How to spot an AI-generated voice or video impersonating your boss

TL;DR — If a message from your boss asks for urgency, secrecy, money, passwords, gift cards, wire changes, or document access, treat it as untrusted until you verify it in a second channel you start yourself. The single most reliable fix is not “spotting the fake perfectly”; it is using a callback number, known chat thread, or in-person check plus a pre-agreed code phrase or approval rule. Reading time: ~5 min

Goal

When you finish, you will have a practical checklist you can use during a suspicious call or video, and a simple verification process your team can follow so an AI-generated voice or video does not trick you into sending money, sharing credentials, or approving access.

Prerequisites

• Your company directory or contact list with your boss's known phone number and email address
• Access to your normal work communication tools, such as your company chat, email, and phone
• A note-taking app or paper to record what was requested, by whom, and when
• If your company has one: the security contact, help desk address, or incident-reporting form
• Optional but useful: one pre-agreed verification phrase or approval rule for sensitive requests

Steps

Step 1: Pause and classify the request

Use this checklist the moment the call, voicemail, or video starts asking for action:

Treat as HIGH RISK if any of these appear:
- "Do this right now"
- "Keep this between us"
- "Buy gift cards"
- "Change bank details"
- "Send payroll/W-2/customer list"
- "Share the MFA code" (multi-factor authentication code)
- "Open the document and sign in"
- "Join this new meeting link instead"

What you should see when this step succeeds: you can label the request as either "normal" or "high risk" before doing anything else.

Step 2: Do not use the contact details provided in the suspicious message

Use a trusted contact path that you open yourself:

Company directory / HR system / existing chat thread / saved phone contact

If you only have email, reply in the existing known thread, not to a new address shown in the suspicious message.

What you should see when this step succeeds: you are contacting your boss through a number, chat, or email thread that existed before the suspicious message.

Step 3: Ask one verification question only the real person should answer

Use one short prompt. Copy and paste one of these exactly:

"I need to verify this request. Please call me back from your saved number."

"Please confirm this in our existing Teams/Slack chat."

"What is the approval code phrase for urgent payment requests?"

"Please ask [finance lead name] to confirm in the usual channel."

What you should see when this step succeeds: the real person confirms through a known channel, or the impersonator stops responding or pushes harder for urgency.

Step 4: Check for common deepfake warning signs during the call or video

Look for clusters of signs, not just one sign by itself:

Voice signs:
- Unnatural pacing or flat emotion
- Odd pauses before answering simple questions
- Pronunciation changes mid-sentence
- Background noise that never changes
- Refuses interruption; talks over you to keep control

Video signs:
- Lip movement slightly off from speech
- Blurry teeth, chin, or hair edges
- Face lighting does not match the room
- Head turns cause brief face warping
- Hands rarely shown, or gestures look delayed

Then ask one unexpected question:

"Where are you calling from right now, and who did you meet with before this call?"

What you should see when this step succeeds: either the person answers naturally and consistently, or the answer becomes vague, delayed, or deflecting.

Step 5: Refuse sensitive actions until the request passes your normal approval path

For any money, payroll, customer data, password reset, MFA code, or vendor bank change, use this rule:

No action until two conditions are true:
1. Verified in a second channel you started yourself
2. Approved by the normal business process already used by your team

Examples of normal business process:

- Finance ticket approved by manager + finance lead
- Vendor bank change confirmed with known vendor contact
- Access request approved in your identity or IT system
- Payroll export approved by HR lead in the usual tool

What you should see when this step succeeds: the request moves into your normal process instead of being handled from the suspicious call or video.

Step 6: Save evidence and report it

If the request still looks suspicious, record the details and report it.

Copy this template into email, chat, or your incident form:

Subject: Suspected AI impersonation of [boss name]

Time received:
Channel: phone / voicemail / video / email / chat
Caller/display name:
Phone number or account shown:
What was requested:
Any links or attachments:
Verification step taken:
Result:
Screenshots or recording saved at:

If your company has no formal process, send it to your manager, IT help desk, or security contact.

What you should see when this step succeeds: the suspicious request is documented with enough detail for someone else to investigate without asking you to recreate it.

Step 7: Set one team rule now so the next attempt fails faster

Pick one rule and circulate it in your team chat or handbook:

Rule option A: No payment or bank-change requests are accepted by voice or video alone.
Rule option B: Any urgent executive request must be confirmed in the existing company chat thread.
Rule option C: MFA codes and password reset links are never shared by phone or video.
Rule option D: Sensitive requests require two-person approval, even from executives.

What you should see when this step succeeds: your team has one written rule that removes the attacker's easiest path.

Verify it works

Run this end-to-end check with a coworker or manager:

1. Have them send you a fake urgent request by voice note or chat.
2. Do not act on the request in that channel.
3. Verify using the saved phone number or existing chat thread.
4. Ask one unexpected question.
5. Route the request into the normal approval process.
6. Log the event using the reporting template.

Expected result:

- No money, credentials, MFA code, or sensitive file is shared from the original message
- Verification happens in a second trusted channel
- The request is either confirmed safely or reported as suspicious

Common pitfalls

Treating a familiar voice as proof

Mistake: assuming "it sounds exactly like my boss" means it is real.

Symptom: you skip callback verification and act on urgency.

Fix: use the saved number or existing chat thread every time the request involves money, access, or secrecy.

Calling back the number from the suspicious voicemail or meeting invite

Mistake: using the contact details included in the suspicious message.

Symptom: the attacker answers the callback too, so the scam appears verified.

Fix: open the company directory, saved contact, or existing chat thread and start a new contact from there.

Letting urgency override process

Mistake: approving a wire, payroll export, or password reset because the caller says the CEO needs it in five minutes.

Symptom: you bypass the normal approver or vendor confirmation step.

Fix: apply the literal two-condition rule: second-channel verification plus normal business approval.

Focusing only on visual glitches

Mistake: trying to detect deepfakes only by lip-sync or face artifacts.

Symptom: a clean audio-only scam or high-quality fake gets through.

Fix: treat behavior as the stronger signal: urgency, secrecy, unusual payment path, new bank details, or requests for MFA codes.

Reporting too little detail

Mistake: sending "I got a weird call" with no number, time, screenshots, or request details.

Symptom: IT or security cannot block, trace, or warn others quickly.

Fix: paste the reporting template and fill every line you have, even if some fields say "unknown".

Assuming executives are exempt from controls

Mistake: believing a senior leader can override payment, access, or data-handling rules by voice alone.

Symptom: attackers target staff with fake executive authority because it works.

Fix: write one team rule that explicitly says executive requests still require the same approval path.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.