Deepfake Fraud Prevention: Call-Back Verification Rules

Do not build your defense on staff noticing a fake. Attach verification to the action: a defined list of requests always needs confirmation through a channel the requester does not control, and the same rule also covers plain email fraud. This guide is for the CISO or security lead who has to write the rule that accounts payable and the IT service desk will follow, plus the layered hiring checks HR will own. It ends with policy text you can copy.

A deepfake is synthetic audio, video or images made to pass as a real person. Vishing is voice phishing: a phone call that works on the listener's trust. Neither changes the defense.

Why training people to spot deepfakes is not the control

People spot deepfakes unreliably, and in one well-documented video-call fraud the call itself removed the employee's doubt. A control that depends on someone noticing something fails at exactly the moment the fake is good enough.

The Hong Kong government says that in a case police received in end-January 2024, in which an employee authorized transfers and the loss was about HK$200 million, the meeting was pre-recorded and there was no interaction between the employee and the fraudster. Its reply does not name the company. We read it as the Arup case because the timing, the amount and the impersonated UK chief financial officer match CNN's report of May 16, 2024, which named Arup and carried its confirmation that fake voices and images were used. CNN put the amount at about US$25.6 million. CNN, citing police, reported that the employee first suspected a phishing email and put aside his doubts after the video call because the other attendees looked and sounded like colleagues he knew.

The research points the same way. A 2024 meta-analysis of 56 papers found total human detection accuracy of 55.54% and overall detection rates not significantly above chance; strategies such as feedback training and AI support raised accuracy to 65.14%. A 2023 study found listeners spotted speech deepfakes 73% of the time, and that showing them examples improved results only slightly. The FBI says AI-generated content is often difficult to identify and that cloned voices can sound nearly identical.

The FBI's consumer advice does tell people to look for subtle imperfections in images and videos, and the NSA, FBI and CISA say every organization should include an overview of deepfake techniques in training. Keep that awareness training. In our view it supplements the company's control and cannot replace it, because the FBI itself says fakes are often difficult to identify.

Deepfakes are likely not the main route. The FBI's 2025 IC3 report lists $3,046,598,558 in business email compromise (BEC) losses and $30,256,592 in BEC losses tied to complaints that referenced AI, about 1% by our arithmetic. That tag covers any mention of AI, not only deepfakes, and the same report says many victims do not realize the extent AI may be involved in scams, so read the share as a rough signal, not a measurement. In the 2026 AFP survey of 465 respondents, 7% of organizations that experienced payments fraud cited deepfake attempts, and the report says deepfake technology has not yet had a widespread direct impact on payment systems.

What counts as verification, and what does not

A check counts only if it reaches the real person through a channel the requester does not control. In practice that means you place an outbound call to a number taken from a system of record as it stood before the request arrived. JPMorgan's guidance says to make the call yourself, use a trusted number from a system of record, and speak to the person responsible for the change.

Each shortcut below fails that test. The reasons are ours unless a source is named.

Shortcut	Why it does not count
Caller ID	Caller ID can be spoofed.
A number, link or contact in the request or the email signature	JPMorgan: calling the provided number may connect you directly to the criminal, who will confirm fake instructions.
Replying in the same email thread, or confirming over chat	The same channel the requester controls. JPMorgan: if a bad actor has compromised employee emails, they can monitor conversations and intercept verification attempts.
An inbound call, even one that "confirms" an earlier request	JPMorgan: fraudsters might call you first. You must place the call.
A new letterhead or bank letter on its own	A document delivered through the same channel as the request proves nothing about who sent it.
A face or voice on a call	In the Arup case, CNN reported citing police, the video call is what ended the employee's doubts.
Facts about the person: employee ID, manager name, date of birth, last four of an SSN	Attackers hold this data. Google's UNC3944 guidance says to avoid public personal data for verification because the group often has it, and NIST's SP 800-63A-4, written for identity proofing by credential service providers, says knowledge-based verification shall not be used for identity verification.
A code or push sent to the device or mailbox being reset	Whoever holds that device or mailbox receives it.
A code word shared across a team	It leaks, and it proves nothing about the channel.

A code word has a narrower use. The FBI suggests a secret word or phrase with family. In the AFP survey, 42% of organizations use passcodes known only to both parties for wires, and 52% of those rating the control call it very effective. In our view such a passcode adds a factor to a wire and does not replace the call-back.

Which actions need a check, and what happens if it fails

Any action that moves money or changes who can get into an account needs a check, and a failed check means hold, never proceed. The matrix is our analysis; the sources behind individual rows follow it.

Action	Required check	Performed by	If the check cannot be completed	Exception approver
Change to a vendor's bank details	Outbound call to the pre-request contact in the vendor master file	AP clerk, then controller	Hold all payments to the new details	Controller may approve another independent channel, such as a visit; never skipping
New payee	Same, plus ownership of the details confirmed with the payee	AP clerk	No payment	Controller
Urgent or out-of-pattern payment, including one "from an executive"	Call the requester at the directory number; second approver	Treasury analyst, second approver	Hold	CFO, by an independent channel
Password reset	Tier 1 or higher in the help desk table	Help desk agent	No reset	Service desk manager
MFA reset or new authenticator	Tier 2	Help desk agent	No reset	Security lead
New device enrollment	Tier 1, Tier 2 for privileged users	Help desk agent	Do not enroll	Security lead
Privileged access grant	Tier 2, plus the system owner's approval	Access owner	No grant	CISO
"IT" or "security" contacts an employee asking for a code, a remote session or a connected-app approval	Employee hangs up and calls the published help desk number	Employee	Refuse	None
New hire	Layered checks in the hiring section	Recruiting and HR	Do not issue access	CHRO and CISO

The first rows follow the FBI's advice to use secondary channels and/or two-factor authentication to verify requests for changes in account information. The password and MFA rows follow what CISA's advisory on Scattered Spider describes: actors who posed as employees to convince help desk staff to reset passwords and move MFA to a device they control.

When someone claiming to be IT calls an employee

Staff need a standing instruction: if anyone from IT or security asks for a code, a remote session or an app approval, hang up and call the help desk at the number on the intranet. The rule runs in both directions. The same CISA advisory describes actors posing as IT staff to convince employees to share a one-time password and to run remote access tools. Google's threat intelligence group reported a campaign in which operators impersonating IT support got victims to authorize a malicious connected app.

How to handle a payment change or an urgent payment

The AP clerk never acts on the request. They call the vendor contact already in the master file, a second person approves, and the new details stay on hold until the record shows the call happened. The call in step 2 comes from JPMorgan's callback guidance. Step 1, the deadlines and the owners are our recommendations, as are the steps marked below.

Same day, AP clerk: log the request and do not reply in the thread. Check: a ticket exists with the original message attached.
Within one business day, AP clerk: call the contact and number in the vendor master file as it stood before the request, and speak to the person responsible for the payment instructions. Check: the record holds the name, number, time and the answer.
Before release, second approver (our recommendation): a person who did not take the request confirms the record and approves the change. Check: two different user IDs on the change.
Hold (our recommendation): no payment goes to the new details until steps 2 and 3 are complete. In the one sentence of its answer visible to non-members, IOFM's Ask the Expert column says there is no industry standard for holding payments. That is one expert's answer, so in our view the company sets the length and writes it down.
Same day as the change, controller (our recommendation): call the previously registered contact and tell them the details changed. Use the phone, because a compromised mailbox can intercept email. Check: a logged call or a logged reply.

Treat requests from inside the company the same way: an "executive" asking for an urgent wire is called back at the directory number, and the request waits for that call.

The residual risk is that the contact in the system of record was itself changed earlier by an attacker. Put change control on the vendor master file and on HR contact data: a changed phone number or contact person is itself a trigger, and the new number cannot be used for call-backs until a separate route confirms it.

In the AFP survey, 94% of organizations say they verify fund transfer requests by calling an authorized contact at a phone number from official records, not from email, and 63% of those rating the control call it very effective, while 74% were affected by BEC in 2025. These figures are self-reported. They do not show whether call-backs stop losses, or whether staff actually used the number on record.

How the help desk should verify a caller

Make the verification tier follow the account's risk, and make the check at higher tiers a combination of independent checks. A call-back alone is enough for a standard user only if it reaches a number the attacker cannot influence. It is not enough for an account whose compromise would be serious.

Tier	Who	Accepted verification
1	Standard user	Call-back to the number in the HR or identity provider (IdP) record, or a prompt to an authentication factor that is still enrolled
2	Privileged users, and anyone whose reset would grant access to money or admin tools	Two independent checks, for example the Tier 1 call-back plus approval from the manager reached by phone at a directory number, or identity verification through the IdP or a verified-ID service
3	Executives and top admins	Tier 2, performed by security staff rather than the front-line desk, or in person. No exceptions

Tier 1 falls short at the top for two reasons. A registered mobile number can be taken over: CISA's advisory says actors convinced cellular carriers to transfer control of a targeted user's phone number. Manager approval can come from a compromised account: Microsoft describes attackers, in some cases, bypassing password reset procedures by using a compromised manager's account to approve their requests. So at Tier 2 the checks must not share a failure point, and the manager step is a phone call, not a chat message.

Video with government ID is a weak rung. Google's guidance lists on-camera or in-person verification and Okta's 2023 advisory recommends visual verification, but the same NIST guideline says that all types of remote identity proofing are in some way vulnerable to forged media, including visual comparisons by proofing agents. FinCEN's alert to financial institutions lists a third-party webcam plugin during a live verification check as a red flag. Our rule: a face alone never verifies, video with ID counts only beside a second independent check, and in-person verification ranks highest.

Four more rules:

Limit what the desk can reset. Microsoft advises scoping privilege to exclude administrative operations over Global Administrators, and Okta advises constraining custom help desk roles so they exclude groups of highly privileged administrators.
Do not let the procedure be the secret. CISA reports the actors first learn what steps are needed for password resets from help desks, so the rule must hold when the caller knows it. CISA also names contracted IT help desks as targets, so an outsourced desk's contract has to carry the same tiers.
Send temporary credentials only to a channel the verification step established. Google's recovery steps tell admins to send a backup code in an IM or text message. Do that only to a channel you verified, not whichever one the caller names.
Tell the user after every reset. NIST's SP 800-63B-4 says account recovery shall cause a notification to the subscriber or their designee, and Okta advises turning on and testing new device and suspicious activity notifications. Send it through a known channel, and never to the device just enrolled.

Which credential is reissued, and the checks afterward, are in our phishing-resistant MFA rollout guide.

How to verify a remote hire

For hiring, do not use the single call-back rule. A new hire has no record that predates the request, so there is nothing to call back, and the FBI says North Korean IT workers cannot be identified reliably with a single indicator. Use layered checks across the employment lifecycle.

Most of the names and addresses these workers give prospective employers come from stolen identities, the FBI says, and the actors often validate the stolen data so it will pass employment background checks. The FBI also says paid individuals appear in interviews and meetings and verify fraudulent identities, and that sometimes one person passes the interview while a different person does the work. The FBI says these workers pay facilitators to keep employment-related devices connected to the Internet from locations such as personal residences while the workers access them remotely. In our view, the same-person check and a verified shipping address therefore raise friction, but they are not proof. The FBI says much the same of other checks: E-Verify, requiring a U.S. passport, multiple forms of identification or live verification can raise friction. That line describes friction, not a checklist. The USCIS Form I-9 handbook says an employer cannot specify which documentation an employee presents from its lists of acceptable documents, so have counsel decide which IDs you ask for and when.

Stage	Owner	Check
Interviews	Recruiting lead	Complete as much of hiring and onboarding as possible in person, as the FBI's January 2025 advisory advises. Capture images for comparison with later meetings
Offer	HR operations	Where location allows, in-person identity verification such as fingerprinting or a drug test, which the FBI suggests to verify identity and claimed location. Treat the result as one layer: the FBI's October 2026 alert says these workers pay people to complete urinalysis tests or fingerprint submissions
Before shipping	IT asset manager	Signature delivery, and ship only to designated work locations, per the FBI and South Korea advisory. No access to any systems until the background check is complete, per the FBI's July 2025 alert
Day one	Hiring manager and IT	Same-person check by the reviewer who saw the person earlier, then provisioning with least privilege
After day one	Security	Identity verification throughout employment, per the January 2025 advisory, and layered access controls and detections, per the October 2026 alert

Indicators the advisories state include a home address for laptop delivery that is a freight forwarding address or changes quickly after hiring, accounts and addresses that rotate, and unwillingness to appear on camera. The last is weaker now that people are paid to appear on camera. The FBI's tip to ask someone to wave a hand in front of their face is itself a visual test, so do not rely on it. Leave out the 2023 advisory's indicator about the country of education: the FBI warns that relying solely on ban lists or filtering out associated names can be unreliable and block qualified applicants, and that aggressive controls carry unusually high risks of false positives that could harm legitimate employees. In our view, nationality is not a control. Run identity checks the same way for every candidate and have counsel confirm they fit employment and biometric privacy law.

Microsoft also reports attackers impersonating newly hired employees to blend into on-hire processes. A "new hire" calling the help desk gets Tier 2 until HR confirms by phone.

How to make staff follow the rule under pressure

People follow the rule when it is written down, they are permitted to hang up, and nobody is blamed for delay. Seniority is the pressure point. A Hong Kong police officer said, according to The Standard, that subordinates generally may not interrupt their supervisors.

Within 30 days, CISO and CFO: issue written permission for any employee to hang up and call back, and a no-blame statement for delaying a real executive.
Within 30 days, each executive: pre-commit in writing that a call-back is expected of them, so a delay is never read as disrespect. The NSA, FBI and CISA ask organizations to rehearse a plan and include executives who may be prime targets.
Quarterly, security awareness lead: rehearse with a tabletop; the same document advises several. Each role (clerk, agent, recruiter) practices the call and the hold.
At onboarding and annually, security awareness lead: train staff on the procedure. In our view, a sense that something is off should never be what the rule depends on, because the procedure has to run when nothing feels wrong.

How to check that it works

Count the trigger events that have a recorded call-back, and review every exception monthly. These checks are our recommendations.

Monthly, controller and service desk manager: compare the vendor master change log and the IdP reset log with the call-back records. Any trigger event without a record is a finding. An AI agent can run this reconciliation and flag the gaps, and a person reviews each one.
Monthly, security lead: review the exception log, who approved what and why, and look for repeat requesters.
Twice a year, security lead: test the whole rule in a tabletop with all its owners.
Twice a year, security team with HR and legal sign-off: run authorized internal test calls to the desk and to AP, as a program with a scoped plan, and record whether the tier was applied.

Copyable policy text

Replace the bracketed items and adapt the tiers to your IdP.

CALL-BACK VERIFICATION POLICY
Owner: [CISO]. Approved by: [CFO, CHRO, CIO]. Effective: [date].

1. Rule
Before acting on a trigger request, the person responsible verifies it through a channel the requester does not control: an outbound call to a number from [vendor master file / HR record / IdP directory] as it stood before the request.

2. Triggers
- Change to a vendor's bank details or contact; a new payee
- An urgent or out-of-pattern payment, including requests from executives
- Password reset, MFA reset, new authenticator, new device enrollment
- A privileged access grant
- Any contact from "IT" or "security" asking for a code, a remote session or an app approval (refuse and call [help desk number])
- A new hire's first-day help desk requests (Tier 2 until HR confirms by phone)

3. Accepted methods
[Tier table from the help desk section.]

4. Does not count
Caller ID; a number, link or contact in the request; the same email thread or chat; an inbound call; a letterhead alone; a face or voice on a call; personal facts; a code or push sent to the device or mailbox being reset; a code word shared across a team.

5. If the check cannot be completed
Hold. Do not proceed. Escalate to [role].

6. Exceptions
Only [role] may approve another independent channel. Nobody may approve skipping the check. Executives are not exempt.

7. Permission
Any employee may hang up and call back. No one is penalized for delaying a request to verify it.

8. Records
Keep the name, number, time, answer and approver for [period set by counsel]. Review monthly: [owners].

9. Hiring
Follow [hiring procedure]; a new hire has no prior record to call back. Identity checks apply to every candidate alike and are reviewed by counsel.

Call-back verification: one rule for payment changes and help desk resets, layered checks for remote hires