Teams should verify executive payment requests through a separate channel using an independent callback to a known number or pre-registered contact, plus a second approver for release. Deepfakes make voice and video convincing, so payment controls should rely on out-of-band confirmation, dual approval, and recallable payment rails rather than the request itself.
Why callback verification should beat the request itself
When the request is urgent, polished, or delivered through a convincing voice or video, the content of the request is the least trustworthy signal. A separate-channel callback to a known number or pre-registered contact breaks the attacker’s control over the conversation and gives the approver a way to test whether the request survives outside the synthetic interaction.
That is why the most reliable control is procedural, not perceptual: use a callback number stored in advance, not one provided during the request, and do not treat a live video presence as proof of authority. The simplest mistake is to verify the person but not the payment instruction.
Why dual approval and recallable rails matter
A second approver reduces the chance that one compromised conversation or one pressured employee can move funds on their own. It also creates a point where the transaction can be challenged before release, which is especially important when the payment is unusual, time-sensitive, or outside normal beneficiary patterns.
Recallable payment rails add a last practical layer of defence because they create an opportunity to freeze or reverse a transfer after suspicion arises. Teams should prefer payment methods and banking workflows that allow holds, recalls, or beneficiary verification checks, because deepfake fraud is often detected only after the request has already left the inbox or call.
What teams should standardise before the next urgent request arrives
The best outcome comes from pre-agreed rules, not ad hoc judgement under pressure. Teams should define who is allowed to approve payments, what counts as an acceptable callback source, which thresholds require a second approver, and what to do when the executive is travelling, unavailable, or asking for confidentiality. Those rules should be rehearsed with finance, treasury, and executive assistants so the process still works when the fraud attempt is designed to create urgency.
For teams building a repeatable control set, the Deepfakes, Social Engineering and AI Impersonation Guide is the clearest starting point because it covers callback verification, payment controls, and identity-based checks in the same fraud pattern. The same problem is also illustrated by Arup deepfake fraud 2024, which shows how convincing executive impersonation can bypass ordinary trust assumptions.
Risk and Threat Considerations
Deepfake payment fraud works because it exploits trust in familiar voices, faces, and urgency. The risk is not just mistaken identity, but the collapse of normal challenge behaviour when the request appears to come from senior leadership.
Failure mechanism: The attacker uses synthetic voice or video to override human scepticism, then pushes the target to act before normal checks, callbacks, or second approvals can intervene.
Impact: Funds can be transferred to attacker-controlled accounts, and the organisation may lose both money and recovery time if the payment moves through channels that are hard to reverse.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Payment approval depends on tightly governed user access and approval authority. |
| Recommendation — Limit payment approval rights to approved roles and review them regularly. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Callback and second-approver checks rely on trusted identity proofing and credential governance. |
| AC-6 — Least Privilege | Dual approval and restricted release authority reduce the blast radius of a spoofed request. | |
| Recommendation — Manage authenticators and recovery paths so approval channels stay trustworthy. Restrict payment release authority to the minimum set of approved personnel. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | The release step is a sensitive function that must be protected from improper authority abuse. |
| Recommendation — Enforce function-level checks before any payment release action. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions and Authorization | Approval workflows need explicit authorization checks before funds can move. |
| Recommendation — Verify that each payment release request is authorized by policy before execution. | ||
Practitioner Guidance
What to verify: Verify the payment instruction, not the executive’s appearance or tone. The callback path should come from a directory, switchboard, or pre-registered contact list that the requester did not influence.
Decision rule: If the request is unusual, time-pressured, or asks for secrecy, require callback confirmation plus a second approver before release. If the payment rail is not recallable, treat the transaction as higher risk and slow it down further.
What good looks like: A legitimate executive payment request can be revalidated quickly, but a spoofed request stalls because the approver cannot complete the out-of-band check or bypass the dual-control rule.
Practitioner takeaway: The control objective is not to recognise a fake face or voice, it is to make a fraudulent instruction fail when it leaves the attacker’s channel and enters your independent approval process.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org