By Eric Kuvykin. Reviewed and expanded October 17, 2026.
A convincing voice or polished message should not be the approval control for a payment change. AI-assisted impersonation makes it especially useful to separate the content of a request from the evidence needed to authorize it. The practical defense is a repeatable verification path that staff can use even when the caller sounds familiar.
Identify the requests that move money
List supplier bank-detail changes, urgent owner instructions, refund exceptions, payroll changes and requests to install remote support software. For each, record the existing approval route and the independent contact method used to verify it. If the route is simply “ask the person who sent the message,” the process does not establish who is actually making the request.
Use saved contact details or another previously established channel to confirm a change. Do not rely on a telephone number or link supplied inside the new request. Employees should have permission to pause without being penalized for questioning apparent urgency, seniority or familiarity.
Rehearse an ordinary exception
A hypothetical New Jersey business might receive a message appearing to come from a regular supplier, asking that an overdue invoice be sent to a new account. In a training exercise, staff would preserve the request, contact the supplier using existing records and obtain the required internal approval before any change. The scenario does not prove any particular supplier is compromised; it tests the business’s own process.
Include a legitimate request in the exercise. The team must be able to complete a real change after verification, not simply reject every unfamiliar message. Keep the approval evidence with the supplier record and restrict who can edit payment details. Avoid spreading sensitive information through a large chat group while trying to verify it.
Prepare a response path
If a suspicious request has already been acted on, contact the relevant financial institution or payment provider promptly through a trusted route and follow its instructions. Preserve messages and transaction references. Assign one person to coordinate the response so employees do not issue conflicting instructions.
Review incidents and near misses for process gaps: missing contacts, unclear approvals or excessive account access. Update the workflow rather than attempting to teach staff to recognize every generated voice or image. A verification record remains useful even when the presentation of the next scam looks entirely different.
Related reading
For practical planning resources, see the AMS New Jersey business operations guide and the selected article library.
