How to Spot AI Voice and Deepfake Scams at Work

What these scams look like

AI tools can now copy a person's voice from a short recording and generate convincing video of their face. Scammers use them to impersonate executives, vendors, and colleagues, usually with an urgent request: pay this invoice, update these bank details, send these files, approve this login.

In 2024, engineering firm Arup confirmed that an employee in Hong Kong was tricked into sending about $25 million after a video call with deepfaked versions of senior colleagues. Smaller versions of the same trick, like a cloned voice asking for a gift card purchase, are far more common.

Warning signs

• Urgency and secrecy: it has to happen now, and don't tell anyone.
• A change in the usual process: new bank details, a new contact, a new app.
• A request to move money, share credentials, or bypass an approval.
• Small oddities: unusual phrasing, poor audio, or a call from an unfamiliar number.

Habits that stop most attacks

• Call back on a number you already have, not one in the message, before acting on any payment or access request.
• Require two people to approve payments above a set amount, and any change to payment details.
• Agree on a verification question or code word for unusual requests between leaders and finance.
• Make it normal to say "I'll call you back to confirm," even to the CEO.

What to do if someone falls for one

Speed matters. Call your bank immediately to try to stop or recall the payment, change any passwords that were shared, tell whoever handles IT and security, and report it to the authorities. Then look at which step in your process let it through and fix that, without blaming the person who was targeted.