When the Supplier's Voice Is Synthetic: Payment Fraud Defences for UK Finance Teams

Invoice fraud is not new. Finance teams have dealt with impersonation, altered bank details and persuasive emails for two decades. What has changed is the cost of convincing a listener. A convincing clone of a known voice can now be produced from a handful of seconds of public audio — a conference talk, a podcast, a video on a company website. A plausible likeness on a video call is within reach of anyone with a laptop and a modest subscription.

That shift undermines a control many organisations rely on without ever writing it down: the belief that staff will recognise something is wrong because they know the person.

The scenarios worth rehearsing

The urgent supplier call. A caller claiming to be from a long-standing supplier reaches the accounts payable team. The voice is familiar. The story is specific: a banking error, a regulatory hold, a payment that must move before month end. Documentation arrives by email to support it. The pressure is time.

The invoice with new bank details. A genuine-looking invoice arrives from a genuine-looking domain, differing by a single character. It references real purchase orders and real project names, drawn from a compromised mailbox or public tender records. The request to update payment details is polite and plausible.

The executive on video. The most expensive variant. In 2024 a multinational engineering firm's Hong Kong office was defrauded of approximately £20 million after staff joined a video conference populated by deepfaked colleagues. The lesson was not that the technology is flawless; it is that authority, familiarity and time pressure together override ordinary scepticism.

Why 'we would spot it' is the most expensive sentence in the room

Most finance professionals, asked whether they would fall for a cloned voice, say no. The evidence suggests otherwise. Recognition of synthetic speech is unreliable, particularly over a poor mobile connection, and video is now convincing enough to survive casual scrutiny. Add the social dimension — a junior colleague does not want to challenge a finance director, and a finance director does not want to delay a supplier relationship — and the technical question becomes secondary.

The useful assumption is not that staff will detect the fraud. It is that some attempts will get through, and that the payment process must catch them anyway.

Verification that holds under pressure

The single most effective measure is an out-of-band callback to a number already held on file — not one supplied by the caller, not one in the email signature. This should be mandatory for any change to supplier bank details and for any payment that departs from an established schedule. The callback should be made by a second person and the result recorded.

Organisations should also maintain a verified supplier register, with bank details confirmed at onboarding by a documented method and re-confirmed at least annually. Invoices above a defined threshold should require dual authorisation from two individuals who cannot approve alone, and payment runs should follow a fixed calendar, so that a request to break the cycle is itself a red flag.

Payment controls that buy time

Fraud succeeds on urgency, so controls should insert delay. Introduce a mandatory twenty-four to forty-eight-hour hold on first payments to new payees and on any change of bank details, communicated to suppliers in advance so the pause is normal rather than suspicious. Segregate the duties of setting up a supplier, approving an invoice and releasing a payment; in smaller teams this can be achieved by requiring the managing director or finance director to release anything above the threshold. Restrict who can amend standing data. Review payment exception reports weekly, not annually.

Email authentication still matters. Enforcing DMARC with a reject policy, monitoring lookalike domains and training staff to check the full address rather than the display name will reduce the volume of attempts. None of it addresses a phone call.

The first hour after a suspicious approach

Treat a near miss as an incident. Preserve the call recording or email headers, note the numbers and addresses used, and notify the bank immediately if funds have moved — recall is time-critical. Report to Action Fraud, and consider informing the NCSC. Notify the insurer in line with the terms of the policy, and involve the incident response retainer if one exists. Where personal data has been accessed, the UK GDPR seventy-two-hour assessment clock may apply.

It is worth noting that the mandatory reimbursement arrangements for authorised push payment fraud, introduced by the Payment Systems Regulator, protect consumers and some small organisations — not commercial payments of the size discussed here. For most businesses, once the money has been transferred, the loss is the business's own.

Questions for the board

Does the finance team have a documented, tested procedure for verifying payment changes, and has it been exercised in the last twelve months? Are deepfake and impersonation scenarios included in the incident response plan? Can the organisation name the individual authorised to approve an out-of-cycle payment, and would staff recognise a request that bypasses them? Has the supplier register been reconciled this year?

Technology has raised the standard of the impersonation. The defence remains unglamorous: a second channel, a second person and a little time.