How Do You Verify a Payment Approval When a Deepfake Voice Sounds Exactly Like the Boss?

You verify it out of band. No payment, no change of supplier bank details and no purchase order is released on the strength of a voice call, a video call or a messaging app thread, however familiar the face and voice. The person releasing the money calls back on a number already stored in your own records, speaks to the named approver, and writes down who confirmed it and when. That rule has to be written and known before the request arrives, because in the moment the call is urgent, plausible and sounds exactly like the person who signs your cheques. Detection is not the control. Procedure is.

What does a deepfake payment request actually look like in a small company?

It rarely arrives as a crude robot voice. The pattern that reaches SMEs looks like this. A finance or admin staff member gets a short call or voice note from the managing director, who is travelling. There is a payment that must go out today, the supplier has changed banks, and the details will follow by message. The voice has the right accent, the right turns of phrase and the right impatience. Sometimes it is a brief video call where the face appears for twenty seconds and the connection then drops, which conveniently explains why the rest happens over chat.

Three things make this work on a small team. The approver genuinely does travel. The staff member genuinely has release rights. And there is genuinely no second signature required, because requiring one felt like bureaucracy in a company of fifteen people. The fraud does not break your systems. It uses your trust exactly as designed.

The same technique is used on purchase orders, which is the quieter version and often the more expensive one. A cloned voice from a known customer confirms a large order verbally so goods ship before the paperwork catches up. You have then funded the stock, the freight and the labour against an order that never existed.

Why is October the right month to fix this?

Because peak trading removes every condition this control depends on. From November your approvers are travelling or on leave, your finance staff are clearing payment runs under time pressure, and you have temporary staff who have never met the director whose voice is being imitated. Urgency stops being a warning sign in December, because in December everything is urgent.

There is also a recovery clock. Money moved to a mule account can sometimes be held if the bank and the police are told quickly, and that window is measured in hours. A business that has to first work out who to call has usually already lost it. The decision to make in October is not whether deepfakes are a threat. It is who has the bank's fraud line, who is allowed to freeze a payment, and whether that person is reachable on 24 December.

What should the written rule actually say?

Keep it to one page that a part-time bookkeeper can follow on their third day. The working version covers six points.

1. A money threshold. Above an amount you set, two named people must approve, and they must be two different people. Pick the number that hurts, not the number that is convenient.
2. A hard rule on bank detail changes. Any change to a supplier's or employee's bank account is verified by calling the number already in your records, never a number supplied in the request itself. This single line stops most of these cases.
3. A callback script. The caller states the amount, the beneficiary and the reason, and the approver confirms it independently. If the approver cannot be reached, the payment waits. A payment that waits a day has never ruined a business.
4. No channel is an approver. Voice notes, video calls, WhatsApp and email are requests, not authorisations. Authorisation happens in your accounting or banking system, under a named login.
5. A safe word for genuine emergencies. Agreed in person, never written in any chat, used only when a real approver needs to move fast.
6. Permission to be wrong. State in writing that no staff member will ever be blamed for delaying a payment to verify it. Without this sentence the rule fails, because juniors do not challenge a director's voice unless they have been told to.

Who should hold the authority to stop a payment?

At least two people, and one of them should not be the business owner. If the only person who can halt a transfer is also the person being impersonated, the fraud controls itself. Name a second holder, give them the bank's fraud reporting number, and tell your bank who they are. Most business banking relationships allow a nominated contact for suspected fraud, and the five minutes spent registering that now is the difference between a hold and a loss.

Check the quiet adjacency as well. Anyone who can change bank details in your accounting system, approve a purchase order or reset a finance login is part of this control whether their job title says so or not. That usually means reviewing who still has access after someone leaves, which is the same housekeeping your Corppass and Singpass roles need before year end anyway.

What does this cost to put in place?

In cash, close to nothing. In time, roughly half a day: an hour to write the page, an hour to walk your finance and admin staff through it, and a short session with your bank to confirm limits, dual approval and the fraud contact. Dual approval on payments above a threshold is a standard feature of Singapore business banking and does not require new software.

The return is asymmetric in a way few controls are. A single successful transfer at the level SMEs are being hit for will typically exceed a month of payroll, and it is not insured by default. If you carry cyber insurance, read how social engineering and funds transfer fraud are treated, because many policies cover the breach but not the voluntary transfer, or cover it only at a sub-limit with a verification condition attached. If the policy requires callback verification and you had no documented procedure, you have bought less protection than you think.

What should you do this week?

Write the one page. Set the threshold. Name the second person who can stop a payment and give them the bank's number. Brief the finance and admin team before November, and brief every temporary hire on day one. Then test it once: have someone send a plausible urgent payment request and see what your staff actually do. The result of that test is the only honest measure of whether you are protected, and it is far cheaper to run in October than to discover in December.

Frequently asked questions

Can we not just train staff to spot a deepfake?

No, and planning around that is the main mistake. The tell-tale signs people were taught two years ago, such as flat tone and odd blinking, are largely gone in current tools. Treat human detection as a bonus, not a control. The procedure has to hold even when the imitation is perfect, which is why verification runs through a channel you already own rather than through judgement about how the voice sounded.

Does a recorded call help us prove what happened?

It helps with the investigation, but recording introduces its own obligations. Under the PDPA you need a lawful basis and appropriate notification to record and keep voice data, and client calls raise confidentiality questions on top of that. If you record approvals, limit it to internal finance calls, state the retention period, and keep the recordings access-controlled. A written log of who confirmed what and when is usually sufficient and far simpler.

We are only eight people and everyone knows everyone. Is this really necessary?

Small teams are the preferred target precisely because the approval chain is short and informal. Scale the rule rather than skipping it: one threshold, one callback requirement on bank detail changes, and one named second approver. That is three lines, it takes an afternoon, and it closes the route that has cost comparable Singapore businesses six-figure sums.