When a familiar voice requests money, make verification a separate channel

FBI and CERT-In guidance supports an independent callback and reporting process that works without first proving a voice was generated by AI.

A familiar voice can make an unusual request feel ordinary. The caller appears to know a colleague's name, sounds impatient and asks for a transfer before a supposed deadline. The person receiving the call needs a process that works even when the audio is convincing and the situation feels urgent.

The central decision is whether the request is authorised. Proving that a recording was generated by AI is a different and often unnecessary task for the person deciding whether to send money or reveal information. A verification process should provide a safe pause, an independent contact route and a way to report concern without requiring certainty about the technology involved.

Recent official reporting keeps the context visible

The [FBI's 6 April 2026 release of its 2025 internet-crime findings](https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions) says the annual report includes an AI section for the first time and describes tactics including voice clones and believable videos. These are complaint-based findings, not a census of every incident or a measure of how often any particular call is fraudulent.

India's [CERT-In blueprint dated 25 May 2026](https://www.cert-in.org.in/s2cMainServlet?pageid=GUIDLNVIEW02&refcode=CISG-2026-02) includes AI-assisted impersonation and deepfake voice or video fraud among its threat scenarios. Its security-operations recommendations include verification procedures, escalation and reporting. The shared practical concern is that convincing presentation can put pressure on an ordinary decision process.

A fictional business rehearses a pause

Imagine a small design studio in Hyderabad. This is a fictional exercise involving adults, not a report about a victim. The studio rehearses a call that appears to come from a partner requesting an urgent change to a supplier payment. No actual money moves and no real person's voice is cloned.

The receptionist does not need to accuse the caller. A simple response explains that payment changes are checked through the studio's established process. The call ends, and an authorised colleague uses a contact method already held in the studio's records. The number supplied during the suspicious conversation is not used to verify that same conversation.

This arrangement gives staff a socially acceptable reason to pause. If the policy says only that employees should be alert, the individual must invent a response while under pressure. A rehearsed procedure makes the decision part of normal business operations rather than a personal confrontation.

Verify through a source the request did not supply

The [FBI's May 2025 warning about an impersonation messaging campaign](https://www.fbi.gov/investigate/cyber/alerts/2025/senior-us-officials-impersonated-in-malicious-messaging-campaign) advises independently identifying a phone number and calling to verify a contact. It also recommends checking unexpected new contact information through a previously confirmed platform or trusted source.

In the fictional studio, the same principle applies to a message that moves from a familiar email thread to an unfamiliar phone account. Being able to describe a recent project is not enough to change the payment process. The review focuses on the requested change, the authorised decision-maker and a separately verified channel.

The verification should be accessible. A staff member who cannot make a voice call needs an approved alternative. A trusted contact being unavailable should lead to a hold and escalation, rather than a rule that silently permits a transfer whenever verification is inconvenient.

Protect codes and account recovery

The FBI's campaign guidance also says not to provide two-factor codes through messages. The studio includes that boundary in the rehearsal. A caller asking for an authentication code, recovery link or screen-sharing session does not gain that access by claiming to be a senior colleague or an emergency support contact.

Requests to change contact details deserve the same care. An impersonator who persuades a business to replace the trusted number could weaken later verification. The studio therefore treats a contact-record update as a separate authorised change, with its own review, rather than allowing the caller to rewrite the route used to check the call.

For families, the FBI also suggests an agreed secret word or phrase. A business should avoid treating a single shared phrase as universal permission for financial or account changes. Its formal approval and payment controls still need to apply.

Detection can inform a decision without owning it

A service may offer to label synthetic audio. Before uploading a recording, an organisation should establish that it is permitted to share the material and understand the service's handling of it. A score should be interpreted under the service's documented limits; this article reports no detector accuracy or independent comparison.

The fictional studio's procedure does not depend on obtaining such a score. A genuine human caller can make an unauthorised request, and an uncertain recording can still justify a careful callback. The process remains useful across those possibilities because it verifies the instruction rather than trying to infer trust from the sound alone.

Staff should also avoid public accusations based on an inconclusive test. Preserve the relevant communication for an authorised review. A mistaken label can create a separate problem for a legitimate colleague or customer.

Reporting is part of the response

If money or account access may have been affected, contact the relevant bank or service through an independently established channel promptly. Follow the organisation's incident process and preserve the information needed for review, such as the timing, communication and transaction reference. Do not send passwords or authentication codes as evidence.

In India, the [Ministry of Home Affairs' parliamentary answer of 11 March 2025](https://www.mha.gov.in/MHA1/Par2017/pdfs/par2025-pdfs/LS11032025/1906.pdf) identifies cybercrime.gov.in for cybercrime reporting and the 1930 helpline for assistance with online cyber complaints. In the United States, the FBI's cited 2026 release directs reports to IC3. Reporting routes vary by jurisdiction; none is a promise of recovery.

Practise without copying a person's identity

The studio can rehearse the workflow with an ordinary scripted call, invented names and no real payment details. The test asks whether someone can pause, find an independent contact, escalate and record the result. It need not generate a convincing clone of a colleague to discover whether the process works.

This is defensive educational information, not individual legal or financial advice. The studio and call are fictional; no voice was cloned, detector used, payment made or report submitted. Official references were checked on 15 October 2026. The useful habit is an independent verification step that remains available when presentation becomes persuasive.

Evidence diagram and readable guide


Original explanatory diagram: trusted callback and suspected-effect reporting remain separate branches after a pause.

[Open the complete evidence diagram](/assets/cyber-workflow-voice-fraud-verification-20261015.svg)

Read the diagram

**Pause, verify and respond separately**

Verification and incident assessment can proceed separately. No audio detector result, real victim, financial transfer or recovery outcome is depicted.

- **Unusual request.** Notice the requested payment or account change.

- **Pause the change.** Do not disclose authentication codes or reset information.

- **Trusted contact route.** Use a route established independently of this request.

- **Authorised decision.** Apply the ordinary approval process or keep the hold.

- **Suspected effect.** Check whether money or access may already be affected.

- **Preserve and report.** Use the relevant service and official jurisdictional channel.

The contact branch reaches an authorised decision. The suspected-effect branch reaches preservation and reporting. Neither branch depends on proving that a voice is synthetic.

How the connections work

- Unusual request to Pause the change: pause; solid directed link. Proposed pause relationship; no measured causal effect.

- Pause the change to Trusted contact route: callback; solid directed link. Proposed callback relationship; no measured causal effect.

- Trusted contact route to Authorised decision: decision; solid directed link. Proposed decision relationship; no measured causal effect.

- Pause the change to Suspected effect: assessment; solid directed link. Proposed assessment relationship; no measured causal effect.

- Suspected effect to Preserve and report: reporting; solid directed link. Proposed reporting relationship; no measured causal effect.

Keep the paths separate

Trusted contact and suspected-effect assessment are separate branches after the pause; reporting does not grant payment or account-change authority.