A familiar voice used to feel like proof. Today, artificial intelligence can imitate an owner, executive, employee, client or family member well enough to make an urgent request sound convincing.
The risk extends beyond voice calls. Criminals can produce polished emails in a leader’s writing style, fabricate photographs and create video that appears to place a trusted person in a meeting. Lexington businesses should assume that appearance and sound alone can no longer verify identity.
Where impersonation creates the greatest risk
AI-assisted impersonation is most dangerous when it reaches a workflow that moves money, changes access or releases sensitive information. Common targets include:
- Wire transfers and urgent vendor payments
- Payroll or direct-deposit changes
- Vendor banking updates
- Password and multi-factor authentication resets
- Tax records, patient information and confidential client files
- Requests that bypass normal review because an executive is supposedly traveling or unavailable
Professional firms, medical practices, construction companies, nonprofits, real estate organizations and family businesses all rely on trusted relationships. Criminals exploit that trust by adding urgency, secrecy or pressure to act before anyone verifies the request.
Create a verification rule before the call arrives
The most important control is simple: never approve a high-risk request only through the same communication that initiated it. If a request arrives by phone, verify it using a known number from the company directory. If it arrives by email, call the person or vendor using contact information already on file.
This is called out-of-band verification. It prevents a convincing voice, video or message from becoming the only evidence an employee uses to authorize an irreversible action.
Put two people between a request and a loss
Require a second approver for wire transfers, new payment destinations, payroll changes and releases of confidential information. Configure dual authorization inside the banking or financial platform when possible, rather than relying only on an informal email approval.
Employees should also have clear authority to pause an unusual request without being penalized for slowing it down. A verification process fails when staff believe an executive’s urgency overrides the rule.
Strengthen the technology around the procedure
Good process is the foundation, but technical controls reduce the number of fraudulent requests that reach employees. Use multi-factor authentication, protect administrator accounts, limit access according to job responsibilities, monitor unusual sign-ins and keep email-domain protections properly configured. Review mailbox forwarding rules and vendor access, because a compromised real account can make impersonation even more persuasive.
Give every team a short response checklist
- Stop when a request involves urgency, secrecy, money, credentials or confidential data.
- Call back using a trusted number, not a number supplied in the request.
- Require a second authorized person for sensitive changes.
- Confirm vendor banking changes directly with a known vendor contact.
- Save the message, recording or email and report it immediately.
- If money moved, contact the financial institution at once and begin the incident-response plan.
Trust still matters; verification protects it
Lexington business is built on relationships. Verification does not weaken those relationships—it protects employees, clients and leaders from someone using a trusted identity against them.
Hensley / Elam helps Kentucky organizations strengthen identity security, payment-change procedures, Microsoft 365 controls, employee awareness and incident-response plans before an AI-generated request puts them to the test.
This article provides general technology and security information, not legal, financial or regulatory advice.
Local awareness is part of a strong defense; follow TOPS in Lexington community news for more stories affecting the Lexington area.