Deepfake Payment Fraud: The Internal-Control Test for Finance Teams
Current position
CERT-In directions require specified cyber incidents to be reported within six hours of noticing them or being brought to notice. Financial entities may also have RBI, SEBI, insurance or sector-specific incident and fraud reporting duties. The exact event, clock, regulator and reporting format must be assessed immediately; internal investigation should not delay urgent containment.
How it works
Deepfake fraud usually combines impersonation with urgency, secrecy and a payment exception. The technology is new, but the control failures are familiar: weak callbacks, shared credentials, overridden approval limits and unverified bank changes.
Vendor master changes should be verified using independently held contact details, not the number in the change request. High-risk payments should have cooling periods or secondary confirmation.
Preserve email headers, call logs, device details, payment trails and CCTV or access records. Evidence can disappear when accounts or devices are wiped.
| Issue | Current position | Why it matters |
|---|---|---|
| CERT-In clock | Specified incidents within six hours | From noticing or being informed |
| Control principle | Out-of-band verification | Voice or video alone is not authority |
| Payment design | Maker–checker plus transaction limits | No single-channel override |
Practical example
A finance manager receives a video call that appears to show the CEO ordering a confidential ₹75 lakh acquisition payment. The request uses a new beneficiary and bypasses procurement. The correct response is to pause, call the CEO through an independently stored number, verify the board or deal record and require the normal second approver. Urgency is a risk signal, not an approval.
Action checklist
- Require out-of-band callback for beneficiary changes and exceptional payments.
- Use maker–checker, role-based access and daily payment limits.
- Maintain approved contact details outside incoming messages.
- Train teams on deepfake, remote-access and QR-code fraud.
- Activate bank recall, cybercrime reporting and incident preservation immediately after suspected loss.
Evidence and document checklist
- Original email with headers and attachments.
- Call/video logs and meeting metadata.
- ERP and bank user audit trail.
- Beneficiary master-change record.
- Incident timeline, bank complaint and regulatory reports.
Common mistakes
- Trusting a familiar voice or face.
- Allowing emergency override without independent confirmation.
- Using the requester’s supplied phone number for callback.
- Deleting the device or message before preservation.
Red flags
- Secrecy request tied to payment.
- New beneficiary and unusual jurisdiction.
- Pressure outside normal working hours.
- Request to install remote-access software.
Escalation and complaint route
Contact the bank immediately to freeze or recall funds, report cyber financial fraud through 1930 and the official cybercrime portal, and assess CERT-In and sector-regulator reporting. Preserve evidence and involve legal, IT, finance and law enforcement together.