DECISION BRIEF 04 · DEEPFAKE SCAMS & PAYMENT CONTROL · RELEASED 21 AUGUST 2026

Deepfake Scams: What CEOs Must Verify Before Approving Payments

Deepfake scams have made voice and video unreliable as sole proof of authority. Never approve a high-risk payment based only on a call or recording; instead, require a known-channel callback, an independent second approval, and a recoverable transaction path.

deepfake scams: Executive decision

Therefore, remove voice and video from the list of evidence that can independently authorize a high-risk payment.

Instead, require three controls. First, verify the request through a contact route already held by the organization. Second, obtain approval from another accountable person who did not receive the original request. Third, preserve enough time or banking capability to stop, recall, or escalate an unusual transfer.

However, this recommendation does not mean that every transaction needs executive friction. Instead, the organization should apply it to pre-defined risk triggers, including unusual urgency, a new beneficiary, changed bank details, secrecy, large value, executive override, or cross-border payment.

Why deepfake scams change payment control

Deepfake scams attack a shortcut inside many organizations: people equate familiarity with authority. Consequently, a recognizable voice, face, title, or email thread lowers skepticism. Moreover, Generative AI makes that shortcut cheaper to exploit and easier to scale.

For example, OJK reported 1,379 financial-fraud reports that indicated the use of AI between 22 November 2024 and the end of June 2026. Specifically, the reported methods included investment scams using deepfake images or videos, voice cloning, false calls, manipulated documents, and misleading claims about AI trading tools. However, this figure is not a count of unique victims, and not every case was a deepfake case.

Meanwhile, the broader control environment is already under pressure. OJK recorded 608,167 reports to the Indonesia Anti-Scam Centre through 30 June 2026. In addition, it reported more than one million accounts and 132,583 telephone numbers connected to reported fraud. However, these totals cover many forms of financial fraud, not AI fraud alone.

The deepfake scams attack path

Therefore, the failure occurs before any forensic decision about whether the media is fake. In other words, the organization treats an unverified communication as authorization. That is why payment design matters more than perfect media detection.

The deepfake scams verification rule

1. Known-channel callback for deepfake scams

First, end the incoming interaction. Then, contact the requester through a number, directory entry, banking workflow, or internal channel that existed before the request. Do not use a phone number or link provided inside the suspicious message.

2. Independent approval for deepfake scams

Likewise, require a second accountable person to review the beneficiary, amount, purpose, and evidence. However, the second approver must not rely on the same voice call, video, or message as the first approver.

3. Recoverable path for deepfake scams

For unusual or irreversible payments, create a short hold, bank-confirmation step, or documented recall route. Therefore, speed should follow verified authority, not replace it.

Strategic options for deepfake scams

Recommendation: redesign control for deepfake scams

Therefore, adopt Option C as the primary control. In addition, use awareness and detection as supporting layers, not substitutes. As a result, the organization addresses the business failure directly: it should not move value until authority is independently verified.

The strongest counterargument

However, more verification can slow legitimate decisions and frustrate senior leaders. That concern is valid. Instead of universal friction, use explicit risk tiering. For example, routine, reversible, and previously approved transactions can remain fast. By contrast, unusual and irreversible requests should earn additional scrutiny.

A 90-day control test

1. Days 1 to 30: map payment and credential-release workflows; identify high-risk triggers, known contact routes, bank-recall options, and accountable owners.
2. Days 31 to 60: introduce the three-verification rule for one business unit or payment category; train finance, executive assistants, procurement, and treasury.
3. Days 61 to 90: run controlled simulations using voice, video, email, urgency, and vendor-detail changes; test both successful detection and false alarms.

Then, measure exception volume, verification completion, median approval delay, callback success, false escalation, policy bypass, and time to contact the bank after a simulated loss. Ultimately, the control should reduce unauthorized-payment exposure without creating routine operational gridlock.

Falsifier: if the targeted rule produces substantial operational delay but does not improve independent verification or stop realistic simulations, redesign the thresholds and workflow. Therefore, do not preserve a control merely because it sounds secure.

Implications for decision-makers

• CEO and board: make clear that executive urgency never overrides payment verification.
• CFO and treasury: define risk triggers, second approvers, holds, and bank escalation routes.
• CIO and security: protect directories and collaboration tools while treating detection as one signal, not the authorization decision.
• Procurement and operations: verify vendor-bank changes through a previously known contact route.
• Communications leaders: limit unnecessary publication of voice, travel, reporting-line, and approval-pattern details.

Frequently asked questions about deepfake scams

Deepfake scams evidence ledger

• ANTARA, OJK: IASC received 1,379 reports related to AI-enabled financial fraud, 4 August 2026. Specific AI-indicated report count and reported methods; not a unique-victim count.
• OJK: June 2026 Board of Commissioners Meeting. IASC totals through 30 June 2026; covers all reported financial fraud, not AI alone.
• Komdigi: AI increases the complexity of digital fraud, 17 June 2026. Indonesia policy and awareness context.
• INTERPOL: Global Financial Fraud Threat Assessment, 16 March 2026. Global threat evidence; the 4.5× estimate is not Indonesia-specific.
• FBI: Business Email Compromise. Known-number verification, payment-request confirmation, multi-factor authentication, and urgency warnings.
• US FTC: How to avoid imposter scams. Independent contact routes and avoiding contact information embedded in an unexpected message.

---

Disclosure. This is independent analysis based on public sources. The three-verification rule is Antovany Reza’s decision framework, not a claim that one control can eliminate fraud. Evidence reviewed 21 August 2026.