The Friday Payment and the Cloned Voice
At 4:40 p.m. on a Friday, a junior accounts payable clerk at a 60-person construction firm receives a phone call from a number matching the finance director's. The voice is familiar, slightly urgent: an acquisition is about to close, and £48,000 must be sent within the hour to a new supplier, or the deal collapses. A follow-up email from the director's address gives bank details and says not to discuss it with colleagues because of confidentiality. Earlier that week, the clerk had pasted a supplier contract into a free online 'summarise this document' tool to save time. Head office policy requires two-person authorisation for payments over £10,000, but the finance director is the second approver and is 'unavailable'. The clerk is about to process the payment.
1. List the warning signs in this case and explain why each is suspicious, distinguishing technical indicators from social-engineering pressure.
Read the worked answer
Social-engineering pressure
- Urgency: one hour, deal collapses.
- Secrecy: 'don't discuss with colleagues', which disables the control that would stop the fraud.
- Authority: the finance director, the clerk's senior.
- Exception framing: the normal two-person rule is waived because the second approver is 'unavailable'.
Technical indicators
- Caller ID matches the director's number - easy to spoof; a familiar voice can be cloned from a short sample.
- Email from the director's address may be spoofed or a compromised account.
- New payee and new bank details, changed at the last minute.
- The amount is over £10,000, so policy applies; the request is an explicit attempt to bypass it.
The combination is the signal. Any one alone is weak; together they match CEO-fraud and voice-cloning patterns.
2. What should the clerk do in the next ten minutes, and what should the firm change afterwards?
Read the worked answer
Next ten minutes
- Do not pay. Stop the process and tell a supervisor.
- Call the finance director on a number from the internal directory, not the number that called, and not the email reply chain.
- Ask a second person to verify the supplier through an independent channel.
- Preserve the email headers and call log; report to security/IT.
- If payment details were already entered, ask the bank to recall or hold it.
Afterwards
- Enforce two-person approval with an approver independent of the requester; no exceptions by phone or email.
- Add callback verification for all new payees and changed bank details.
- Train staff on deepfake voice and CEO fraud; run a test exercise.
- Review email authentication (SPF/DKIM/DMARC) and payment limits.
- Make it safe to challenge a senior request.
3. The pasted contract: what risk did that create, and how should it be handled?
Read the worked answer
Risk: the contract likely contains commercial terms, supplier names, pricing and possibly personal data. Pasting it into a free consumer tool may breach confidentiality, the supplier's NDA and data-protection law. Free tools often reserve the right to use inputs to improve models, and the clerk cannot know where the data is stored or who can access it.
Handling
- Report it the same day to the data protection lead or security; do not delete the evidence.
- Check the tool's terms and privacy notice; ask whether training can be disabled and whether the data can be deleted.
- Assess whether the contract contains personal data; if so, follow the breach process and consider notification.
- Notify the supplier if their confidential information was exposed, as the contract may require.
- Move summarisation to an approved tool with a data-processing agreement, or redact names, prices and clauses before use.
- Add a short 'approved AI tools' list and a one-page rule: no confidential documents in public chatbots.