The executive who rang to approve the payment
If a payment instruction has just arrived by voice and you are trying to decide what to do with it, the answer is the same whoever appeared to be calling and however senior they sounded.
Hang up and call back on a number you already have — from your own directory or HR record, never the number that called you and never a number offered during the call. A clone cannot answer a phone you dialled. Until that callback is complete, the instruction has not been given.
How it presents to the person being asked
You are rarely cold-called out of nowhere. By the time the voice call happens, the ground has usually been prepared.
There is a reason the payment cannot go through the normal route. A confidential acquisition. A regulator, an auditor, a law firm. A supplier threatening to halt a shipment. A deadline that lands outside working hours — a Friday afternoon, the last day of a quarter, the week the finance director is on leave. That last detail is not luck. Absences are visible from the outside, in out-of-office replies, conference schedules and social posts.
There is often an email thread already running, and it reads correctly: the right names, the right internal shorthand, a reply chain that appears to go back days. The voice call is not the whole fraud. It exists to clear the one control the email could not clear on its own — the requirement that a human being confirm the instruction.
And there is a reason not to check. You are asked to keep it between you. You are told the executive is about to board a flight. You are told the deal is market-sensitive. Each of these is a way of saying: do not use the second channel.
Senior voices are the cheapest to obtain. An earnings call, a keynote, a webinar, a podcast interview, a recruitment video — a public-facing executive has published plenty of clear speech, and roughly a minute of it is enough for a likeness that holds up over a phone line. Seniority does not protect a voice; it exposes it.
The real obstacle is not detection. It is the org chart.
Most finance teams already know they should verify. What stops them is social, not technical. Nobody wants to be the accounts payable clerk who told the chief executive they did not believe it was really them. The cost of being wrong feels asymmetric: verify unnecessarily and you look distrustful in front of the person who signs your review; fail to verify and, well, that has not happened yet.
So do not ask anyone to make that judgement. Make the callback mandatory, uniform and impersonal. A clerk who calls back is not doubting the CEO. They are completing a control that applies to every voice instruction in the company, including the CEO’s, and they would be in breach if they skipped it. Nothing personal is being expressed, so nothing personal can be taken.
Two things make that stick. First, the executives must endorse the policy in writing, by name, and say plainly that they expect to be called back and will not treat it as an affront. Second, the policy must state that no one may ever ask for it to be waived — because “just this once, we don’t have time” is the exact sentence the fraud needs.
A callback policy you could adopt on Monday
Short enough to fit on one page and to be remembered under pressure. Adjust the thresholds to your business; keep the structure.
| Rule | What it says | Why it is written this way |
|---|---|---|
| Scope | Any instruction to move money, change bank details, or release a payment early, where any part of the authorisation arrived by voice call or voice note. | Covers the voice call used as a second factor, which is the actual attack. |
| The control | Call the instructing person back on the number in the company directory. Not the number that called. Not a number in the email. Not a number given on the call. | The directory number is the only one the attacker does not control. |
| Who calls | The person executing the payment, not the person who received the instruction. | Splits the fraud across two people who must both be deceived independently. |
| Bank detail changes | Always verified, at any value, by callback to a known contact at the supplier, plus a hold period of [VERIFY: your hold period] before first payment. | Changing where money goes is the step that turns a legitimate invoice into a loss. |
| No waiver | Nobody may authorise skipping the callback. A request to skip it is itself reportable. | Removes the only lever urgency has. |
| Failure route | If the callback does not connect, the payment waits. Waiting is always an approved outcome. | Staff need an action that is safe when nobody answers. |
| Record | Note in the payment file: number dialled, time, who answered. | Makes the control auditable, and makes completing it the path of least resistance. |
Run this past your own auditors and insurers — some policies now require a documented verification step for voice-authorised payments. [VERIFY: confirm what your cover actually requires before citing it here.]
Two supporting habits
- Rehearse it once. Run a short exercise where a finance colleague receives a plausible out-of-hours instruction and follows the policy end to end. The point is not to catch anyone out; it is to make the callback feel ordinary before it matters.
- Reduce the signal you give away. Executive absences, quarter-end dates and acquisition timing are the raw material for the story. They cannot always be hidden, but they do not need to be broadcast.
If a payment has already gone out
- Contact your bank and the receiving bank immediately. Recall is possible for hours, not days.
- Preserve everything before anyone tidies it — email headers, call logs, any call recording in its original file, and the timeline of who was told what. Do not forward recordings through chat apps; each hop re-compresses the audio.
- Notify insurers, your auditors and, where the loss is material, your regulator. [VERIFY: link the national fraud reporting bodies for your markets — verify every URL before publishing]
- Do not run an internal blame process first. Recovery is time-critical; attribution is not.
A recording can be checked afterwards, and an assessment that the voice was probably generated is useful for an insurance claim, a police report and an internal post-mortem. It is not a control. Detection explains what happened; the callback is what stops it happening. Read why phone audio is the hardest case before you rely on a verdict from a call recording.
Questions
How do I verify a payment instruction given by voice?
Ring back on the directory number and have a different person than the one who took the instruction do it. Log the callback in the payment file. If nobody answers, the payment waits.
The caller ID matched our internal range. Isn’t that a check?
No. The number displayed on an inbound call is supplied information, not verified identity, and internal-looking numbers are not harder to display than any other. Only an outbound call you place proves where the line goes.
Would a video call settle it?
Less than it used to. Treat a video call as another inbound channel the other party chose, not as identification. The callback still applies.
Can we detect this live, during the call?
Not with us. Truthring analyses a recorded file after the event. Any product promising a reliable live verdict on compressed call audio is claiming more than the condition allows.
What if the executive genuinely is unreachable?
Then the payment waits, and that must be an outcome nobody is punished for. A policy that has no safe failure route will be broken the first time it is tested.
Reviewed