How do we stop staff being tricked by a fake "CEO" call or urgent payment request?

"CEO fraud" and business email compromise rely on one thing: an urgent request from someone you trust, that pressures a staff member to act before they think. With AI-cloned voices now in the mix, you can't rely on "it sounded like her." The fix is a process everyone follows, every time.

The one rule that stops it

Out-of-band verification. Any request to move money, change supplier bank details, or reset access must be confirmed on a separate, known channel before anyone acts — for example, hanging up and calling the person back on the number you already have for them (never a number from the message itself). If the request is genuine, a 30-second call confirms it. If it's a scam, that call is where it falls apart.

Back it up with a few more controls

• Dual authorisation for payments over a set amount — no single person can approve and send a large transfer alone.
• A written approval process for any change to payment or banking details.
• Short, regular staff training so the team expects these scams and feels safe pausing to check — even when the "boss" is pushing for speed.
• A no-blame culture, so anyone can question an odd request without fear.

Why this matters more every year

Attackers now use AI to make these approaches nearly flawless, so "train people to spot the signs" is no longer enough on its own. A firm verification habit works regardless of how convincing the fake is. We help Perth businesses put these processes — and the supporting email and identity controls — in place. Call (08) 9325 1196.