By Ammar Ashour
An urgent voice or video message that looks and sounds like a company leader is still a payment request—not proof of authority. The safest accounting response is to pause, preserve the request, verify the person through a trusted channel, confirm the business purpose, and follow the normal approval process.
This article provides a fictional tabletop exercise for a United States accounting team. It is designed to test decisions and documentation without using real money, accounts, suppliers, or employee messages.
Why practice an executive impersonation scenario?
The FBI’s December 3, 2024 guidance on generative AI and financial fraud says criminals can use AI-generated audio to impersonate people and elicit payments. It also describes generated video used in real-time chats with alleged company executives or other authority figures.
In a separate May 15, 2025 public service announcement, the FBI warned that AI-generated voice messages can increase the believability of impersonation. Its advice is process based: independently identify a trusted phone number and call to verify the person’s identity before acting.
That matters because appearance is only one signal. The NIST Generative AI Profile notes that deepfake content can challenge our ability to distinguish human-generated from synthetic content. An accounting control should therefore depend on verified authority and supporting evidence—not confidence in someone’s voice, face, writing style, or job title.
Set up the drill in 20 minutes
Use fictional details and keep the exercise outside live banking and accounting systems. Assign four roles:
- Facilitator: reads each scenario update and keeps the answer key private.
- Payment preparer: receives the request and explains the first response.
- Approver: decides what evidence is required before money could move.
- Observer: records decisions, owners, unanswered questions, and escalation steps.
The exercise is not a test of whether someone can identify synthetic media by sight or sound. It tests whether the team follows its process when the request feels convincing and urgent.
Fictional scenario: “I need this payment released now”
Everything in this scenario is invented for training. It is not a client case or a report of an actual incident.
Inject 1: the voice message
At 2:35 p.m., an accounts payable specialist receives a message from a new mobile number. The profile name and photo appear to belong to the company president. A short voice note sounds familiar and says a confidential acquisition requires a $48,750 wire today. The message includes new beneficiary instructions and says not to involve anyone else.
Decision point: What should the payment preparer do before replying, opening any attachment, creating a beneficiary, or entering the payment?
Inject 2: the live video call
The requester starts a brief video call. The face and voice appear to match the president. The connection is unstable, and the requester repeats that the payment must remain secret. The requester offers to approve the transfer within the same messaging application.
Decision point: Does the video call establish identity and payment authority? Which previously trusted channel should the team use, and who must make that contact?
Inject 3: the trusted contact is temporarily unavailable
The president does not answer the number listed in the company directory. The requester sends another message: “I am in a meeting. You already saw me. Process it now.” No purchase agreement, approved payment request, or second approver is available.
Decision point: Does urgency justify an exception? Who can authorize a hold, and what evidence would be required before the request could continue?
Inject 4: independent verification
The president later returns the call through the number already stored in the company directory and says no payment was requested. The accounting team still has the original message, sender information, voice note, proposed beneficiary details, and its decision record.
Decision point: What should the team preserve, who should receive the internal escalation, and what accounts or communication channels should be reviewed for possible compromise?
Use this decision worksheet
| Field | What to record |
|---|---|
| Time and channel | When the request arrived and whether it used email, text, voice, video, or another platform |
| Claimed requester | The person and role the message claimed to represent |
| Requested action | Amount, payee or beneficiary change, deadline, and requested secrecy or exception |
| Evidence received | Documents, links, audio, video, caller details, and any business-purpose support |
| Trusted verification route | Where the independent contact information came from |
| Verification result | Person reached, time, channel, and what was confirmed or denied |
| Internal decision | Hold, reject, escalate, or continue under the normal approval process |
| Decision owners | Preparer, verifier, approver, security contact, and any executive consulted |
| Preserved evidence | Where the original request and the decision record were stored |
| Follow-up | Account review, password or access response, bank contact, and external reporting if applicable |
Facilitator answer key
- Pause the request. Do not click, reply through the new channel, create the beneficiary, or enter the payment while identity and authority remain unverified.
- Preserve the original evidence. Keep the message, sender details, attachments, links, audio or video, and timestamps according to the organization’s authorized process.
- Use a trusted route. Call the executive through a number already maintained in the company directory or another independently verified source. Do not use contact information supplied in the request.
- Confirm the business purpose. Require the underlying agreement, obligation, approved payee, amount, and normal decision owner.
- Keep approval roles intact. A persuasive call does not replace required review, separation of duties, or payment limits.
- Hold when verification is incomplete. Being unable to reach the executive is not evidence that the request is legitimate.
- Escalate the suspected impersonation. Notify the organization’s designated security, leadership, and payment-control contacts and preserve the decision trail.
The FBI’s business email compromise guidance similarly recommends verifying payment and purchase requests in person or by calling the person who made the request. For changed supplier details, use the deeper workflow in Supplier Bank Detail Changes: A Verification Workflow for Small Businesses.
Debrief the process—not the acting
Ask the team to answer these questions:
- At which moment did the request become a controlled exception?
- Did anyone treat a familiar voice, face, profile photo, or writing style as approval?
- Was the independent contact route already available, or did the team need to search for it during the event?
- Could one person create the beneficiary and release the payment?
- Who had clear authority to hold the request?
- Was the final decision understandable from the stored record?
- What one policy, directory, or approval change should be completed before the next payment run?
Score the exercise on observable process steps: stopping the payment, using a trusted callback route, confirming the business purpose, preserving approval roles, documenting the decision, and escalating the event. Do not score employees on whether they noticed a visual or audio imperfection.
What AI can help prepare—and what it cannot authorize
An approved AI tool may help draft fictional scenario variations, organize the observer’s notes, or identify missing fields in the completed worksheet. Use fictional data for the exercise and review the output before relying on it.
AI should not decide that the executive is authentic, approve an exception, create a new beneficiary, or release money. A confidence score, voice match, face match, or well-written summary does not replace independent identity verification and the organization’s approval process.
If money was already sent
Act promptly. FBI guidance says to contact the financial institution immediately and request that it contact the institution where the transfer was sent. Report business email compromise or related internet-enabled fraud to IC3 and preserve the transaction and communication details. A recall or recovery is not guaranteed.
For the broader payment controls that belong before this drill, review AI Invoice Fraud: 7 Checks Before Your Business Pays.
Run one practice round this week
Put 20 minutes on the next accounting or payment-team agenda. Use the fictional scenario, complete the worksheet, and choose one improvement with a named owner and due date.
The goal is not to prove that the team can spot a deepfake. It is to prove that an unverified request cannot move money.
Sources checked October 20, 2026. General educational guidance for accounting workflow planning in the United States; not legal, cybersecurity, banking, or individualized financial advice. Cover image: AI generated editorial illustration.
