advice most businesses have absorbed is to train that person to notice when something is off. That advice has quietly stopped working, and it is worth understanding why before your next payment goes out of the door.
What changed on live calls
Fake audio and video used to be a production job: a rendered clip, made in advance, played at someone. Now it runs live, on a call, responding in real time. The familiar tells are going with it. The slightly wrong mouth, the flat delivery, the lag when you ask an unexpected question: these were never reliable, and they get less reliable every few months.
Gartner put numbers on the trend at its London summit on 22 September, from a survey of 297 senior security leaders. Those are large organisations, not businesses like yours, so treat the percentages as a direction rather than your odds. The direction is clear enough: as Infosecurity Magazine reported, 41% of them had seen at least one social engineering incident involving fake audio on a staff call in the previous 12 months, and 36% had seen one on a video call.
The useful part is not the percentages, it is what Gartner told those organisations to do about it. Craig Porter, a director analyst there, framed the shift as moving security training away from teaching people to "spot the fake" and towards making verification the normal thing to do for consequential requests. That is a change of approach, not a purchase. Nothing you can buy will reliably tell your finance colleague that the face on the screen is generated.
Why "spot the fake" was always the wrong job
Put yourself in the position of the person taking the call. Someone senior, or someone from a supplier you deal with every week, is asking for something plausible under time pressure. To refuse, your colleague has to decide that a person they appear to be looking at is an impostor, and act on that suspicion in the moment, with no evidence beyond a feeling.
That is an enormous amount to ask, and it puts the cost of being wrong entirely on them. Challenge the managing director and be mistaken, and you have insulted your boss. Pay the invoice and be wrong, and the money is gone. Most people, most of the time, will pay the invoice.
We have written before about a request that looked completely official and was still fraudulent: a fraudster emailed Revolut from a genuine government domain and got customer records back. The lesson there was that a real-looking sender does not make a request real. Fake audio and video is the same lesson arriving through a different door, and it closes off the last channel people instinctively trust. A phone call used to be how you checked an email. Now the call needs checking too.
Build a process where nobody has to spot anything
The fix is procedural, and it is cheap. You are not trying to detect the fake. You are trying to make the fake useless, so that a perfect impersonation of your finance director still cannot move any money.
Pick the callback number in advance, and never take it from the request. Every supplier and every colleague who can authorise a payment should have a number you already hold, in your own records, from before this conversation started. When a request to pay or to change bank details arrives, whoever received it rings that number and asks. The person who made the genuine request will answer and confirm it. The impostor will not be on the end of it. This single habit defeats nearly all of this, and it works regardless of how good the fake gets.
Require a second approver for anything that changes where money goes. New supplier bank details, a changed payroll account, a first payment to a new payee: two named people, one of whom did not receive the original request. Impersonating one colleague under time pressure is now easy. Impersonating two, through two separate channels, at once, is a different job entirely.
Agree an out-of-band channel before you need it. Decide now which second channel counts as confirmation: a message in your work chat, a text to a known mobile, an in-person word. Write down that a request arriving on one channel gets confirmed on another. It matters that this is agreed in advance, because a channel someone proposes during the call is a channel the attacker chose.
Say out loud that pausing is expected. This is the part that costs nothing and gets skipped. Every one of these checks fails if your colleagues believe that using them looks like distrust or slowness. So the person at the top has to say it, plainly and more than once: if I ring you asking for a payment, I expect you to hang up and ring me back, and I will not be annoyed. Put it in writing. The day someone follows the rule against a genuinely urgent request from a genuine director, back them publicly. That is the moment the rule either becomes real or quietly dies.
Apply the same thinking to account recovery. Money is the obvious target, but the other high-value request is "I am locked out, please reset my access". A convincing voice on the phone to whoever administers your email and files is worth as much as a payment. The same rule applies: reset requests get confirmed on a known channel, never on the one the request arrived through. We covered the related question of whether a face video is a safe key to a business account when Google launched selfie sign-in.
What to ask this quarter
You do not need to evaluate any technology to close most of this gap. Three questions will tell you where you stand.
Who, by name, can authorise a payment or change supplier bank details on their own? What are they required to check first, and is that written down anywhere, or is it their judgement? And if one of them rang you tomorrow to say a director had just asked them on a video call to release a payment today, what would you want them to have done first?
If the honest answers are vague, that is the work. It is an afternoon of writing things down, not a project.
How Steelwise can help
Writing down who can move money, what they check first, and how anyone confirms an urgent request is short, unglamorous work that most businesses have never got round to. Get in touch if you want a hand with it.
Further reading
- NCSC: Phishing attacks, defending your organisation
- NCSC: Phishing and scams collection
- NCSC: Small business guide
- Action Fraud: report fraud and cybercrime