Jennifer Marsh almost transferred the money before she second-guessed herself.
She was a finance manager at a mid-sized manufacturing company, and the call had come through just after four in the afternoon. It was her CFO's voice, unmistakably his, asking her to process an urgent wire transfer to close a time-sensitive supplier deal before the close of business. He sounded rushed, slightly irritated, exactly the way he sounded whenever a deal was coming down to the wire.
Jennifer had processed similar requests before. This one felt routine, right up until the CFO mentioned a supplier name she didn't recognize and a payment amount well outside their normal range. She asked him to confirm the details over email as a formality. The line went quiet for a second too long before the voice agreed and hung up.
She sent a message to the real CFO's assistant instead of waiting for that email. Ten minutes later she had her answer. He had been in a meeting all afternoon and had never made that call.
What Jennifer had heard on the phone wasn't her CFO. It was an AI generated voice, built from public recordings of his earnings calls and conference appearances, convincing enough to fool someone who had spoken to him dozens of times before.
Deepfake fraud targeting financial approvals has moved from a novelty to a real operational risk faster than most finance teams have been able to adjust. The reason is simple. Voice and video generation tools have gotten good enough, and cheap enough, that recreating a specific executive's voice no longer requires a Hollywood budget or specialized skill. A handful of public interviews or recorded earnings calls is often enough raw material to work with.
Attackers have also gotten smarter about timing. These calls rarely come in during a quiet Tuesday morning. They come in late in the day, near a deadline, when the person on the receiving end is already primed to move fast and less inclined to slow down and verify.
The financial world has spent years training employees to spot suspicious emails. Deepfake voice fraud sidesteps that training entirely, because the natural instinct most people have built is to trust what they hear on a phone call from someone they recognize.
Jennifer's company treated the incident as a warning rather than a near miss to quietly forget. Their head of finance operations, a careful, detail-oriented man named Thomas Reid, used it to push through a policy that had been sitting in draft form for months.
The new rule was simple but strict. Any financial request above a defined threshold, regardless of who appeared to be asking or how urgent it sounded, required a second verification through a separate, pre-agreed channel. A phone call could no longer authorize a transfer on its own, no matter how convincing the voice on the line sounded. If the CFO called asking for an urgent wire, the person receiving that call had to confirm it through a method the CFO could not spoof on the spot, like a code word established in advance or a callback to a number stored in the system rather than one provided during the call itself.
Thomas also pushed for something less technical and more cultural. He made it clear to every member of his team that pausing to verify a request, even one that appeared to come from the CEO or CFO directly, would never be treated as a lack of trust or a career risk. Before the policy change, employees like Jennifer often felt pressure to move quickly rather than slow down and question someone senior. That pressure was exactly what attackers were counting on.
The hardest part of defending against this kind of fraud is that it doesn't look like a typical security threat. There's no suspicious link, no obvious spelling error, no strange sender address. It sounds like a normal conversation with someone you already trust.
That means the usual security awareness training, built around spotting phishing emails, doesn't fully prepare employees for this. Companies serious about closing this gap have started running realistic simulations, using the same kind of AI voice tools attackers rely on, so employees experience what a convincing deepfake call actually sounds like before they encounter one for real.
Jennifer went through one of those simulations two months after her own close call. She said it was unsettling how normal it sounded, right up until she remembered the same detail that had saved her the first time. A legitimate urgent request can always survive a second, independent check. Only a fraudulent one falls apart when someone insists on verifying it a different way.
Deepfake fraud succeeds by exploiting trust and urgency at the same time. The fix isn't a piece of software that detects fake voices with perfect accuracy, because that technology is still catching up to how convincing these attacks have become. The real fix is a process that never lets urgency override verification, no matter how familiar or authoritative the voice on the other end sounds.
Jennifer still remembers how close she came to sending that transfer. What stopped her wasn't suspicion. It was a policy that gave her permission to pause.
Evvo Labs helps organizations build verification processes and training programs that hold up against AI generated fraud, including deepfake voice and video attacks. Our consulting teams design approval workflows that protect against impersonation without slowing down legitimate business.