Check the request, not the voice: payment changes at work

Produces: a payment change or an unusual payment that has been confirmed through a contact you found yourself, approved by a second person and written down, or a clear refusal.

Use it when anyone asks you, by email, call, chat or video, to change bank details, pay a new account, or make an urgent or unusual payment.

Not when a payee and their details are unchanged and the payment is routine.

You need a trusted source for contact details (your directory, the contract, a previous invoice, or a supplier portal you reach through your own bookmark), a second person who can approve, and somewhere to write it down. For calls to you or your family at home, use AI voice scams: hang up and call back instead.

Why a voice or a face is not a check

Business email compromise (fraud where someone poses as a boss or supplier by email to redirect payments) is one of the largest loss categories in fraud complaints: $3.05 billion in 2025 IC3 complaints, next to investment fraud at $8.65 billion (FBI IC3 2025 report, complaint data). CNN reported that an Arup employee in Hong Kong made 15 transfers totalling HK$200 million (about US$25.6 million) after a video call with deepfaked colleagues. Arup confirmed that "fake voices and images were used" and that "none of our internal systems were compromised" (CNN, via ABC17, May 2024, press report). People cannot reliably tell a cloned voice from a real one (the evidence is in our voice-scams guide), so the check rests on where the contact details came from and on a second person.

Steps

Scripts

For step 4:

Hello, this is <YOUR_NAME> at <YOUR_ORGANISATION>. I am calling about a
request to <WHAT_CHANGES>. Can you confirm that you asked for this, the
amount of <AMOUNT>, and the last four digits of the new account?

Replace the following:

• <YOUR_NAME> and <YOUR_ORGANISATION>: who you are.
• <WHAT_CHANGES>: the change, such as move future payments to a new bank account.
• <AMOUNT>: the amount, or no amount if the change has none.

For step 7, in the place your team keeps records:

Date: <DATE>
Request: <WHAT_CHANGES>, <AMOUNT>, arrived by <ARRIVED_BY>
Contact used: <CONTACT_SOURCE>
Confirmed by call-back: <CONFIRMED>
Second approver: <SECOND_APPROVER>
Outcome: <OUTCOME>

Replace the following:

• <ARRIVED_BY>: email, phone call, chat or video call.
• <CONTACT_SOURCE>: the directory, contract or earlier invoice you used.
• <CONFIRMED>: yes or no, and the time of the call.
• <SECOND_APPROVER>: the name of the person who approved.
• <OUTCOME>: paid, changed, declined or escalated.

Leave full account numbers out of the record.

Cases that trip people up

• A video call. End the call and begin at step 1. A face and a voice on a call do not count as a check.
• A request that seems to come from your manager. Use their number from the directory in step 3. The second approver is someone other than your manager.
• A one-person business. Ask someone outside it, such as your accountant, to be the second person.

How to tell it worked

• Every change has a record with a contact source that is not the request.
• Some real requests take longer, because step 4 needs a person to answer.
• It has failed if you find yourself using a number from the request "just this once". Stop and start at step 3.

Sources

1. FBI IC3. 2025 Internet Crime Report. Complaint data. Link
2. CNN, via ABC17. Report on the Arup deepfake video-call fraud, 2024. Press report. Link
3. FBI. Public service announcement I-120324, 2024. Government advice. Link

Changes

1. v1.010 Oct 2026first version