You did EXACTLY what you thought you were supposed to do. Your boss asked for a payment, you checked the amount, and you sent it. You even spoke to them on video, so what more verification do you need?
And then… Oh, man. Then your boss calls to ask why you sent $48,000 to an account nobody can recognize.
How can this have been a scam?
The voice sounded right, the person knew your name, and they mentioned a supplier you work with all the time, so what’s going on? Okay, there was a bit of a delay in the video, but half of your meetings have those, so it wasn’t a cause for alarm. But now that you know something was very wrong, every little detail is suspicious.
Now you need to prove you were scammed, and you don’t know where to start.
Everyone wants information, but before you can answer a single question, you have to work backward through what happened.
Start With the Transfer, Not the Video
Now that you know the payment was a scam, you’ll get the urge to replay the call and figure out how it was possible for someone else to copy your boss.
That’d be the wrong move, though.
The first thing you should do is call the bank and give them the transaction reference, amount, the recipient’s account, and the time of the transfer. Then ask whether they can recall the payment or contact the bank that received it. At this point, there’s no need to prove AI was involved or anything.
Your priority right now is reporting fraud and requesting a recall. Sure, there’s no guarantee that this’ll get the money back, but you have to try.
Then you have to confirm what your boss actually authorized, so call them on the number that’s saved in the company’s records. Ask whether they requested a payment or whether they allowed someone else to request it. Their answer will help you find out whether that request was genuine or not. Unfortunately, it won’t tell you what the caller used: a deepfake, a recording that was edited, or another trick.
You should also get in touch with IT and explain which accounts and devices were used.
There could be an account that got compromised, so they’ll have to secure it. Don’t wipe a laptop before you contact IT because that could delete information you’ll need later on.
Reconstruct the Scam
There are many types of payment fraud, and it’s getting more sophisticated, which means it’s also getting harder to notice before it’s too late.
Here’s what to do if it happens to you.
The Recording of the Call or the Meeting
Don’t waste your time arguing about how real the face looked.
Instead, what you can do is check whether anyone recorded the meeting, and if they did, get that recording ASAP. That conversation before someone requested the payment could explain why you trusted it. Make sure to keep the original file without cutting out the suspicious parts.
Maybe you’ll notice a mouth that doesn’t match the words, although poor video quality can do that as well.
The Invitation and Messages
Open the invitation. Who sent it? You may’ve seen your boss’s name, but if you were busy, you probably didn’t check the address under it. If the address is wrong, that’s a clue, and it’s something you can follow up on. If the address is correct, then you should let your boss know that their account may have been compromised.
Save the emails you received and send them over to IT.
Then, find the first time the scammer mentioned the new bank account. If that information didn’t come in the call, then you should connect the message to the payment request, not the call.
The Payment and Approval Records
Look at the payment you made and then look at the bill you were supposed to settle.
It could be that you paid the correct amount for a real invoice, but the money ended up going to the wrong account. Check when the details of that other account got into your system and who entered them. That is, if you didn’t enter the information during the call, because then you already know.
But if it wasn’t you, then you should also go through approvals and see whether another person signed off or the payment went through on your authority alone.
If you’re in the middle of a dispute over who authorized what, the company’s legal team can use Round Table Group expert witness services, or another similar reputable firm that specializes in finding/screening expert witnesses, to help them find someone with a background in digital forensics.
Conclusion
Going through something like this could make you a little paranoid about every call you get in the future, but it’s completely possible to prove and track scams.
It comes down to noticing details that you missed and working with the right experts.
Give yourself some space to separate what you remember from what you can show, because you don’t have to explain every single second of the video to establish that someone stole the money, but you’ll need an account of what happened that holds up when someone asks you, “How do you know that what you’re saying is true?”.
