Deepfake payment fraud and accountancy practices

Q: How might an attempt unfold?

Illustration only. A practice manager receives a video call that appears to come from a partner who is abroad. The partner looks and sounds right, says a client's property purchase will fail unless £48,000 is sent from the client account within the hour, and asks the manager not to disturb the other partner. The manager follows the firm's rule, ends the call and rings the partner's mobile number from the staff list. The real partner knows nothing about it. The manager reports the attempt internally, the firm alerts its bank and reports to Action Fraud, and no money leaves the account.

Deepfake payment fraud uses AI generated voice or video to impersonate a partner, client or supplier so that someone in the practice moves money or changes bank details. The defence is a payment process that does not trust any single call, message or video, backed by call back checks on numbers already held on file. If money is lost, contact your bank at once and report to Action Fraud, and check whether your cyber policy covers funds lost to social engineering.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

What is deepfake payment fraud?

It is payment diversion fraud with a more convincing disguise. Action Fraud describes payment diversion fraud, also known as business email compromise or mandate fraud, as criminals contacting businesses, often posing as someone they know, to request payments or change bank details. Mandate fraud is when someone gets you to change a direct debit, standing order or bank transfer mandate.

The deepfake element is the cloned voice on a phone call, the fake face on a video meeting, or a voice note that sounds exactly like the senior partner. The government’s Stop Think Fraud campaign warns that criminals impersonate senior executives, sometimes using deepfake audio or video, to rush staff into urgent payments. Our page on preventing payment diversion fraud covers the email based version; this page deals with the AI generated voice and video angle.

How common is it?

The Home Office’s National Assessment Centre fraud assessment 2025, published on 9 March 2026, says organised crime groups have used deepfake videos and voice cloning to enable specific and tailored payment diversion frauds, and that criminals will increasingly adopt generative AI technology such as deepfakes. It describes a February 2024 case in which deepfake recreations of company employees were used to deceive a finance worker into transferring £20 million into a criminally controlled account.

The same assessment places payment diversion fraud among the fraud types causing the highest harm in the UK in 2025, and cites the Economic Crime Survey 2024 finding that over a quarter (389,000) of UK businesses with employees reported fraud attempts. The NCSC’s assessment of AI and the cyber threat, published in January 2024, said AI will primarily offer threat actors capability uplift in social engineering and that generative AI can already enable convincing interaction with victims.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

Why are accountancy practices targets?

Practices make payments for clients, hold client money, run payroll and know when tax payments fall due. A fraudster who knows that a client is about to pay a large tax bill, or that a partner is travelling, has a ready made story. Public material such as webinar recordings, podcasts and social media videos gives criminals enough audio of partners to clone a voice. Clients are also targeted with fake calls from their accountant asking them to pay HMRC or the practice into a new account. Our pages on client money rules and HMRC scam calls and emails cover related risks.

What warning signs should staff look for?

urgency and secrecy, such as a deal that must close today and must not be discussed with anyone else;
a request to change bank details, which Stop Think Fraud notes is rare for a genuine business;
a senior person contacting a junior member of staff directly about a payment they would normally route through the usual process;
a video call where the caller keeps the camera off after a few seconds, blames a poor connection, or avoids questions only the real person could answer;
a voice note or call from an unfamiliar number, or a familiar number asking for something unusual.

Stop Think Fraud suggests that if executives never request urgent payments directly, all staff should know that and know how to respond to such a request.

What controls stop a deepfake payment request?

The controls are the same ones that defeat ordinary payment diversion fraud, applied without exception to calls and video as well as email:

Call back on a known number. Stop Think Fraud says always confirm both old and new account details using a known phone number, not one provided in the message. Action Fraud says to contact the supplier directly using established contact details you have on file.
Use a second channel. The NCSC’s phishing guidance recommends that all important email requests are verified using a second type of communication, such as a phone call or confirmation in person.
Require two people to approve payments and any change of bank details, so no single conversation can move money.
Hold new payee details. Stop Think Fraud notes some firms hold new supplier accounts for 14 or 30 days before approving them, which leaves time for checks.
Agree a challenge question or code word between partners and finance staff for genuine urgent requests.
Reduce spoofing. The NCSC says setting up DMARC stops phishers from spoofing your domain.

Write these rules into the practice’s procedures and its AI policy, so staff know they will be backed for refusing to pay without checks.

Is staff training enough?

No. The NCSC warns that phishing defences often place too much emphasis on users spotting attacks and recommends a layered approach with technical controls alongside education. A good deepfake is designed to fool a careful person, so the payment process has to stop the loss even when the employee believes the call. Training is still worth doing. Stop Think Fraud points to free NCSC staff training that takes less than 30 minutes to complete, and the NCSC recommends an effective process for staff to report suspected phishing. More general measures are on our page on cyber security for practices.

Attack	What it looks like	Control that defeats it
Cloned voice call	A partner phones asking for an urgent transfer	Call back on the number held on file, second approver
Deepfake video meeting	Several familiar faces on a call approve a payment	Payment only through the normal approval route, never on a call
Supplier bank change	Email and follow up call confirm new account details	Confirm old and new details on a known number, hold period
Fake accountant call to client	Client is told to pay tax or fees into a new account	Tell clients in writing that bank details will never change by phone
Spoofed email domain	Request appears to come from the firm’s own address	DMARC and a second channel check

What should you do if money has been sent?

Speed counts. Action Fraud says notify your bank immediately and report fraud to Action Fraud, online or on 0300 123 2040; in Scotland, report to Police Scotland on 101. The NCSC says tell your IT team or IT provider quickly, contact your bank using its official website or phone number, and report a cyber incident through the government reporting service.

If client personal data was exposed, for example because a mailbox was compromised, the UK GDPR requires the breach to be reported to the ICO no later than 72 hours after becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms, and every breach must be documented. See personal data breach reporting.

Does cyber insurance cover deepfake fraud?

Sometimes, and the wording needs checking. The NCSC’s cyber insurance guidance notes that some policies will not cover money lost through business email compromise fraud, while others go further and cover cyber related incidents such as computer enabled fraud. Check how the policy describes a loss where staff are tricked into making a payment, and whether that section carries its own, lower limit. Ask whether cover applies when the instruction came by phone or video rather than email, whether client money is included, and what verification steps the insurer expects you to have followed. The NCSC also says insurance will not prevent an attack, so it supports the controls above rather than replacing them. Our page on insurance for accountancy practices explains how cyber and professional indemnity cover fit together.

How might an attempt unfold?

Illustration only. A practice manager receives a video call that appears to come from a partner who is abroad. The partner looks and sounds right, says a client’s property purchase will fail unless £48,000 is sent from the client account within the hour, and asks the manager not to disturb the other partner. The manager follows the firm’s rule, ends the call and rings the partner’s mobile number from the staff list. The real partner knows nothing about it. The manager reports the attempt internally, the firm alerts its bank and reports to Action Fraud, and no money leaves the account.

Frequently asked questions

Can the bank get the money back?

Sometimes, if it is told quickly enough to contact the receiving bank before funds are moved on. That is why Action Fraud says to notify your bank immediately.

Is a video call safer than a phone call?

No. The Home Office assessment describes deepfake video recreations of company employees being used to obtain a £20 million transfer. Treat video exactly like any other unverified instruction.

Should clients be warned?

Yes. A standard line in engagement letters and invoices saying the practice will never change its bank details by phone, text or video call, and that clients should call back on a known number, helps protect clients and the firm.

Using AI in your practice? Solar AI Cover brings professional indemnity, cyber and liability cover together for firms that use or build AI, and Solar Protect runs fee protection schemes for accountancy practices. See AI insurance for accountants or ask about a practice scheme.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 6 November 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.