Key takeaways

  • The FBI's Internet Crime Complaint Center recorded more than 21,000 business email compromise complaints in 2024, with adjusted losses of about $2.77 billion. The target is the payment process, not the firewall.
  • Finance staff and executive assistants need role-based training: they handle the requests, hold the context and are the people criminals impersonate leaders to reach.
  • The FBI warns that criminals use generative AI for cloned voices and for real-time video chats that impersonate company executives. A familiar voice is no longer proof of identity.
  • Teach one rule above all: verify through a channel you already trust, such as a number from your own records, never through the contact details in the request.
  • Training works only if policy backs it. Dual approval, a call-back rule for bank detail changes and a standing right to pause any urgent request make the safe action the easy one.
  • Practice beats slides. Short scenario drills with real examples from the team's own workflow build the habit that holds under pressure.
  • A person who stops a payment on suspicion should be thanked, even when the request was real.

Why these two roles

Criminals who commit payment fraud study how a business works. They look for the people who can release money or who control access to the people who can: accounts payable and receivable staff, payroll, controllers, treasury, and the assistants of executives, who see the calendar, the travel plans and the inbox. The FBI's 2024 Internet Crime Report lists business email compromise at more than 21,000 complaints and about $2.77 billion in adjusted losses for the year. That is the cost of requests that looked normal.

General awareness courses cover phishing links and passwords. They rarely address what these roles face: a message from the chief executive asking for a quick payment before a flight, a vendor writing that its bank has changed, a call from 'the bank' about a held wire. Role-based training starts from those moments.

The patterns to teach

  • The urgent executive. A message or call that appears to come from a senior leader asks for a confidential, immediate payment or gift cards, and asks you not to discuss it.
  • The changed bank details. A vendor, landlord, contractor or payroll employee writes that their account has changed. The email may come from the real, compromised mailbox of that vendor.
  • The invoice in the thread. An attacker with access to a mailbox waits for a real conversation about a payment and inserts a revised invoice at the right moment.
  • The impersonated authority. A caller claiming to be the bank, an auditor, a lawyer or a government official applies pressure and asks for credentials or a one-time code.
  • The assistant as a door. A request to the assistant to reset a password, forward a file, share the calendar or buy something on the executive's behalf.
  • The slow build. Weeks of harmless messages that build trust before the ask.

The common thread is pressure plus a break from the normal process. Training should teach staff to treat that combination as the signal, however good the message looks.

What changes with cloned voices and fake video

In December 2024 the FBI's Internet Crime Complaint Center published a warning that criminals use generative AI to commit fraud at scale. It describes AI-generated audio, sometimes called vocal cloning, used to impersonate well-known people or relatives to obtain payments, and AI-generated video used for real-time video chats with alleged company executives, law enforcement and other authority figures. It also notes that criminals use AI audio clips to gain access to bank accounts.

The consequence for training is simple. Staff cannot rely on 'it sounded like him' or 'I saw him on the video call'. The FBI suggests looking for imperfections in images and video and listening closely to tone and word choice, but those are weak defenses against good fakes and getting weaker. The strong defense is process: a known way to check identity that does not depend on how convincing the voice is.

The FBI's advice for individuals is to verify the identity of a caller by hanging up and calling a number you have researched independently, and to agree a secret word or phrase with family. Businesses can use the same idea in the form of an agreed code phrase for sensitive approvals, plus a call-back rule.

Controls that make saying no easy

Training tells people what to do; policy makes it safe to do it. Put these in writing and tell executives that they apply to them:

  • Call-back on bank changes. Any change to a payee's account details is confirmed by calling a number already on file, not one in the request, and by a second person.
  • Dual approval for payments above a threshold you set, and for any new payee.
  • A cooling-off rule. A first payment to a new account waits for a set period or an extra check.
  • No exceptions for seniority. A request from the chief executive follows the same steps. The assistant's right to say 'I need to verify that' is in writing and backed by the executive.
  • No secrets on payment. Any request to keep a transfer confidential from colleagues is a red flag in itself.
  • Out-of-band confirmation for voice and video. If a request arrives by call or video, confirm it with a message or call on a separate, known channel before acting.
  • A fast reporting path. One address or phone number, available at all hours, that connects to someone who can freeze or recall a payment.

Speed matters after a mistake

If money has been sent to a fraudster, hours matter. The FBI's report describes the Financial Fraud Kill Chain, run by its Internet Crime Complaint Center's Recovery Asset Team, which works with financial institutions and FBI field offices to try to freeze fraudulent transfers. Train staff to call the bank at once, ask for a recall, and report to the Complaint Center. Make clear that fast reporting is rewarded, never punished; a person who hides a mistake for a day costs the company far more than the mistake itself.

How to run the training

  • Keep it short and role-specific: thirty to forty-five minutes a quarter beats one long annual session.
  • Use the team's real workflow. Walk through how a payment request actually arrives, with redacted real examples.
  • Run scenario drills: a short call or email exercise where the team decides what to do, then compares it with the written rule.
  • Include the executives. Ask them to attend one session and to say aloud that they will never be offended by a verification request.
  • Rehearse the bad day: who calls the bank, who tells the executive, where the incident record goes.
  • Refresh when the criminals change. Add new patterns, such as voice clones, as they appear in public reports.

Measure what matters: how many unusual requests were reported, how long verification took and whether the call-back rule was followed, rather than how many people finished a course. A separate article in this series covers what a program should measure.

Sources

This article is general guidance, not legal advice. Adapt it to your organization, and ask your counsel about employment, privacy and contract questions before you rely on it. Last reviewed .

Next article

Related reading

Need help with this?

Train your people to stop the phish, the fake voice and the wire request before money moves.

Security Awareness Training