When Voice Verification Is No Longer Enough: Dual-Control for Deepfake Payment Requests

The controller gets a call. It sounds exactly like the owner, who is travelling and needs a wire sent before end of day. A familiar voice used to be reasonable proof. It isn't anymore.

Whether the impersonation uses synthetic audio, a hacked email account, or just a convincing caller, the control is the same: no unusual payment goes out on one person's request and one person's check.

Decide Which Requests Trigger Dual Control

Write down the events that need extra verification before money or banking details move. Typical ones:

• A new beneficiary or bank account
• A change to existing payment instructions
• An urgent or confidential transfer
• A request that skips the normal invoice or purchase process
• A payment above a threshold you've set
• Gift cards, cryptocurrency, or anything else hard to reverse
• A request made while the usual approver is away

Apply it no matter who's asking. A senior title shouldn't override a payment control.

Separate Request, Verification, and Release

Dual control works when nobody can start, verify, and release a high-risk payment alone. Give these roles to different people:

1. Requester: submits the business purpose and supporting records.
2. Verifier: confirms the request through an independent, trusted source.
3. Approver or releaser: checks the evidence and authorizes the payment.

In a small team the roles may shift around, but at least two authorized people should be part of the decision.

Verify Through a Known Channel

Don't call the number in the suspicious message, and don't follow a link the requester sent. Use contact details you already hold in an approved directory, the vendor master record, a contract, or the banking file. For internal requests, use the corporate directory, or confirm in person if that's practical.

Ask about the transaction, not whether the person "really sent that email." Confirm the payee, amount and currency, business purpose, supporting invoice or agreement, any bank-detail change, and the timing and urgency.

A voice can be part of the check. It shouldn't be the only part.

Require a Second Approver

The second approver should look at the original request, the record of the independent verification, and the payment details in the finance system. They need to be free to reject or pause the payment without asking the requester for permission. Plan for holidays and absences so "it's urgent" can't be used to squeeze the process down to one person.

Control Vendor Bank Changes

A change to a vendor's bank details deserves its own workflow:

• Compare the request with the existing vendor record.
• Call a known vendor representative using stored contact details.
• Record who confirmed the change and when.
• Get the internal approvals you require.
• Where you can, keep editing vendor records separate from releasing payments.

A convincing email thread or phone call isn't enough on its own.

Keep an Approval Record

A short record should hold the request and its supporting documents, the verification channel and where the trusted contact came from, who took part in verification and approval, the final payment details, any exceptions or escalations, and the time of release. You should be able to rebuild the decision later without relying on anyone's memory.

Give Staff Permission to Pause

Process only works if the culture backs it up. Tell finance and operations staff they're expected to pause when a request is unusual, urgent, secret, or doesn't match normal practice. No legitimate boss should be upset that someone followed the verification steps.

Run a tabletop exercise with a realistic voice or video-call scenario, and see whether people really use the known-channel and second-approver steps.

A payment process that stays safe even when the voice sounds right holds up against a convincing impersonation far better than instinct does.

Related Reading

This extends our spear-phishing guide. The old urgency-and-impersonation tricks now come with more convincing voice and video, so payment processes need stronger independent checks.