Deepfakes at the Payables Desk: The Controls Small Businesses Need Against AI Fraud

Oct 30

7 min read

Updated: 5 hours ago

For the first time, the FBI's annual Internet Crime Report, released in April 2026, counted complaints with an artificial intelligence connection: 22,364 in 2025, with about $893 million in reported losses. Business email compromise (BEC) remained the second-costliest category, at $3.05 billion. That total included more than $30 million in losses from BEC complaints that referenced AI. Since the report came out, FBI alerts in July and September have described criminals using AI-generated video to pose as officials, an October alert urged employers to layer identity checks on remote hires, and on Sept. 24 the Federal Trade Commission opened a review of how online advertising tools help impersonation scams spread.

The AI-specific dollar figures are small next to total losses. The trend matters anyway. AI is changing how fraudsters earn trust, and the most reliable defenses are procedures, not detection software.

What the official sources report

The FBI's 2025 data. The Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, reporting $20.877 billion in losses, up 26% from 2024. The report says generative tools can write convincing emails that impersonate executives and carry phishing links or wire instructions, and that cloned voices can be used to request wire payments. Other AI-linked losses included more than $5 million in voice-cloned "family emergency" scams and almost $13 million tied to voice spoofing or suspected voice deepfakes in online job interviews, used mainly to gain access to private networks. Losses in investment-fraud complaints that referenced AI topped $632 million. Because the tally depends on victims recognizing and reporting AI involvement, it is best read as a floor.

Recent FBI alerts. A July 20, 2026, public service announcement (I-072026-PSA) warned that criminals were circulating deepfake videos of a senior FBI leader that steered victims to a spoofed IC3 website, and were using AI video in live chats. It noted that cloned voices can sound nearly identical to the real person. A Sept. 17 alert (I-091726-PSA) on government and law enforcement impersonation counted nearly 61,000 complaints and more than $1.6 billion in losses from January 2025 through July 2026. It said scammers now use AI to appear as officials on video calls. Medical practitioners were singled out with threats about misused or expiring licenses, a pretext that produced 3,322 complaints and more than $37 million in losses. On Oct. 13 (I-101326-PSA), the FBI warned that North Korean IT workers are using paid facilitators and stolen identities to land remote jobs at U.S. companies. That alert does not attribute the scheme to AI, but it targets the same weak point: verifying identity at a distance. The FBI recommended an approach it calls identity in depth: layered checks throughout the employment relationship.

FinCEN. The Treasury Department's Financial Crimes Enforcement Network remains the most detailed official source on deepfakes. Its alert FIN-2024-Alert004, from November 2024, describes three patterns. Criminals pair AI-generated images with stolen or invented personal data to create synthetic identities. They alter or fabricate identity documents. And they use deepfake voice and video to impersonate executives and employees in BEC and similar schemes. FinCEN said suspicious activity reports describing deepfakes rose from 2023 into 2024, and it cited a reported case in which a finance worker paid out $25 million after a video call with a deepfaked chief financial officer. On Sept. 3, 2026, FinCEN separately reported that 33,904 Bank Secrecy Act reports filed between September 2023 and December 2025 involved about $12.7 billion in activity linked to suspected digital asset investment scams, which FinCEN tied to overseas scam centers.

The FTC. Consumers reported losing about $16 billion to fraud in 2025, a record. Imposter scams accounted for nearly $3.5 billion, including nearly $1 billion lost to people posing as businesses and about $920 million to government impersonators. The FTC's Sept. 24 advance notice of proposed rulemaking, approved 2-0, asks whether to write rules aimed at search engines, social media and other platforms whose ad-optimization tools further impersonation scams. Comments are due 60 days after its Federal Register publication, scheduled for Oct. 1, which points to about Nov. 30.

Why the old warning signs no longer work

For years, fraud training told employees to look for misspellings, awkward phrasing and unfamiliar voices. Generative AI erases most of those cues. The FBI said in a December 2024 alert that criminals use AI to write messages faster and to translate them with fewer telltale errors, to clone voices, and to stage live video calls posing as company executives. The FBI still lists visual giveaways such as distorted hands, odd shadows and lag on calls. Businesses should treat those as a bonus, not a safeguard. The safer assumption is that a fraudulent request will look and sound genuine. Controls therefore need to verify the request through a channel the fraudster does not control.

The controls to adopt now

1. Call-back verification on independently sourced numbers. The FBI's advice is to hang up and contact the person or organization at a number you found yourself, and to use a second channel to confirm any change to account information. Apply that rule to every new payee, every change in vendor bank details, every change to an employee's direct deposit, and every urgent or "confidential" payment request from an executive. Never use the phone number, link or email thread contained in the request itself.

2. Dual authorization and separation of duties. Require two people to approve payments above a set amount, and keep the person who sets up or edits a vendor from approving payments to that vendor. Use the bank's own controls: dual approval in the online banking portal, positive pay for checks, ACH debit blocks or filters, and wire limits. Make clear in writing that no executive can override the process by phone or video.

3. Vendor master-file discipline. Limit who can edit vendor records. Require a documented change request, verify it by call-back, and hold the first payment to new bank details until verification is complete. Review a report of all vendor-file changes weekly, and deactivate dormant vendors.

4. Code phrases for payment requests. The FBI suggests families agree on a secret word to verify identity. Businesses can adapt the idea with pre-agreed challenge questions for any payment or data request made by phone or video. Even with a code phrase, a phone or video call should not be the only authorization for moving money.

5. Identity checks at the front door. For remote hiring, follow the FBI's layered approach: multiple forms of identification, live verification, E-Verify, and attention to remote-access software or repeated changes to bank accounts and addresses. For new customers seeking credit terms, FinCEN's red flags for banks are a useful checklist: photos that conflict with other data, mismatched documents, third-party webcam plug-ins during verification, and refusal of multifactor authentication.

6. Hardened email and cloud accounts. FinCEN recommends multifactor authentication, including phishing-resistant forms. A Sept. 1 FBI alert on "consent phishing" explains why passwords are not enough. A victim tricked into approving a malicious app grants it persistent access to email and files, and changing the password does not revoke that access. The alert focused on prominent individuals, but any business on Microsoft or Google cloud services should periodically review which third-party apps have access, and consider requiring administrator approval for new ones.

7. Less raw material for cloning. The FBI recommends limiting the images and voice recordings people post online. Executives cannot disappear from the internet, but companies should assume that any public video of a leader can be used to clone that leader's voice and face.

8. Training built on scenarios. Short, realistic drills for accounts payable, payroll, human resources and executives work better than annual slide decks. Employees need explicit permission to pause any request, however senior the apparent sender, without fear of blame.

9. A response plan that moves in hours. The FBI's Financial Fraud Kill Chain handled 3,900 incidents in 2025 and froze about $679 million of $1.16 billion in attempted theft, a 58% success rate. Speed drives those results. If money goes out, call the bank's fraud line immediately to request a recall, then file at ic3.gov regardless of the amount. Beware of follow-up "recovery" offers. The FBI says IC3 does not contact victims directly, and "IC3 will never ask for payment to recover lost funds."

What to document

A written payment-verification policy approved by the owner or board.
A verification log for each call-back showing the date, the requester, the number called, where that number came from, and who confirmed.
Vendor change forms with supporting evidence, and approval trails from the banking portal.
Training records and drill results.
An incident playbook with bank fraud contacts, insurer and counsel contacts, and the IC3 reporting link.

For businesses with audited or reviewed financial statements, these records are also evidence of internal control over cash disbursements. It is also worth checking whether a crime or social-engineering insurance policy imposes its own verification conditions and sublimits.

Timing

The fourth quarter brings year-end vendor payments, bonuses and staff vacations, followed by W-2 and 1099 season in January. That makes November a sensible time to test these controls with a tabletop exercise. Businesses whose names or brands have been used in impersonation scams may also want to comment on the FTC's notice before the deadline.

Sources

This article is general information, not tax, legal, or accounting advice. Consult a qualified professional about your situation.