Impersonation, deepfakes and social engineering
Your AP team says it calls back before changing a vendor's bank details. Does it, every time?
Payment redirection is simple: a real supplier seems to change banks, the invoice is genuine, only the destination is wrong. The FBI advises verifying any change in account number or payment procedure with the person making the request; in practice that means calling the vendor on the number already on file and getting a second approval. Almost every finance team says it does this. The question is whether everyone with access does it under pressure, and whether you can prove it to your insurer.
Built for Fintechs, marketplaces and platforms that pay many vendors, and the accounts payable teams behind them; Controller, Head of AP, Treasury
The problem in numbers
What the public record shows
Every figure links to the page it came from, with its date.
45%
of organizations surveyed by AFP cited vendor imposter fraud in 2024, up 11 percentage points
financialprofessionals.org, 2025-04
2.77 billion
US dollars in reported business email compromise losses in the US in 2024 (FBI IC3), the wider category this drill sits in, not vendor bank changes alone
cyberscoop.com, 2025-04
16.6 billion
US dollars in all cybercrime losses reported to the FBI in 2024, a record high; this covers every type of cybercrime, not BEC alone
cyberscoop.com, 2025-04
What you get
The deliverables
You get a consented, harmless drill of fake bank-change emails, texts and calls, and a dated evidence letter built to answer cyber-insurance questions.
A harmless, consented drill
Simulated bank-change requests by email, text and phone, sent to the staff in scope. No cloned voices or faces are used.
A record of what staff did
For each request: was the callback made, to which number, and did the second approver check it independently.
A dated evidence letter
Written to answer cyber-insurance questions about social-engineering and funds-transfer controls.
The findings behind it
Which channels, people or exceptions let a change through, with plain fixes.
How it runs
2 to 3 weeks, start to finish
2 to 3 weeks
Consent and scope
Written consent, the list of people who can change vendor bank details, and the channels to test.
Drill
Simulated requests are sent over email, text and phone, and each response is recorded.
Evidence letter and readout
A dated evidence letter and a readout with finance and AP leads.
Consent. This runs only with written consent from your company before anything starts. Nothing is sent to anyone outside the agreed scope.
Method
How the answer is produced
One control, tested properly
The drill checks the callback to the number on file and the independent second approval, the verification step the FBI advises for payment changes, in every channel.
Every channel
Email, text and phone are all tested, because the rule is often written only for email.
Harmless by design
Requests are simulated, no money moves, and no cloned voices or faces are used.
Why Amir
Designed and led by someone who has built fraud models in production
The patents closest to this problem:
Amir is a named inventor on US 12,118,558 B2 (Estimating quantile values for reduced memory and/or storage utilization and faster processing time in fraud detection systems, filed at NICE Actimize; granted).
A related idea: it scores each account against its own history in real time, the kind of check that would flag a first payment to a vendor's new bank details as unusual. The drill tests a human process and is not an implementation of the patent.
View on Google PatentsAmir is a named inventor on US 12,541,721 B2 (Method for extreme class imbalance within fraud detection, filed at NICE Actimize; granted).
A related idea: redirected payments are a tiny share of all vendor payments, and this patent addresses building fraud models when the bad cases are that rare. The drill uses no model and is not an implementation of the patent.
View on Google PatentsThese patents were filed at the companies named. They show the problems Amir has worked on; they are not Riskernel products.
Is this you
You probably need this if
- You cannot pull a record of who called whom, on which number, for your last 20 vendor bank changes.
- The callback number can be edited in the same step as the bank details.
- Your procedure is written for email, but requests also arrive by text, phone or supplier portal.
- Outsourced bookkeepers or a shared-service centre can edit the vendor master.
- Your cyber-insurance form asks whether you verify payment instruction changes out of band, meaning on a separate channel, such as a call to the number on file.
Questions
Before you reach out
Will any payment be redirected?
No. The requests are simulated and the drill stops before any payment is made.
Do you use deepfakes?
No. This drill uses plain emails, texts and calls. The Deepfake Executive Drill is the separate offer for voice and video fakes.
Why does the evidence letter matter?
If a loss happens and the control was not actually followed, a yes on the insurance form can be questioned at claim time. A dated test record is a stronger answer than a policy document.
Can an insurer or broker commission this?
Yes. Insurers and brokers can commission the drill for their insureds, with each insured's written consent. It also answers the social-engineering and funds-transfer questions on cyber-insurance forms.
What do you need from us?
Written consent, the list of people who can change vendor bank details, and a contact who knows how changes are approved today.
Scope Vendor Bank-Change Drill with Amir
Tell Amir what you run and what worries you. He replies with a short scope outline.