A finance officer receives a call from someone who sounds exactly like the managing director, asking for an urgent payment to close a deal. A supplier emails new bank details on familiar letterhead. A caller claiming to be from IT asks a receptionist for a password reset code. Each request is plausible, urgent and personal.
Social engineering — manipulating people into handing over money, access or information — is not new. What has changed is how convincing it has become. AI tools can now clone a voice from a short recording, write flawless emails in a company's style, and produce fake documents in minutes.
Why technology alone won't stop it
Email filters and security software catch some attempts, but social engineering targets people, not systems. A genuine phone call from a cloned voice, or a real email account that has been taken over, will pass most technical checks. The decision point is the person who receives the request.
The warning signs
Most attempts share some common features:
- Urgency — it must be done now, before checks can happen
- Authority — the request comes, or appears to come, from someone senior
- Secrecy — "don't mention this to anyone yet"
- A change — new bank details, a new contact, a new process
- A bypass — a request to skip the usual approval
Build the pause into procedures
The most effective control is a rule everyone knows: certain requests are always verified through a separate channel, no matter who appears to be asking. That includes any change to supplier or employee bank details, urgent or unusual payment requests, requests for passwords, codes or access, and requests for confidential information.
Verification means calling back on a number you already hold — not one given in the message — or confirming in person. Senior leaders should say publicly that they expect to be verified, and will never be offended by it.
What this means in practice
- Write a short verification rule for payments, bank changes and access requests.
- Make sure senior leaders endorse it.
- Train staff with realistic examples, including voice and email.
- Make it easy and safe to report a suspected attempt.
- Review controls on payment approvals so no single person can be pressured into a loss.
Talk to us about insider and fraud risk controls. → Background checks
