How to verify an urgent request that sounds like your CEO
Verify an urgent request that sounds like your CEO by contacting the executive through a previously established trusted route. Confirm the exact action and its authority, then follow the ordinary payment, information, or access controls. Do not use a callback number or verification link supplied only in the suspicious request.
Independent identity verification is confirmation of a requester’s identity through a trusted route established outside the request being checked. This operational definition follows the approach in the FBI’s May 2025 impersonation guidance. It has no single psychological origin, and it should not be confused with judging whether an audio recording sounds natural.
A voice match can make a request persuasive without establishing authorization. A real executive can also ask for something that requires additional approval. Identity, authority, and transaction approval remain separate questions.
The known-route verification method below is a proposed business procedure. It is not a validated deepfake detector or a guarantee against fraud.
Design for verification rather than suspicion
In this explicitly composite scene, a finance leader receives a voice message while helping their child prepare for a school event. They move into the hallway to listen again. The voice sounds familiar and the request refers to an ordinary commercial matter. It also asks for an exception to the usual approval sequence because the CEO is said to be unavailable.
The finance leader does not need to decide whether the voice is synthetic. The immediate question is whether the company has independently verified the request and satisfied its controls. A sound that seems authentic cannot answer either question.
The CEO should make that expectation explicit before an incident. Staff should be able to pause a consequential request without having to accuse a senior leader of being an impostor.
Use an ethical influence playbook to establish the internal communication standard. An executive’s urgency should not make verification an act of disloyalty. The company needs a procedure that works when the apparent requester is influential and impatient.
The known-route verification method
1. Pause the consequential action
Do not transfer funds, change payment details, disclose sensitive information, or grant access while the request remains unverified. Use the company’s established pause and escalation procedures. Preserve ordinary operations that do not depend on the disputed request.
State the reason in procedural terms. A proposed response is: “This action requires independent verification and the usual approvals. I will use our established contact route.” These are suggested words, not a quotation from agency guidance.
Avoid continuing an argument about whether the voice sounds genuine. The person making the request may try to keep the conversation focused on familiarity, status, or urgency. Return to the action and the required control.
Do not open an attachment or follow a link merely because the message offers it as proof. If the request arrived through an unfamiliar platform, use the approved route for checking it rather than moving further into the unfamiliar channel.
Record what was requested and which action is paused. A vague warning can leave another employee unaware that the same request is still unresolved.
2. Retrieve the contact route independently
Use a previously verified company directory, approved contact record, or established internal communication route. The route must not depend solely on information supplied in the request you are checking.
The FBI’s December 2024 financial-fraud alert describes misuse of generated audio and recommends independent contact to verify a person’s identity. Its guidance concerns a broader range of fraud situations than executive payment requests. Applying it here requires a company-specific procedure.
If the approved contact is unavailable, use the documented escalation path. A requester’s claim that nobody else may be contacted is not a replacement for that path. Confidentiality requirements should still permit authorized verification.
Do not disclose unnecessary details while finding the right person. State that a request requires verification and use the approved security or finance channel for sensitive information.
Check that contact records themselves have an owner and a controlled update process. A callback procedure cannot provide the intended separation if employees routinely replace trusted details using unverified instructions from incoming messages.
3. Confirm the exact request, not merely the person’s availability
When contact is established, ask whether the executive made the specific request. Confirm the action, recipient or destination, timing, and relevant conditions through the appropriate protected process.
A greeting or confirmation that the executive is traveling does not validate a transaction. Nor does a genuine calendar entry establish that a particular payment instruction is authorized. Verify the material details that control the action.
If the executive confirms a request but supplies different details, keep the action paused until the discrepancy is resolved. Do not combine convenient elements from two conflicting accounts into a new instruction nobody approved.
Use decision rights and escalation thresholds to determine who can authorize the requested action. A verified voice or account establishes neither the signer’s authority nor satisfaction of required approvals.
A proposed internal question is: “Are we confirming identity, approving this action, or both?” Document the answer. That distinction prevents an identity check from being treated as blanket permission to bypass every remaining control.
4. Retain independent approval and destination checks
Apply the normal separation of duties, payment verification, and access controls required by the company. The exact controls should be designed with qualified finance, security, legal, and banking advisers for the company’s circumstances.
A second approver should verify the relevant evidence rather than merely acknowledge that the first person spoke with someone. Independent review loses value when both approvals depend on the same unverified message.
For changes to payment destinations, use the approved process for confirming the counterparty and its instructions. This article does not establish a universal procedure for every bank, jurisdiction, or transaction.
Do not create an emergency exception during the same conversation that asks for it. If the company has an authorized emergency route, follow its existing requirements and preserve the record.
The important distinction is between detecting synthetic media and controlling a consequential action. A deepfake detector attempts to assess content. A verification and approval process determines whether the company should act. The latter remains necessary even when the content is genuine.
5. Escalate a failed verification and preserve evidence safely
If the request cannot be confirmed or the details conflict, notify the designated security and finance owners. Preserve messages, relevant metadata, and the sequence of actions through the approved incident process.
Do not undertake an informal investigation by recontacting the suspicious sender, sending test payments, or sharing the recording widely. The incident owner should determine the appropriate next steps and reporting obligations with qualified advisers.
If money or access has already moved, use the established urgent response route immediately. Contact the relevant financial institution or security owner through known channels. The article provides no assurance that funds or information can be recovered.
NIST’s 2024 generative AI profile treats information integrity and security as relevant organizational risks. It supports a broader risk-management approach, not a claim that one detection tool can authenticate every communication.
Connect the response to the company disinformation incident process. Internal communications should state verified facts and current instructions. Avoid naming a suspected perpetrator or circulating an unconfirmed explanation of how the message was created.
6. Test the procedure without creating a real incident
Run clearly authorized simulations using dummy requests and approved participants. Do not move funds, change access, or expose private information. Define the simulation’s scope and the person responsible for stopping it.
Ask whether participants can locate the trusted contact route, reach the escalation owner, distinguish identity from authority, and document the decision. A successful exercise should demonstrate those actions rather than merely produce a completed training record.
Include executives in the exercise. A procedure that staff understand but senior leaders routinely override will remain difficult to use under pressure. Ask leaders to model an ordinary response when verification delays their own legitimate request.
Review unavailable contacts, ambiguous approvals, and duplicate channels. Fix the specific gap and repeat only the relevant part of the exercise. Do not add unnecessary steps without a defined purpose.
The proposed completion record is short: request received, action paused, trusted route used, authority confirmed or unresolved, required approvals completed or withheld, and incident route used if needed. Keep it within the company’s authorized records.
Do not rely on spotting an imperfection
The FBI’s 2025 alert notes that generated content can be difficult to identify. An unusual pause or awkward phrase may justify attention, but the absence of such a clue does not establish authenticity.
The same principle applies to video, email style, and knowledge of company details. A persuasive presentation should not decide whether the organization follows its controls. The recipient can use the same verification procedure without determining which technology, if any, produced the request.
Avoid making employees responsible for a forensic judgment they are not equipped to make. Give them an operational responsibility they can perform: pause, use the trusted route, verify the action, and escalate uncertainty.
Keep the exception process accountable
A business may need a legitimate urgent path. Define it in advance, including authority, contact routes, records, and conditions. Have the relevant qualified owners review it for the company’s requirements.
If the CEO cannot be reached, the process should say who can decide and which actions remain unavailable. Silence should not become implied authorization. An unavailable executive is a continuity problem the company can plan for.
Review the relationship between verification and other AI-related tools, including company sentiment analysis. A tool serving another business purpose should not be treated as an identity or transaction-approval system without evidence supporting that use.
Give staff a usable sentence
The CEO can authorize a clear expectation: “Verify consequential requests through our established route, including requests that appear to come from me.” This is a proposed policy statement that requires adaptation to the company’s actual controls.
That instruction should be supported by reachable owners and a workable escalation path. A reassuring announcement alone does not create those capabilities.
A familiar voice can remain part of ordinary communication. Consequential actions should depend on verified identity, proper authority, and completed controls that the voice cannot replace.