Finance teams: four tricks criminals use, and what stops each one

October 3, 2026

Criminals go after finance teams because that’s where the money moves: in 2024, an employee of the engineering firm Arup sent about £20 million to criminals after a video call where, according to Hong Kong police, everyone else was a deepfake. This two-minute video, told by a villain, is for finance directors, accounts payable, payroll and bookkeepers. It shows four tricks and what stops each one: new bank details from a “supplier” (phone them on a number you already have), a fake boss on a video call (call back, and never skip the approval steps), client figures in free AI (use the AI tools your company has approved) and the bank and payroll logins (a password manager and two-step sign-in).

Why do criminals target finance teams?

Your finance team pays suppliers, changes bank details and runs payroll, so they’re the people a criminal needs to fool. Stop! Think Fraud, the government’s fraud campaign, calls payment diversion fraud one of the most damaging scams facing UK businesses: criminals deceive staff into sending money to the wrong bank account. It says these scams rely on urgency, authority and trust, and often target busy teams or key moments such as the financial year-end.

UK Finance says CEO fraud, where a criminal impersonates the chief executive or another senior person, mostly affects businesses: the criminal emails a member of the finance team with what appears to be a genuine email from the boss. In 2025 it was the least common of the eight scam types in UK Finance’s annual report, but it had the highest average loss, at just over £28,000 per confirmed case. Our guide to phishing, spear phishing and whaling explains why finance teams feel these targeted emails most.

What should you do when bank details change?

In the first trick, a criminal poses as a supplier and emails to say the bank details have changed, sending from the supplier’s hacked email account or from a lookalike address. Stop! Think Fraud says it’s rare for businesses to change bank accounts. It advises confirming both the old and the new account details on a known phone number, never one from the message, and using sign-off processes for any change to bank or payroll details. Some companies wait 14 or 30 days before they approve a new supplier’s account details.

Payroll faces the same trick. In salary diversion fraud, scammers pose as employees and ask HR or payroll to change their bank details, so the salary goes to the criminal. Our invoice fraud video covers the supplier version in more depth, including how hard it is to get the money back.

How does a deepfake video call scam work?

In the second trick, the criminal becomes your boss on a video call. A deepfake is a fake face and voice, made with AI, and Stop! Think Fraud warns that criminals who impersonate senior executives sometimes use deepfake audio or video to pressure staff into urgent payments.

It happened at Arup, the British engineering firm. Hong Kong police said in February 2024 that a finance worker had joined a video call with people the worker believed were the chief financial officer and other members of staff, all of whom turned out to be deepfakes. According to police, the worker had first suspected a phishing email, because it talked of a secret transaction, but put the doubts aside because the people on the call looked and sounded like colleagues. The worker sent HK$200 million, about £20 million, in 15 transactions. In May 2024, Arup confirmed it was the company involved and that fake voices and images were used. Arup said none of its internal systems were compromised.

CNN reported that the fraud came to light only when the employee later checked with the company’s head office. That check is the fix in the video: call back on a number you already know, and never skip the approval steps, whoever asks. Get Safe Online advises checking with the person, “however senior or busy”, by phone, in person or another trusted way, not by email. Stop! Think Fraud adds that if your company has a rule that the chief executive or finance director never asks staff for urgent payments, every member of staff should know it. Our fake boss quiz video shows the email version of the same scam.

Is it safe to paste client figures into free AI?

The third trick isn’t the villain’s at all. To save time, someone pastes client figures into their own free AI account, and the figures leave the company’s control. The NCSC says that passing sensitive information to consumer AI services is likely to reduce your visibility and control over it, because it may be stored, retained or used to improve the service, unless specific privacy controls are in place. OpenAI says it may use content from its services for individuals, such as ChatGPT, to train its models unless the user opts out.

The NCSC also warns that AI can get things wrong and present incorrect statements as facts, so check any figures it gives you. The fix is to use the AI tools your company has approved, under a business account. Our shadow AI video shows what happens to a client contract pasted into a personal account.

Why do bank and payroll logins need extra protection?

The fourth trick goes after the logins themselves. The NCSC lists banking and finance accounts, and HR and payroll systems, among a business’s important online accounts. A password that’s also used on another site can be tried on your bank login if that site leaks, so the NCSC says that if you have re-used passwords across business-critical accounts, you should change them as soon as possible. Our password re-use video shows how one leak puts other accounts at risk. Walking away without locking your screen is the other way in, and the ICO advises locking it whenever you’re away from your desk.

The NCSC says a password manager stores passwords safely, so you can have a unique password for each service, and that turning on two-step verification (2SV) is one of the most effective ways to protect online accounts, because it helps stop criminals getting in even if they know the password. Where an account offers passkeys, the NCSC recommends turning them on for business-critical accounts first. The ICO advises giving access only to those who need it, and the NCSC suggests reviewing who has access to important accounts every few months. Our video on passwords in a spreadsheet explains why a password manager is the safer place for shared logins.

Warning signs

New bank details, by email, from a supplier or a member of staff.
It’s urgent. Stop! Think Fraud lists unexpected or urgent payment requests as a sign to look out for.
It’s secret. The message in the Arup case talked of a secret transaction.
It mentions people you work with. Criminals can gather information about your business and the people in it, for example on LinkedIn, so a message that names your colleagues can still be fake.
A request to skip the approval steps, which Stop! Think Fraud also lists as a warning sign.

What to do about each trick

New bank details? Phone on a number you already have. Confirm the old and the new details with the supplier, or with the member of staff for payroll, never on a number from the message, and have two people approve the change.
A request from the boss? Call back on a number you already know. Do this however senior or busy they are and however urgent it sounds, and never skip the approval steps, whoever asks.
Use the AI tools your company has approved, and check the figures. Keep client figures out of personal AI accounts. AI can get figures wrong.
Protect the bank and payroll logins. Use a password manager and two-step sign-in, limit who has access, and lock your screen when you step away.
Report it fast. If something feels wrong, tell IT or your manager straight away. If money has gone, ring your bank at once on its official number, and keep the emails.

Video transcript

Read the full transcript

Villain: I don’t bother with your IT team. I go after your finance team: finance directors, accounts payable, payroll, bookkeepers. That’s where the money moves.

Villain: Trick one. I pose as your supplier, and email to say the bank details have changed.

Villain: What stops me? You phone the supplier on a number you already have, and two people approve the change.

Villain: Trick two. I become your boss, on a video call. With AI, I fake his face and voice. That’s a deepfake.

Villain: I make it urgent and secret, mention people you work with, and ask you to skip the approval steps.

Villain: This is real. In 2024, an employee at the engineering firm Arup sent about £20 million after a video call where everyone else was a deepfake.

Villain: What stops me? You call back on a number you already know. And you never skip the approval steps, whoever asks.

Villain: Trick three isn’t even mine. To save time, you paste client figures into your own free AI account, and they leave your control.

Villain: What stops me? You use the AI tools your company has approved, and check the figures. AI can get them wrong.

Villain: Trick four: your bank and payroll logins. A re-used password or an unlocked screen can let me in.

Villain: What stops me? You use a password manager and two-step sign-in, limit who has access, and lock your screen when you step away.

Villain: So go on. Try and stop me. I’ll wait.

Narrator: That’s how criminals target finance teams.

Narrator: If something feels wrong, tell IT or your manager straight away. If money has gone, ring your bank at once, on its official number.

Narrator: Protect the team that moves your money. Talk to Ingenio.

Frequently asked questions

What is deepfake fraud?

Deepfake fraud uses AI to fake a real person’s face and voice, such as a senior colleague’s, to persuade someone to send money. Stop! Think Fraud warns that criminals who impersonate senior executives sometimes use deepfake audio or video to pressure staff into urgent payments.

What happened in the Arup deepfake case?

An Arup employee in Hong Kong sent HK$200 million, about £20 million, to criminals after a video call with people the employee believed were the chief financial officer and other staff. Hong Kong police said everyone else on the call was a deepfake. Arup reported the fraud to the police in January 2024 and confirmed in May 2024 that fake voices and images were used.

How can you tell if a video call is a deepfake?

Don’t rely on spotting it. In the Arup case, police said the people on the call looked and sounded like colleagues the worker recognised. The check that works is the one that uncovered that fraud: contact the person another way, on a number you already know, before any money moves.

Is it safe to put client figures into ChatGPT?

Not into a free personal account. OpenAI says it may use content from its services for individuals, such as ChatGPT, to train its models unless you opt out, and the NCSC says information passed to consumer AI services may be stored, retained or used to improve the service. Use the AI tool your company has approved, and check its figures: the NCSC says AI can get things wrong.

What is salary diversion fraud?

It’s when a scammer poses as an employee and asks HR or payroll to change their bank details, so the salary goes to the criminal’s account. Stop! Think Fraud recommends clear processes for changing payroll details, with sign-off before any change is made.

What should we do if we’ve paid a fraudster?

Act at once. Tell your IT team or provider as soon as you can, and contact your bank directly using its official website or phone number, as the NCSC advises. Keep all the emails, because the police and investigators may need them.

How we help

At Ingenio, our KnowBe4 security awareness training gives your team short lessons and simulated phishing emails, including training on fake invoices and business email compromise. We set up a business password manager with shared folders, so you control who can see which passwords, and we help you turn on two-step sign-in across Microsoft 365. Our Microsoft 365 identity protection service, powered by Huntress, watches for unusual sign-ins and new inbox forwarding rules. If you’re planning to bring AI into the finance team, our Copilot readiness assessment checks what your staff can already access before you switch on Microsoft 365 Copilot. We’re based in Brighton and support businesses across Sussex and the South East.

Final thought

Each trick in the video ends with a request to move money or hand over access, and each one depends on someone acting before they check. A call back on a number you already have, and approval steps that nobody skips, give your finance team the time to check.

👉 Talk to us about protecting your finance team. We’re happy to talk it through.

Sources

Simon Smyth

Simon founded Ingenio Technologies in 2005 and remains its owner and Managing Director. Based in Brighton, he helps growing businesses of 10 to 75 people across Sussex and the South East get IT that keeps up with their growth. His work covers managed IT support, cyber security, Microsoft 365 and practical automation and AI.

Related articles