The Boss on the Video Call Might Not Be the Boss. Write the Call-Back Rule Now.
INTERPOL just warned that AI fakes erase the usual signs of a scam. A familiar face and voice prove nothing. One written rule still works.
By John Martines · October 25, 2026 · 6 min
INTERPOL launched a campaign this month showing how AI-made video and voice can fake a boss asking for an urgent payment. Here is what that means for a small business, and the call-back rule to write this week.
It's 4:40 on a Friday. Your office manager gets a video call from you. You're in the truck, the picture is a little choppy, and you sound rushed. A supplier needs a deposit today or the job slips two weeks, so could she send $18,000 to the account in the message you just texted her? She knows your face. She knows your voice. She sends it.
You were at your kid's game the whole time.
That scene is the one INTERPOL chose to show the world this month. It is no longer a story about big companies. It is a story about whoever in your business can move money.
A deepfake is a video, voice recording or photo made by AI to look and sound like a real person. The raw material is whatever is already public: a voicemail greeting, a podcast, a video on social media. In the best-known case, below, police said the fakes were built from public video and audio of the real people.
Scams built on this are an old trick with a new costume. For years criminals have sent emails that pretend to be the owner or a supplier and ask for a payment or new bank details. The FBI calls it business email compromise. What's new is that the request can now arrive as a phone call or a video call, in a voice and face your staff trust.
How it got here:
- January 2024: an employee in the Hong Kong office of Arup, the British engineering firm, joined a video call with what looked and sounded like the company's chief financial officer and several colleagues. Every one of them was fake. Police said the employee made 15 transfers totaling HK$200 million, about $25.6 million. Arup confirmed it was the company in May 2024.
- May 15, 2025: the FBI warned that criminals were using AI-made voice messages to pose as senior US officials, then asking people to move to another app or click a link. Its advice: verify any unexpected request by calling a number you already know.
- April 2026: the FBI's yearly Internet Crime Report for 2025 put losses from business email compromise at about $3 billion, from roughly 24,800 complaints, according to coverage of the report.
- October 18 to 19, 2026: INTERPOL launched a public campaign built around three short videos, themselves made with AI, showing how deepfakes drive fraud. One shows an employee on a video call with a boss who urgently wants a bank transfer. The campaign line is "Wait. Validate. Don't take the bait."
Large companies have finance teams, approval software and a second signature on every big payment. A 20-person business usually has one or two people who can send money, and they take instructions from the owner, often by phone or text, often in a hurry. That is exactly the setup these scams are built for.
Three things change.
Seeing and hearing is no longer proof. The old advice was "if it sounds like the boss, it's the boss." INTERPOL's point is that AI removes the usual giveaways: the odd accent, the bad grammar, the wrong voice. Your staff can't be trained to spot a good fake, and you shouldn't ask them to.
Your voice and face are already out there. If you've posted a video on Facebook, recorded a voicemail greeting, or spoken on a local podcast, there's enough to copy. The same goes for your office manager and your biggest supplier.
The money moves fast and rarely comes back. Wire transfers and bank-to-bank payments are the usual target because they're quick and hard to reverse. By the time anyone notices, the money has usually moved on through other accounts.
The good news is that one habit beats every version of this scam, including the ones that haven't been invented yet: confirm the request on a channel the requester didn't choose.
1. Write the call-back rule. One sentence your whole team can repeat: "Any request to send money, change bank details or buy gift cards gets confirmed by calling the person back on a number already in our files, never a number in the message." That covers you, your partners, your suppliers and your customers. Post it where payments get made. Our free [AI Fraud Drill](/tools/fraud-drill) builds the rule, a payment-change checklist and a 10-minute staff drill for you.
2. Make it safe to say no to the owner. This is the step most owners skip. Tell your staff, out loud and in writing, that you will never be upset when they hang up on you to call you back. Then do it yourself: the first time you ask for a payment by phone, say "go ahead and call me back on my cell before you send it." A rule that staff are afraid to use on the boss doesn't work.
3. Set a payment line and a second person. Pick a dollar amount, say $2,500, above which any new payee or any change to bank details needs a second person to approve. In a small office that might be the owner and the office manager. Many business banking services can require a second approval for wires and new payees; ask your bank to switch it on.
4. Agree on a code word. Some businesses use a simple code word or question only the real people would know, asked on any unexpected money request. It's low tech and it works on a phone call, where a call-back is awkward. Change it if anyone leaves.
5. Know your first call when it goes wrong. Write down your bank's fraud line now. If money goes out by mistake, call the bank first, within minutes if you can, then report it at ic3.gov. Speed is what gives you any chance of getting it back.
- Who in your business can send a wire or a bank payment today? Write the names down.
- Does your bank require a second approval for new payees or wires over a set amount?
- Is the call-back rule written down somewhere your staff will see it when a payment request arrives?
- Do your three biggest suppliers know you'll call them back before changing their bank details?
- Does everyone know the bank's fraud number, without having to search for it?
Fakes will keep getting cheaper and better, and a live video call will get as easy to fake as a voice message is now. Vendors will sell software that promises to catch them. Some of it will help, but none of it will catch every fake, and a rule your team follows costs nothing.
You don't need detection software. You need a rule, a second person, and a team that knows it's always fine to hang up and call back. Write the rule this week, and the next time "you" call the office in a hurry, the answer will be "Sure, I'll call you right back."
---
Sources (checked October 25, 2026). INTERPOL campaign, three AI-made videos, the campaign line and Project SynthWave PLUS: "INTERPOL launches public awareness campaign highlighting risk of AI deepfake scams" (INTERPOL, Oct 2026), with coverage by Cybernews and Fincrime Central (Oct 2026). Arup case, amount and transactions: "British engineering giant Arup revealed as $25 million deepfake scam victim" (CNN, May 16, 2024); fakes made from public video and audio: Hong Kong police via public broadcaster RTHK, as reported by CNN and Business Insider (2024). FBI warning on AI voice messages: Public Service Announcement I-051525-PSA (FBI Internet Crime Complaint Center, May 15, 2025), as reported by BleepingComputer (May 2025). Business email compromise losses for 2025: FBI Internet Crime Report 2025 (April 2026), as reported by Insurance Business and Red Sift (April 2026).