Deepfake Payment Fraud Tabletop: A 45-Minute Exercise
Rehearse an urgent payment request supported by a convincing executive voice message. This 45-minute tabletop tests independent verification, payment authority, and escalation when the usual approver is unavailable.
How do you run a deepfake payment fraud tabletop?
Give finance and executive participants a fictional urgent payment request, then ask them to decide whether to hold or release it. Require a verification route, a named decision owner, and a record of the evidence behind each choice.
For a Q4 workshop prepared on October 5, 2026, bring the current payment approval policy, delegated authority list, and supplier verification procedure. Check whether these still work when the usual approver is away.
AI voice impersonation is a documented threat: the FBI's May 15, 2025 advisory described messages impersonating senior US officials and recommended independently verifying contact details. This exercise adapts that verification problem to a fictional business payment. [FBI voice impersonation advisory](https://www.ic3.gov/PSA/2025/PSA250515).
Prepare the fictional request and assign roles
Scenario: accounts payable receives an email requesting payment to a supplier's new bank account before today's cutoff. A voice message apparently from the CFO says the payment is approved and a delay will interrupt tomorrow's delivery.
The invoice matches an expected purchase, but the account change is unverified. Use a written description of the voice message; no cloned recording or real payment is needed.
- Accounts payable identifies the checks required before releasing funds.
- Procurement verifies the supplier request through an established contact route.
- The executive approver explains authority and any proposed exception.
- Security records suspected impersonation and preserves the supplied messages.
- The facilitator releases updates; an observer records decisions and missing evidence.
Compare verification methods
Ask which method gives the team evidence independent of the suspicious request. The FBI recommends verifying payment changes and obtaining contact numbers independently of the message. [FBI business email compromise guidance](https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/business-email-compromise).
| Method | What it establishes | Limitation |
|---|---|---|
| Reply to the original email | The same account can answer | A compromised account can confirm its own fraudulent request. |
| Call the number supplied in the request | Someone answers at that number | The requester may control the number. |
| Use a previously verified supplier contact | An independent route to confirm the account change | The contact must be reachable; internal payment approval is still required. |
Run the 45-minute exercise
Use these suggested timings. Before each update, record the payment status, decision owner, evidence obtained, and next action; do not accept a vague promise to verify later.
- Minutes 0–5: read the brief and assign roles.
- Minutes 5–15: decide whether to hold or release payment and specify the verification steps.
- Minutes 15–25: reveal that the CFO and usual supplier contact are unavailable. Require an escalation route and a response to the claimed delivery risk.
- Minutes 25–35: reveal that an independently reached supplier manager denies requesting the account change. Record immediate actions and who owns them.
- Minutes 35–45: review the decision log and assign improvements.
Debrief the controls that held or failed
Check whether participants verified the supplier change separately from internal authorization, kept the payment status explicit, and found a backup decision owner. Ask what made the apparent executive instruction difficult to challenge.
Record one concrete improvement for each gap: the change, owner, due date, and evidence needed to close it. For example, finance could document an alternate verification route and rehearse it before the next approver absence.
Finish with a repeat scenario in which the request is legitimate but the executive remains unavailable. Assess whether the revised process supports a verified payment without bypassing approval controls.
Frequently asked questions
Do participants need to recognize a deepfake voice?
No. Describe the voice as convincing and assess how participants verify the request independently. The exercise tests payment controls and decision-making without requiring audio analysis.
Can this tabletop work at an executive offsite?
Yes. Include finance and procurement representatives so executives must address actual approval and verification steps. Reserve the final ten minutes for assigning improvements, and use fictional supplier and payment details.
Run this as a real exercise
Team Exercises helps facilitators turn business training topics into AI-powered simulations with team links, decision rounds, analytics, and debrief-ready outcomes.
Start a free scenario