“This is the boss, please transfer the money right away” – what AI fraud sounds like and how your team stays calm

Would someone on your team transfer money if the boss called, sounded stressed and said it was urgent and confidential?

Most people would hesitate – fortunately. But fraudsters work with exactly this moment: time pressure, authority and a request for secrecy. What's new is that they no longer need a badly made email for it. With AI, voices and even faces in videos can be imitated so realistically that you barely notice in everyday life.

What's technically possible today

The BSI (Germany's Federal Office for Information Security) describes how voices can be recreated with AI – so well that people and even automatic speaker recognition are fooled. High quality usually requires several hours of audio; with additional helper data, sometimes just a few minutes. For many executives, such material is publicly available: interviews, videos, talks. According to the BSI, faces can now be faked in real time too.

A well-known example comes from Hong Kong. In early 2024, an employee of an international company there transferred the equivalent of around 25 million US dollars to fraudsters after a video conference. According to the police, all the other participants in the conference were fakes. It only came to light when he later checked with head office.

The scam is old, the tool is new

Experts call this “CEO fraud”: someone poses as management and triggers a payment. It used to be by email; now it's also by phone call, voice message or video call. The pattern is almost always the same:

• It's urgent: “today”, “before the bank closes”.
• It's secret: “don't talk to anyone about this”.
• It's unusual: new account, new recipient, unfamiliar channel.
• It comes from the very top – so nobody objects.

According to the Bundeslagebild Cybercrime 2025 (the national cybercrime situation report) by the BKA (Germany's Federal Criminal Police Office), criminals use AI to make attacks more efficient and professional. Phishing is becoming more convincing, spelling mistakes are disappearing. So the signs that used to give fraud away are becoming less and less reliable.

Three rules that do more than any software

• Call back on a known number. For any unusual request for payment or data, hang up and call the person back on the number you already have saved – not the one given in the call or the email.
• Four eyes on money. New bank details and payments above a fixed amount are always approved by a second person. No exceptions, not even “just for today”.
• A code word for emergencies. Agree on a word or a question that only real colleagues know. Sounds like a spy film, but it works.

It's important that management sets an example with these rules and says openly: “If I call and want something unusual, please call me back. I won't be offended.” That one sentence takes the pressure off the team.

Training without scaring people

The goal isn't for your team to find every call suspicious. The goal is that nobody has to decide alone when something seems odd. Good training takes less than two hours and has three parts: hear or see one or two real examples, go through the fixed process together and practise it once – for example with assigned roles, where someone plays the “boss” and someone else politely calls back.

The tone is what matters. If people are afraid to answer the phone after a training session, they were trained badly. If people know that asking questions is explicitly welcome, they stay calm. And if someone does fall for a scam: reporting it immediately is right, hiding it is wrong. That's the only way the whole team learns from it.

Technology can help a little too: require two people to approve payments in online banking, save management's phone numbers as contacts in the phone system, forward suspicious emails to a checking address with one click. That doesn't replace a clear process, but it makes it more convenient.

And what if it has already happened?

Then act quickly but calmly. Inform the bank immediately and try to recall the payment. Write everything down and secure evidence: call log, emails, voice messages. Report it to the police – in Germany, the State Criminal Police Offices (Landeskriminalämter) have dedicated Central Cybercrime Contact Points for businesses. And then review how it happened without assigning blame. Anyone who reports mistakes openly helps everyone; anyone afraid of getting into trouble stays silent. What the first minutes after an attack look like is set out in the 10-minute emergency plan.

The Cyber Monster trains your team – without scaremongering, with real examples and a process that works in everyday life. If the phone is your main line to customers, the Telephone Monster will look at numbers and call forwarding at the same time.