I have covered deepfakes on FOX 5 New York more than once, and the question that follows every segment is the same: what should a business actually do? Most of the answers on offer are expensive. Detection software, new banking platforms, insurance riders. All of those have a place. But the first thing every company should do is the free thing, and almost nobody has done it. Here is how.
Why does a cloned voice beat your current process?
Most payment processes rely on recognition. The controller recognizes the CEO's voice. The assistant recognizes the boss's face on a video call. The escrow officer recognizes the attorney's tone and phrasing from a dozen earlier closings. That recognition used to be a reasonable check, because faking it required skill and time.
Voice cloning changed the economics. A few seconds of audio from a podcast, an earnings call, a conference keynote or a voicemail greeting is enough to produce a convincing copy. Video is close behind. The attacker does not need to break into your systems. They need your staff to do what they always do, which is trust a familiar voice asking for something ordinary.
The fix is not to stop trusting people. It is to add one small step that a recording cannot pass.
How does a verification phrase work?
Two people agree on a phrase in person or on a call that one of them placed. From then on, any request to move money or change where money goes that arrives by phone, video, voice note or text includes a simple exchange.
- The request arrives. "I need you to wire the deposit to the new account this afternoon."
- The receiver asks for the phrase. "Before I do, what is our check phrase?" or asks the agreed private question.
- The sender answers. If the answer matches, proceed under your normal approval rules. If it does not, or the caller deflects, gets irritated, or says there is no time, the request stops.
- The receiver calls back. Hang up and dial the number already on file for that person. Never use a number from the message that made the request.
That is the entire system. It works because the phrase was never written in email, never posted anywhere, and never said in a channel the attacker can see.
How do you pick a phrase that holds up?
A good phrase is memorable to the two people who hold it and useless to everyone else. Avoid anything on social media or in public records: pet names, street names, children's names, birthdays, favorite teams. Those are the first guesses. A short question with a private answer tends to work better than a single word, because it is harder to stumble into by accident and easier to remember under pressure.
A few rules that keep it strong:
- Agree on it face to face or on a call you started, not by email or chat.
- Do not store it in a shared document, a password manager note labeled "verification phrase," or a group text.
- Use a different phrase for each pair of people who need one. The CEO and the CFO share one; the CFO and the controller share another.
- Change it when anyone who knew it leaves, and at least once a year.
Who needs one?
Start with everyone who can move money or change where money goes. In a mid-market company that is usually the CEO, CFO, controller, accounts payable, payroll, and the executive assistants who relay instructions from the top. In a law firm it includes the closing and escrow staff and the partners who direct them. In a wealth management practice it includes anyone who can process a client distribution. In an insurance agency it includes whoever handles premium and claim payments.
Then extend it outward. Your bank relationship manager, your outside counsel, and your largest vendors all make or receive payment instructions. A verification phrase agreed with each of them protects both sides. Families should do the same thing for the same reason, because the "grandchild in trouble" call is the consumer version of the CFO call.
What does the rollout look like?
Deepfake verification phrase: rollout checklist
Day one. The CFO or COO lists every person who can initiate, approve or change a payment. Usually fewer than fifteen names.
Day two. Each pair that passes payment instructions agrees on a phrase in person or on a call one of them placed. The owner keeps a dated list of who holds a phrase, not the phrases themselves.
Day three. Add three lines to the payment procedure: ask for the phrase on any voice, video or text request; call back on a number already on file for any change in bank details; two named approvers for any payment above [amount].
Day four. A ten-minute briefing for the people on the list. The message is simple: asking for the phrase is never rude, and no one in this company will ever be in trouble for slowing down a payment to verify it.
Ongoing. Review the list quarterly. Change phrases on departures. Run one practice call a quarter so the habit stays sharp.
What does this not cover?
The phrase defeats impersonation of a known person over a live or recorded channel. It does not catch a compromised email account sending a quietly edited invoice, a fake vendor set up in your accounting system, or a spoofed login page. Those need the other two habits in the checklist above, plus the basics of email security. It is one layer, not the whole wall. But it is the layer that costs nothing and addresses the newest, fastest-growing method directly.
It also belongs in your written rules. If you are drafting or updating an AI usage policy, add one sentence: "Any voice, video or text request to move funds or change payment details is confirmed with the verification phrase and a callback before action." The policy makes the habit official, and the habit makes the policy real. If your firm is figuring out how AI fits into client work more broadly, the same discipline applies to the intake and marketing systems I described for law firms using AI for client acquisition: decide the rule in advance, write it down, and make it easy to follow.
Why is the cheapest control usually the best first step?
I have spent a long time helping companies build systems that produce revenue, including a five-person team that generated $32 million with AI-driven processes. The lesson that carried across every one of them is that the simplest rule people actually follow beats the sophisticated one they skip. A verification phrase is that kind of rule. It takes a sentence to explain, a minute to use, and it turns the one thing AI copies well, a familiar voice, into something that no longer unlocks your bank account.
If you want help putting governance like this in place alongside the systems that make AI pay for itself, the AI Clarity Sprint covers both. Details are on the engagements and FAQ page. For the practical prompts and procedures behind day-to-day AI use, see ChatGPT for Profit, Volumes 1 and 2.
Frequently asked questions
- What is a deepfake verification phrase?
It is a private word, phrase or question that two people agree on in advance and use to confirm identity when a request arrives by phone, video or voice message. If the caller cannot produce it, the request waits until it is confirmed another way. It works because cloned voices and faces can copy how someone sounds and looks, but not what they privately agreed to say.
- Does a verification phrase stop all wire fraud?
No. It stops the specific attack where someone impersonates a known person by voice or video to rush a payment. It should sit alongside a callback rule for changed bank details and a two-person approval for payments above a set amount. Together, those three habits close most of the paths that impersonation fraud uses.
- How do we choose a good phrase?
Pick something that is easy to remember, not on social media, not guessable from public records, and not the name of a pet, street or child. A short question with a private answer works well. Agree on it in person or on a call that one party started, never in the same channel where the request later arrives.
- Who in the company needs one?
Anyone who can move money or change where money goes: the CEO and CFO, controllers, accounts payable, payroll, closing and escrow staff, and the executive assistants who relay their instructions. Families should set one too, for the same reason. Start with the people who can wire funds and expand from there.
- How often should we change it?
Change it whenever someone who knew it leaves the company, and at least once a year. Keep a dated note of who holds the current phrase. The phrase itself should never be written in email, chat or a shared document.
Want AI governance and AI revenue systems built together?
The AI Clarity Sprint gives mid-market companies, law firms, wealth managers and insurance agencies a usage policy, payment verification rules, an approved-tool list and a 90-day plan.