The FinCrime Wire · By LearnAML
Sources checked 9 October 2026 · 3 minute read
The caller sounds familiar. The message knows your job title. The payment supposedly cannot wait. Treat those details as context to verify, rather than permission to bypass your normal process.
Why this belongs in a compliance conversation
FinCEN’s November 2024 alert describes deepfake fraud targeting financial institutions, including manipulated identity documents used to defeat verification. The FBI’s December 2025 alert describes impersonation using AI-generated voice messages and requests that can include wiring funds. These are dated official alerts, not new announcements from October 2026. FinCEN alert; FBI alert.
A 2026 warning worth discussing
In March 2026, FBI Louisville warned that government impersonators may combine AI, official-looking documents and personal information to make payment demands seem credible. Its warning concerns a US campaign; the workplace lesson is to verify authority through a trusted channel before acting. Source: FBI warning, 18 March 2026.
Use an independent route to verify
The FBI recommends independently finding a phone number and calling to verify the person’s identity. For a workplace payment, apply that principle using a previously verified directory or contact record. A callback number supplied inside the suspicious message is not an independent check.
A practical payment desk checklist
- Pause: identify the exact change being requested—new beneficiary, new account, unusual amount or bypassed approval.
- Verify: contact the purported requester through a trusted route outside the incoming conversation.
- Compare: check the payment against the approved invoice, supplier record and expected business purpose.
- Retain controls: follow normal approval and beneficiary-change procedures even when someone claims seniority.
- Record and escalate: preserve the message and verification outcome; involve the appropriate fraud, security or compliance team under your process.
This checklist is LearnAML’s suggested training workflow. Your institution should adapt it to its approved procedures and local requirements.
A fictional scenario to discuss with your team
A voice note apparently from a finance director requests a supplier payment to a replacement account. A second message says not to telephone because the director is in a confidential meeting. The employee uses the internal directory and reaches the director’s office. The request was never authorised.
The useful control was independent verification. The employee did not need to prove that the audio was AI-generated before questioning the change. Equally, an unusual request alone does not prove a crime: document what you know and what remains uncertain.
If money has already moved
Use your institution’s incident process immediately and contact the payment provider through a trusted channel to ask about available recovery steps. Preserve evidence and follow applicable reporting requirements. Recovery is not guaranteed.
Continue learning
Read how frontline staff can spot and respond to scam payments, or build your wider understanding in AML Foundations. Free access for registered learners.