How to Verify AI Impersonation and Payment-Change Requests

AI impersonation and business email compromise can make a forged payment-change request look as if it came from a trusted vendor, production accountant, or executive. The safest response is not to judge whether a message sounds authentic; it is to pause the change and verify it through a known, independent channel before any payment is released.

What this scam looks like

A payment-change scam usually starts with a familiar-looking request: a supplier says its bank account changed, a producer asks finance to move quickly, or an invoice arrives with updated remittance details. The request may come from a compromised mailbox, a lookalike domain, a spoofed caller ID, or a voice or video message generated to resemble someone the team knows.

The request is especially risky when it combines three signals:

• A new destination for money: updated bank details, a new payee, or a request to send funds to an account with a different name or country.
• Pressure to bypass the normal process: urgency, secrecy, a deadline, or a claim that the usual approver is unavailable.
• A convincing identity: familiar language, a copied signature, a realistic invoice, or an apparently authentic voice.

AI can make impersonation more persuasive, but it does not change the control that matters most: treat an account change as untrusted until it is independently confirmed.

Why email, voice, and caller ID are not enough

A reply to the same email thread does not establish that the real vendor is in control of the mailbox. A phone number in the message may route back to the impersonator, and a familiar voice is not proof of identity. Public production information can also give an attacker enough context to tailor a request to a show, venue, supplier, or payment milestone.

These are reasons to strengthen verification, not reasons to assume every change is fraudulent. A legitimate vendor may need to update its account. The finance team should verify the request without using contact details supplied in that request.

The independent-verification workflow

1. Pause the change and preserve the request

Do not edit the vendor record or release the payment while the request is unresolved. Save the original email, attachment, message headers when available, invoice version, caller details, and time of the request. Record who received it and what action was requested.

2. Find a known contact outside the request

Use the vendor master record, a previously verified contract, an existing phone directory, or a prior invoice that predates the change. Do not use a phone number, link, QR code, or reply address supplied in the new message. For a production, the line producer, production accountant, or approved department contact can help identify the established vendor relationship; that person should not be the only person approving the bank change.

3. Confirm the exact change verbally or through a separate channel

Ask the known contact to confirm the old and new payee details, effective date, invoice or contract reference, and the reason for the change. If the request was made by voice, call back using the independently sourced number. For higher-risk changes, use two separate confirmations—for example, a known phone call followed by a confirmation in an established vendor portal.

Never treat a forwarded email, a forwarded voice note, or a screenshot of approval as independent confirmation.

4. Apply dual control before updating records

Separate the person who receives or enters the change from the person who approves it. Require review of the vendor identity, supporting documentation, destination account, and recent payment history. A new account, unusual geography, split payment, or request to rush should increase scrutiny rather than shorten the process.

5. Validate the first payment after a change

Use the organization’s approved payment controls and consider a controlled test or additional approval where policy allows. Monitor the first payment and ask the known vendor to confirm receipt through an independent channel. Verification reduces risk; it cannot guarantee that a payment is recoverable once released.

6. Document the decision

Keep the request, verification evidence, approvers, timestamps, and final disposition in an auditable record. If the request was fraudulent or suspicious, notify the appropriate internal security, finance, and production leads promptly and follow the organization’s incident-response and bank-notification procedures.

Red flags worth escalating

Escalate rather than improvise when a request:

• changes bank details shortly before a payment deadline;
• asks the team to keep the change confidential or skip a control;
• uses a lookalike domain, unusual reply-to address, or new contact information;
• contains a mismatch between the vendor name, invoice, tax information, or account holder;
• asks for payment to a personal account or a destination unrelated to the contract;
• arrives after a mailbox compromise, credential reset, or suspicious login; or
• relies on an urgent voice or video approval instead of the established workflow.

No single red flag proves fraud. The combination of a changed destination and pressure to bypass independent verification is enough to stop the transaction until the facts are confirmed.

Controls for productions and events

Fast-moving productions and events often have distributed teams, temporary vendors, changing locations, and narrow payment windows. Assign ownership before a project begins:

• Keep a current vendor master with a documented source for contact and bank information.
• Define who may request, enter, review, and approve a payment-detail change.
• Use a second channel for changes and prohibit approval based solely on the requesting channel.
• Maintain an audit trail for edits, approvals, supporting documents, and payment release.
• Train production, event, and finance staff to challenge urgency respectfully.
• Reconcile payment status with the known vendor after a high-risk change.

A centralized approval workflow can make these controls easier to apply and review, but automation should route exceptions and preserve evidence—not replace human verification. For production-specific vendor and approval controls, see payment-fraud prevention for film and TV productions. For event setup, on-site pressure, and the seven control points, see payment-fraud prevention for events.

What to do when a suspicious request is discovered

Stop the pending change and tell the intended vendor using a known contact method. Preserve evidence rather than deleting the message. Notify the relevant finance, security, and project leads, and contact the bank or payment provider quickly if funds may have moved. Follow the organization’s legal, insurance, contractual, and incident-reporting requirements; this article is operational guidance, not a legal determination.

How a payment platform can support the process

A payment platform may help by centralizing vendor records, routing changes for approval, recording who did what and when, and making exceptions visible. Those capabilities are useful only when the organization configures roles, reviews alerts, and keeps verified contact information current. No software feature can establish that a person is genuine from an email, voice, or video alone, and no platform should be described as eliminating fraud risk.

For existing product context, see Eved solutions, Eved for film and TV, and Eved for meetings and events. The original LinkedIn article remains available separately at Payment Fraud in Productions & Events on LinkedIn.

Key takeaway

AI can imitate a trusted person, but it cannot make an unverified payment change safe. Pause the request, use a known channel, confirm the exact details independently, require separated approval, and preserve the evidence before releasing funds.