The Callback Rule for Payment Requests: A Word-for-Word Script for Staff

In early 2024, a finance worker at the Hong Kong office of UK engineering firm Arup opened a message claiming to be from the London chief financial officer (CNN, February 4, 2024). The email requested a confidential transaction. Doubts faded during a live, multi-person video call where the CFO and recognizable coworkers walked through the deal. Every other person on screen was synthetic, built from public video and audio clips (ThePrint / World Economic Forum, July 13, 2025). Convinced by live faces and familiar voices, the worker sent 15 transfers totaling HK$200 million (about US$25.6 million) before checking with headquarters. Arup global CIO Rob Greig stated the lesson plainly: staff must start questioning what they see.

The measured losses sit in everyday accounting and helpdesk queues. In its 2025 Internet Crime Report, the FBI Internet Crime Complaint Center (IC3) logged $20.877 billion in cybercrime losses across over 1 million complaints (SecureWorld on FBI IC3 2025 Report, April 9, 2026). Business Email Compromise (BEC) caused $3.046 billion of those losses, alongside 22,364 AI-tagged complaints totaling $893 million, a floor figure because victims must recognize AI involvement to report it. Voice-cloned distress scams topped $5 million, and losses among adults aged 60 and over hit $7.748 billion, up 59% from the prior year in the 2025 IC3 report. Gartner's survey of 302 security leaders (n = 302, fielded March to May 2025) found 62% of surveyed organizations faced a deepfake attack in the prior year (Gartner, September 22, 2025).

Most guides on AI safety at work assume an enterprise security team. Small firms, clinics, and nonprofits rely on a bookkeeper, a receptionist, and a part-time IT lead. This playbook shows why "spot the deepfake" training fails, compares five public cases, models the wage math for a 24-person office, and gives staff The ed.cafe Word-for-Word Callback & Safe-Word Script to tape beside every screen.

Why does "spot the deepfake" training fail at a real reception or bookkeeping desk?

Sensory awareness training fails at frontline desks because three-second voice clones and live video puppetry erase the audio and visual glitches workers were once taught to spot. Asking a busy bookkeeper to listen for robotic cadence turns wire security into an unwinnable guessing game.

Consider the audio sample needed to clone a human voice. In January 2023, Microsoft researchers published VALL-E, a zero-shot neural codec model pre-trained on 60,000 hours of English speech that clones an unseen speaker's voice and room tone from a 3-second audio clip (Wang et al., arXiv:2301.02111, January 2023). Three seconds fits inside a voicemail greeting, webinar intro, or local news clip. Live video requires no studio either. In April 2025, a Palo Alto Networks Unit 42 researcher with no prior video-editing experience built a real-time deepfake persona passable on a live job interview in roughly 70 minutes (HR Dive, April 21, 2025). Written lures improved just as sharply: in Microsoft's 2025 Digital Defense Report (telemetry from July 2024 to June 2025), AI-automated phishing emails drew a 54% click-through rate versus a 12% rate for conventional phishing (The Register, October 16, 2025).

Relying on your ears and eyes to clear a wire transfer works like holding a paper check up to a ceiling light to inspect the signature. That habit helped when forgers traced ink by hand. Once laser printers and check-washing solvents arrived, signature curves proved nothing, so banks moved clearance to Positive Pay and out-of-band confirmation. Where the paper-check analogy breaks down is tougher on staff: a forged check cannot argue back. A live voice clone interrupts, cites real project names, plays airport boarding chimes, and pressures a clerk not to anger the boss before a 4:30 PM cutoff.

Federal agencies warn against perceptual checks for this reason. In Contextualizing Deepfake Threats to Organizations, the NSA, FBI, and CISA advised teams to stop trusting visual or audio familiarity and require out-of-band verification (NSA / FBI / CISA CSI PDF, September 12, 2023). FinCEN echoed that rule in Alert FIN-2024-Alert004, noting synthetic media was defeating liveness and ID checks across banks (FinCEN, November 13, 2024).

What separated the companies that wired millions from the teams that hung up?

Documented impersonation cases from 2024 and 2025 show one clear operational split: victims stayed inside the communication channel opened by the attacker, while defenders broke the channel or forced an out-of-script check. Software spend did not decide the outcome.

In Hong Kong, Arup's finance worker treated a synthetic video call as proof of an email and wired HK$200 million (US$25.6 million) across 15 transfers (CNN, February 4, 2024). In Singapore in March 2025, a multinational's finance director signed a fake NDA, joined a Zoom with deepfaked executives, and wired US$499,000 (S$670,000) from HSBC before police froze the transfer (Mothership, April 7, 2025).

Contrast those losses with three blocked attempts. In July 2024, an unknown WhatsApp number showing Ferrari CEO Benedetto Vigna's photo messaged a Ferrari executive about a secret currency hedge, then called with a clone of Vigna's southern Italian accent (ThePrint / World Economic Forum, July 13, 2025). The executive asked what book Vigna had recommended days earlier; the caller hung up. In February 2025, callers cloning Italian Defence Minister Guido Crosetto's voice asked business families for urgent wires; Giorgio Armani's office defeated the call by requiring a formal written request via official channels (nss magazine, February 10, 2025). And in May 2025, when AI voice memos impersonated senior US officials, the FBI's rule was blunt: dial an independently located number, never the message (AHA News on FBI PSA, May 19, 2025).

Spot one hidden limit in the Ferrari case before turning it into office policy. A C-suite peer at Ferrari can quiz the CEO about a private book conversation. An hourly bookkeeper, receptionist, or tier-1 helpdesk technician has no private trivia with the CEO. Improvised personal quizzes feel awkward when the real boss is calling. Staff need an impersonal rule that runs identically every time.

How does the ed.cafe Three-Gate Callback Protocol stop impersonation mechanically?

In the ed.cafe Three-Gate Callback Protocol published by No Worker Left Behind, staff defeat voice, video, and text impersonation by routing every sensitive request through three mechanical gates: channel break, directory lookup, and dual sign-off. Each gate removes a lever the attacker controls.

Gate 1: Break the inbound channel (hang up first)

Never verify a payment, routing change, or login reset inside the channel that delivered it. Replying to a vendor's email routes your question back to a hijacked inbox. Tapping "Redial" on a spoofed caller ID connects back to the attacker's VoIP trunk. Clicking a Zoom link inside an urgent message puts you inside the attacker's synthetic room. Read the pause line aloud, hang up or close the chat, and place a fresh call yourself.

Gate 2: Dial only a pre-verified directory number (30-day rule)

Look up the requester's phone number in a read-only staff directory, signed onboarding file, or vendor accounting record saved at least 30 days earlier. Never dial a number taken from the incoming email signature, a PDF invoice attachment, an unsaved WhatsApp or SMS number claiming "my work phone broke," or an AI search box.

Keeping staff mobile numbers, org charts, and vendor bank tables out of public chatbots cuts attacker reconnaissance too; see our guide on what not to paste into an AI tool at work. Because uninvited meeting bots capture clean voice samples of executives and clients, pair your directory rule with controls from our playbook on AI notetakers in meetings, consent lines, and bot removal. If field staff travel on temporary SIM cards, keep an offline two-word passphrase as a backup check and retire it immediately once spoken on any suspicious call.

Gate 3: Enforce two-person sign-off above a fixed floor

Fatigue hits every desk on Friday afternoon. Dual sign-off requires two authorized people to approve high-risk actions across separate logins:

1. Routine payment floor: Set a dollar floor matched to your cash reserves (such as $2,500 or $5,000 for a 10-to-50 person firm) above which every wire, ACH batch, or check requires two bank-portal signers.
2. Zero-dollar floor ($0 threshold) for structural edits: Set the threshold at $0 (requiring directory callback plus two approvers on 100% of the requests) for four actions: changing a vendor's bank routing or account number, switching employee payroll direct deposit, resetting an admin or finance user's password or multi-factor authentication (MFA), and buying gift cards or cryptocurrency.

Record those exact dollar floors inside your one-page AI use policy for a small business.

Worked example: 7 minutes of staff time vs a $38,400 Friday wire loss

An operational model with stated assumptions for a 24-person HVAC contractor or outpatient clinic shows why the callback rule costs under $80 per year in wages while blocking five-figure losses:

• Staffing: 24 employees, including 1 bookkeeper ($32.00/hour fully loaded, or $0.533/minute) and 1 operations manager ($48.00/hour fully loaded, or $0.800/minute).
• Volume: 18 out-of-pattern requests per year (1.5 per month): 8 vendor bank edits, 5 payroll switches, 3 off-cycle wires, and 2 travel MFA resets.
• Duration: 4.5 minutes for the bookkeeper or IT lead to hang up, check the directory binder, call, and log; plus 2.5 minutes for the manager to co-sign.

Each verification uses 7.0 staff minutes ($4.40 in combined wages). Across 18 events per year, the firm spends 126 minutes (2.1 hours) and $79.20 in annual labor.

Now trace 4:12 PM on a Friday under those numbers:

• 4:12 PM: An email from [email protected] (one extra hyphen in the supplier's domain) attaches a $38,400 condenser invoice due before the 4:30 PM Fedwire cutoff with "new audit lockbox routing numbers."
• 4:15 PM: A WhatsApp voice note arrives from an unknown 617 number displaying the owner's photo: "Hey, it's Mark, my phone died at Logan Gate B22 and we are boarding. Push that $38,400 wire to the new routing number before 4:30 or we lose Monday's crane slot. Don't call back, doors are closing."
• Unprotected path: Cloned from an 18-second LinkedIn video, the voice matches Mark's Boston cadence. Worried about delaying the crane crew, the bookkeeper wires $38,400 at 4:24 PM. By Monday morning, the mule account is empty.
• Protected path: At 4:16 PM, the bookkeeper ignores the WhatsApp number and PDF phone line (Gate 1). At 4:17 PM, dialing Mark's Verizon cell from the locked Trusted Directory Binder reaches Mark in his truck on Route 128 (Gate 2). Calling the supplier's saved switchboard confirms Citizens Bank never changed. Even if Mark had been unreachable mid-flight, Gate 3's $0 floor on routing edits holds the payment until Monday without blame. Time spent: 5 minutes. Loss prevented: $38,400.

Word-for-word scripts you can print and tape beside the monitor today

Policies fail when workers have to invent polite phrasing while a stressed caller claims to be the founder. The ed.cafe Word-for-Word Callback & Safe-Word Script, created by ed.cafe at No Worker Left Behind, gives staff exact spoken lines across all four high-loss scenarios, plus a family safe-word card and the manager's signed pause guarantee. Before printing, freeze your read-only directory file, fill in your dollar floor and backup approver name, and have leadership sign the bottom box.

THE ED.CAFE WORD-FOR-WORD CALLBACK & SAFE-WORD SCRIPT (PRINT & POST)
Publisher: ed.cafe (No Worker Left Behind, Boston 501(c)(3))

COMPANY THRESHOLDS (FILL IN BEFORE PRINTING)
- Dual Sign-Off Floor (existing payee):  $__________ (e.g., $2,500)
- Vendor Bank / Routing Change Floor:    $0 (100% callback + 2 signers)
- Payroll Direct-Deposit Switch Floor:   $0 (100% callback + 2 signers)
- IT Password / MFA / Token Reset Floor: $0 (100% callback + ID check)
- Gift Cards / Crypto / Off-Ledger:      PROHIBITED BY EMAIL/VOICE/TEXT
- Trusted Directory Location:            ______________________________
- Backup Approver Name & Extension:      ______________________________

RULE 0: NEVER USE CONTACT DETAILS INSIDE THE INCOMING MESSAGE
Never reply in-thread, tap Redial, or call numbers on PDFs or texts.

SCENARIO A: URGENT WIRE, ACH, OR VENDOR BANK-ROUTING CHANGE
1. On a live phone or video call, read verbatim:
   "Our company policy requires an out-of-band callback for every payment
    or bank-account change, even when we are on video together. I am going
    to hang up now and call you right back on the number in our internal
    directory."
2. For email, Slack, Teams, SMS, or WhatsApp requests, call the directory
   number on file for 30+ days:
   "Hi [Name], this is [Your Name]. I am calling your directory line to
    verify a request received at [Time] to [send $X / update bank routing
    for Vendor Y]. Did you initiate that exact request, and can you read
    me the last four digits of the authorized account?"
3. For any vendor bank-routing change, ALSO call the vendor's saved AR
   number (30+ days old) AND get [Backup Approver]'s portal co-signature.
4. IF CALLER PUSHES BACK ("boarding a plane / secret deal / broken phone"):
   "I understand the urgency. Under signed company policy, I cannot bypass
    the directory callback, and management guarantees zero penalty for
    holding this until you are reachable on your directory line or
    [Backup Approver] co-signs in person." THEN HANG UP.

SCENARIO B: EMPLOYEE PAYROLL DIRECT-DEPOSIT SWITCH
1. Never process a direct-deposit switch sent only by email, PDF, or chat.
2. Call the employee's onboarding HR phone number (30+ days old) or check
   in person:
   "Hi [Employee Name], this is [Your Name] in payroll. We received a
    request to move your direct deposit to a bank ending in [XXXX]. Did
    you submit this today, and can you confirm your employee ID plus the
    last four digits of your PRIOR bank account?"
3. If unauthorized: freeze the switch and alert IT to check inbox access.

SCENARIO C: IT HELPDESK PASSWORD, MFA, OR SESSION RESET
1. Never reset passwords, enroll MFA phones, or read OTP codes on an
   inbound call or chat. Read verbatim:
   "For account security, I cannot reset credentials or MFA on an inbound
    call. I am hanging up now to call your registered directory number and
    loop in your manager."
2. Call the registered directory extension AND verify via in-person badge
   check OR a separate IT-initiated video call with the user's manager.

SCENARIO D: RUSH GIFT CARDS, CRYPTO, OR "SECRET EXECUTIVE TASK"
1. Read or send verbatim, then log with [Owner / Operations Lead]:
   "Our organization never authorizes gift cards, wire advances, or off-
    ledger purchases via email, text, or voice note."

FAMILY & ELDER EMERGENCY SAFE-WORD CARD (TAKE HOME)
1. Pick ONE unusual two-word phrase in person with family (never on social).
2. Rule for any "jail / hospital / crash / bail" call: "What is our family
   safe word? Either way, I am hanging up to call your cell directly."
3. Retire and replace any safe word immediately after a suspicious call.

MANAGER'S SIGNED NO-BLAME PAUSE GUARANTEE
"I instruct every employee, contractor, and temp at [Organization Name]
 to follow this Callback Rule without exception, even on requests that
 appear to come from me. No worker will ever be reprimanded or blamed for
 delaying a payment, deal, or login reset to complete a directory callback,
 even if a real deadline or wire cutoff is missed."
Signed (Owner / Director): _________________________ Date: ____________

Why does the manager's "no-blame pause guarantee" matter more than the script itself?

Frontline verification scripts fail under pressure whenever workers fear an impatient boss more than an external scammer. Fraudsters lean on secrecy and executive rank because junior staff rarely hang up on a partner without written immunity.

Both the Arup loss and the Singapore US$499,000 wire wrapped the payment inside a "confidential restructuring" or fake NDA so the worker would not ask a colleague next door (CNN, February 4, 2024; Mothership, April 7, 2025). Fear of blame creates the same blind spot in daily AI use, so our guide on why teams hide AI use and a 30-day amnesty plan starts by removing punishment for honest reporting.

Make the guarantee stick with a 10-minute quarterly drill: hand out signed copies at standup, run one test from an unlisted number requesting a vendor routing check (never a distressing personal hoax), and thank the worker who hangs up on the boss to call the directory line. Inside the ed.cafe Staff Room and our peer circles at No Worker Left Behind (where Circle #1, a free 30-chair Boston cohort taking the Google AI Professional Certificate via the Massachusetts AI Hub, is forming in October 2026 ahead of its December 1, 2026 close), learners rehearse spoken refusal lines aloud.

What is the 60-minute rollback sequence if a fraudulent wire or reset already went through?

Action inside the first 60 minutes decides whether stolen funds get frozen at an intermediary bank or vanish overseas. If someone realizes ten minutes too late that a call was synthetic, skip blame and run four steps in order:

1. Minutes 0 to 10 (Call your bank's wire-recall desk): Dial the fraud number on your corporate card or token and request an immediate wire recall and hold-harmless freeze. Fast HSBC escalation to Singapore and Hong Kong police froze the US$499,000 deepfake transfer within three days (Mothership, April 7, 2025).
2. Minutes 10 to 25 (Revoke sessions, MFA devices, and inbox filters): Revoke active session tokens in Microsoft Entra ID or Google Workspace, remove newly added authenticators, and delete hidden auto-forwarding or "move bank alerts to RSS/Trash" rules planted by BEC intruders.
3. Minutes 25 to 45 (File an FBI IC3 report): Submit routing numbers, beneficiary accounts, and timestamps at ic3.gov for FBI Recovery Asset Team / Financial Fraud Kill Chain review, then file a local police report.
4. Minutes 45 to 60 (Save raw logs and alert insurers): Export raw .eml headers, WhatsApp numbers, voice files, and VoIP call logs without deleting threads, then notify your crime or cyber insurer.

Where this stops being true

An out-of-band callback paired with dual sign-off blocks voice clones, video puppetry, and spoofed emails, but three boundary conditions require stronger controls:

• Carrier SIM-swap or phone compromise: If attackers hijack an executive's mobile line via SIM swap or spyware, calling the directory cell reaches the attacker. Gate 3 (dual sign-off by a second person on a separate device) closes this gap because one hijacked phone cannot forge a second signer's bank token.
• Sleeper edits in editable vendor files: If an intruder edits a vendor's phone inside QuickBooks in September and waits until November to request a routing change, a 30-day lookback inside that file calls the intruder. Lock your master directory to admin write access with version logs, and check routing edits against the original W-9 or public switchboard.
• Statutory escrow and regulated sector rules: Title agencies, broker-dealers, municipal treasuries, and clinical human-service providers (see our guide for case managers using AI for case notes, consent, BAAs, and state rules) operate under statutory privacy mandates and Uniform Commercial Code (UCC) Article 4A bank security contracts. Have legal counsel and your bank officer review formal wire agreements alongside this script.

Questions people ask

Key terms

• Out-of-band verification: Confirming a request over a separate channel initiated by the receiver rather than replying inside the call, video link, email, or text that brought it.
• Trusted directory: A read-only or version-logged contact list of verified employee numbers and historical vendor switchboards stored separately from incoming emails and invoices.
• Dual sign-off (two-person rule): A control requiring two authorized people to review and approve a wire, bank-routing change, or credential reset before execution.
• Business Email Compromise (BEC): Fraud schemes that spoof or hijack business email or chat accounts to redirect payments or payroll, causing $3.046 billion in 2025 FBI IC3 losses.
• Zero-shot voice synthesis: Neural audio models that generate speech in a target voice from a few seconds of sample audio without hours of studio training.
• No-blame pause guarantee: A signed leadership promise that workers will never be punished for delaying an urgent payment or login reset to complete a directory callback.

Sources

1. CNN, Kathleen Magramo, "Finance worker pays out $25 million after video call with deepfake 'chief financial officer'" (February 4, 2024): CNN Report.
2. ThePrint / World Economic Forum, "Security systems are failing to detect deepfakes. 'Trust, but verify' no longer works" (July 13, 2025): ThePrint / WEF Analysis.
3. SecureWorld, reporting on the FBI IC3 2025 Internet Crime Report, "AI-Enabled Fraud Topped $893M, FBI Reports" (April 9, 2026): SecureWorld IC3 Summary.
4. Gartner Newsroom, "Gartner Survey Reveals Generative Artificial Intelligence Attacks Are on the Rise" (n = 302 cybersecurity leaders, September 22, 2025): Gartner Press Release.
5. Chengyi Wang et al. (Microsoft), "Neural Codec Language Models are Zero-Shot Text to Speech Synthesizers" (arXiv:2301.02111, January 2023): arXiv Preprint.
6. HR Dive, reporting on Palo Alto Networks Unit 42 research, "Researcher creates 'passable' deepfake job candidate in 70 minutes" (April 21, 2025): HR Dive Report.
7. The Register, reporting on Microsoft Digital Defense Report 2025, "AI makes phishing 4.5x more effective, Microsoft finds" (October 16, 2025): The Register Coverage.
8. National Security Agency (NSA), FBI, and CISA, "Contextualizing Deepfake Threats to Organizations" (September 12, 2023): Defense.gov Joint CSI PDF.
9. Financial Crimes Enforcement Network (FinCEN), "Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions," FIN-2024-Alert004 (November 13, 2024): FinCEN Alert.
10. Mothership Singapore, "Multinational firm's finance director scammed into wiring US$499,000 after Zoom call with deepfaked CEO & execs" (April 7, 2025): Mothership Report.
11. nss magazine, "The Crosetto scam: what is going on with Giorgio Armani, Massimo Moratti and Italian entrepreneurs" (February 10, 2025): nss magazine Report.
12. American Hospital Association (AHA) News, reporting on FBI PSA I-051525-PSA, "FBI warns of malicious text, AI voice messaging campaign impersonating senior US officials" (May 19, 2025): AHA News Brief.