A convincing voice is not approval
A finance employee receives an urgent call that sounds like an executive, followed by a request to change payment details. The event may involve synthetic audio, ordinary impersonation, a compromised mailbox or several techniques together. The immediate concern is the payment and the authority used to request it, not whether a voice detector returns a particular score.
The FBI has warned that criminals use generated audio and video for impersonation and financial fraud. In a specific incident, however, appearance alone does not establish the mechanism. Preserve the original communication and investigate the supporting records. Avoid accusing a colleague or supplier on the basis of a persuasive but unverified interpretation.
Coordinate the financial and technical tracks
If money may have been sent, the finance owner should promptly contact the relevant financial institution through a known channel and follow its fraud process. Capture payment references, timing and recipient details securely. Do not promise that funds can be recovered: the bank and other involved parties determine what actions remain possible.
In parallel, the security lead should establish whether business email, collaboration accounts, devices or shared documents were compromised. A genuine message thread can be abused after account takeover. Conversely, a fraudulent call does not by itself prove a tenant breach. Keep those hypotheses separate and assign evidence requests that distinguish them.
Preserve the original record
| Record | Why it matters |
|---|---|
| Original email with headers | Establish the message path and content |
| Call or meeting identifiers | Anchor timing and provider records |
| Existing recordings, where lawfully available | Preserve the original media rather than a re-encoded copy |
| Payment and approval records | Reconstruct who authorised which instruction |
| Account and document activity | Check whether the attacker had inside access |
Restrict access to sensitive material and agree a secure transfer method. Do not upload recordings containing confidential information to arbitrary public AI tools. Altering or repeatedly converting media can remove context that an investigator may need.
Verify through an independent route
Contact the purported executive or supplier using information already held in a trusted directory or established business record. The suspicious message may contain a convincing callback number, so calling that number can return you to the same attacker. Record the independent confirmation and preserve the original instruction unchanged.
Review what allowed the instruction to become an approved action. Did one person both change a beneficiary and release a payment? Was an urgent exception used? The investigation should identify the actual decision path before proposing controls, rather than respond only with a generic reminder to spot better-written phishing.
Close the incident with separate conclusions
The final account should distinguish confirmed financial activity, confirmed technical compromise, suspected impersonation methods and remaining uncertainty. Assign remediation to the right owner: finance approval controls, identity security, supplier verification or endpoint recovery may all require different work.
A useful exercise then tests whether a future urgent request can bypass independent verification. If the incident also affected Microsoft 365, use the Microsoft 365 compromise guide to plan the related account investigation. AI assistance can help organise evidence; it should not be treated as a definitive authenticity test.
Get help with the affected business systems
Explore this response workstream or our AI incident response services. You do not need to operate an AI application or prove the attacker used AI to request help. Describe the affected systems, observed impact and urgency; we confirm availability and agree an authorised scope.
Send only non-sensitive context through the website. If company email may be compromised, use a trusted communication channel and avoid sharing the investigation through the suspected account.
Sources and review
Reviewed 24 October 2026. The decision tables and planning examples are Atlant Security guidance. A suspected use of AI is not established attribution. Scope, availability and evidence handling are agreed before an engagement.
