This week’s story is not about a fancy breach. It is about a help-desk worker who got a call that sounded exactly like a senior leader: urgent tone, familiar cadence, a request to ‘fix payroll routing before the pay run.’ In more than one recent case pattern, the voice was synthetic. The goal was simple—change where paychecks land. We do not have a single public case file with every detail confirmed, and you should treat viral retellings with caution. What is solid is the method: pressure plus a trusted voice plus a routine admin task.
School offices and small shops are prime targets because payroll changes often sit with a handful of people who also answer the phone. If your process still treats ‘the boss called’ as proof, a deepfake does not need malware. It needs a hurried human and a form. The fix is not a new gadget. It is a boring rule that survives a convincing voice.
A familiar voice is not a credential.
What to do on Monday
Pick payroll and direct-deposit changes as your one high-risk lane. Write a two-person rule that does not bend for urgency, rank, or a ‘secret project’ story. Then run it once with the people who actually answer the phone.
- Freeze verbal-only payroll changes: any direct-deposit or payee update requires a written ticket plus a second person who was not on the call.
- Publish a call-back rule: verify on a known internal number or in person; never use a number or link the caller provides.
- Add a shared out-of-band phrase for executives and business office staff, rotated on a simple schedule, used only to confirm identity—not as a password for systems.
- Train the help desk on a one-line refusal script: ‘I can help after we verify on our standard channel,’ and back them when they use it.
- Review last month’s payroll-change tickets for any that started from phone or chat alone; close those gaps in the written procedure before Friday.
Deepfakes will get cheaper. Your advantage is process that does not care how real the voice sounds. On Monday, make the boring rule official, practice the refusal line once, and leave the office harder to move with a phone call than it was when you walked in.