Deepfake voices and wire transfer verification: how do you verify clients now?

If you are the CCO or COO of an RIA, broker-dealer or family office, your wire procedure may still end with a staff member who recognizes the client's voice. AI voice scams have made that check unreliable, so wire transfer verification now has to hold up even when the caller sounds exactly right.

Why can't you trust a client's voice on the phone anymore?

Because generative AI can now imitate a specific person's voice, and federal agencies have warned that criminals use it to ask for money. In a December 2024 public service announcement, the FBI said criminals "can use AI-generated audio to impersonate well-known, public figures or personal relations to elicit payments."

Financial firms are a named target. FinCEN's Alert FIN-2024-Alert004, issued November 13, 2024, describes fraud schemes that use deepfake media against financial institutions, including criminals who impersonate executives or trusted employees to direct large transfers. FINRA's 2026 Annual Regulatory Oversight Report lists "deepfake audio and video" among GenAI-enabled fraud tactics and describes account impersonation that often ends in "a third-party wire transfer request, from the customer's account."

The losses are large. The FBI's 2025 IC3 Annual Report counts 24,768 business email compromise complaints with about $3.05 billion in reported losses, and more than 22,000 complaints that included AI-related information, with about $893 million in losses.

For many advisory and brokerage firms, hearing the client's familiar voice was the last check before money moved. A voice cloning scam turns that check against you: if the voice can be produced by software, a procedure that ends with "I recognized them" has no real final step.

What do regulators expect from your verification procedure?

Regulators expect a written identity theft prevention program, tailored to your firm, that detects and responds to red flags, though no rule prescribes a specific callback script. Regulation S-ID's guidelines specifically name authenticating customers and monitoring transactions on existing accounts.

17 CFR 248.201 applies to SEC-registered broker-dealers and investment advisers that offer or maintain covered accounts. In its December 2022 risk alert, the SEC Division of Examinations said this reaches some registered advisers, giving the example of advisers "who can direct transfers or payments from individual accounts to third parties" when the accounts are primarily for personal, family or household purposes.

The rule requires the program to identify relevant red flags, detect them, respond to them, and be "updated periodically." It also requires board or senior management involvement, staff training "as necessary," and oversight of service providers. Appendix A tells firms to update the program as identity theft methods change. Cloned voices and video are exactly that kind of change.

The same 2022 risk alert listed deficiencies examiners found: generic programs not tailored to the firm, no red flags related to account takeovers, training "limited to a single sentence," and red flags that were not updated after firms changed how customers open and access accounts.

Two other rules point the same way. Regulation S-P requires written policies to safeguard customer information and an incident response program, so a fake call that extracts client data can become a reportable event. The Gramm-Leach-Bliley Act's pretexting provisions make it a violation to obtain customer information through false statements to a financial institution's employees. Your front office staff are the people those statements are aimed at.

Why do traditional callbacks fail against a cloned voice?

Most callback verification fails because some part of the check depends on the request itself. If the attacker controls any piece of the verification, the verification proves nothing. The common weak points:

• The callback goes to a phone number supplied in the email, text or voicemail that made the request.
• Staff confirm identity with facts that are often exposed in data breaches, such as date of birth, address or the last four digits of a Social Security number. NIST's SP 800-63A-4 states that knowledge-based verification "SHALL NOT be used for identity verification."
• The final check is whether the voice sounds right.
• One person receives the request, verifies it and releases the wire.
• Urgency (a closing, a medical emergency, a client traveling abroad) is treated as a reason to skip steps.

FinCEN's alert gives a useful pattern to watch for. One of its red flags is a customer who "attempts to change communication methods during a live verification check due to excessive or suspicious technological glitches during remote verification of their identity." On a phone call, that looks like a client who cannot take a call back, insists on staying on the current line, or keeps dropping off video.

What does a strong wire transfer verification procedure look like?

A strong wire transfer verification procedure is out of band, uses contact data that existed before the request, and separates the person who verifies from the person who releases funds. In practice, firms that rebuild their procedure usually write down these elements:

• Clear triggers. First-time payees, changed bank instructions, third-party wires above a set amount, any money movement shortly after a change of address, email or phone number, and any request that stresses urgency or secrecy.
• A number of record. The callback goes to the number in your CRM or custodial record as it stood before the request arrived. A request to change that number gets its own verification and a confirmation sent to the old contact details.
• Hang up and call back, even when the client called you. The FBI's guidance is to end the call, look up the contact information yourself, and call it directly.
• Questions an impersonator could not answer from breached data. Confirm the details of the request itself, then ask about something from the relationship that is not in public records. Some firms add a passphrase the client chose in person, similar to the secret word the FBI suggests families use.
• A second approver. The person who completed the callback does not release the wire. A principal or operations lead reviews the record first.
• A written record. Who called, which number was dialed, when, what was confirmed, and who approved. That record becomes evidence that your Regulation S-ID program operates as written.
• The same rules for internal requests. A voice or video call that sounds like your managing partner asking to move firm or client money goes through the same steps.
• A default answer of no. If the client cannot be reached on the number of record, the money waits.

How do you keep clients on board with the extra step?

Tell them before it happens. Clients accept a delay far more easily when they heard about it at onboarding or in a letter than when it surprises them on a closing day.

A short client notice can explain that your firm will always call back on the number you have on file before sending money to a new destination, that staff will never ask them to stay on the line or switch to a new number, and that a request to skip the callback is itself a warning sign. That gives clients a simple rule they can apply to any caller who claims to be from your firm.

What should you do this quarter?

Start with the program you already have and test it against a voice-cloning scenario. A practical sequence:

• Pull your Regulation S-ID program and check whether deepfake voice and video appear among your red flags. If your program has not been updated since before FinCEN's November 2024 alert, it is due for review under Appendix A.
• Map every channel through which a money movement request can arrive: phone, email, text, client portal, custodian platform and in person.
• Lock down changes to client phone numbers and email addresses, since a changed number defeats every callback that follows.
• Run a tabletop exercise with a scripted request that sounds like a long-time client asking for an urgent wire to a new account.
• Train staff on the procedure itself, with examples. Examiners have criticized one-sentence training.
• Report the update to your board or designated senior management, as 17 CFR 248.201(e) contemplates.
• Confirm the steps if a fraudulent wire goes out: contact the sending bank to request a recall and file at ic3.gov. Firms that file a suspicious activity report on a deepfake scheme are asked by FinCEN to include the key term FIN-2024-DEEPFAKEFRAUD.

How does s90 help?

s90 works with RIAs, broker-dealers, dual-registered firms and family offices across Los Angeles and Orange County to keep the technology side of their compliance programs examiner-ready. For wire verification, that means locking down the accounts and contact records a callback depends on, logging changes to client contact data, enforcing phishing-resistant MFA for staff, and helping you run the tabletop that tests the procedure. If you would like a second look at your callback procedure, we are happy to walk through it with you.