$2.95B
FTC-reported imposter losses in 2024
FTC says imposter scams were the most commonly reported fraud category in 2024 and cost people $2.95 billion.
AI impersonation/Signal
Deepfake payroll change voice note scam
A payroll administrator receives a voice note from what sounds like the CFO asking for a confidential executive payroll update.
“payroll fraud”
↑ 223%Key indicators
Usually targetsPayroll staff
Often hitsPayroll, HR, and finance teams
Common regionGlobal
Last updated2026-04-03
Estimated impact
$1.4K
median reported loss
Typical range$90 – $9.0K
Recovery rate~15%
Scam breakdown
1
Attackers collect public voice, image, or video material from social platforms, voicemail, or prior leaks.
2
They use synthetic media to create a convincing identity signal and then create urgency before the target can verify it.
3
The pressure usually aims at fast payments, confidential data, or internal approval changes.
What to do first
Freeze the change until the executive confirms through the normal payroll process.
Related terms
CFO payroll voice scamexecutive payroll deepfakeAI impersonationSignalSurgingPayroll staffHR teamsPayroll, HR, and finance teamsGlobalCFO payroll voice scamexecutive payroll deepfake
Real-world example
How this scam plays out in practice
Based on reported patterns. Names and details are illustrative.
The setup
Daniel, 35, a payroll staff, encountered what appeared to be a legitimate ai impersonation situation while using Signal. Attackers collect public voice, image, or video material from social platforms, voicemail, or prior leaks.
Step 2
What happened next was calculated: They use synthetic media to create a convincing identity signal and then create urgency before the target can verify it.
Step 3
The pressure escalated quickly: The pressure usually aims at fast payments, confidential data, or internal approval changes.
The outcome
Daniel realized something was wrong when the request bypasses written approval and asks for a new bank account immediately.. By that point, significant damage had already been done — money sent, personal information shared, or trust exploited.
The lesson
Freeze the change until the executive confirms through the normal payroll process. Daniel's experience shows why the request bypasses written approval and asks for a new bank account immediately. and the caller or video pushes for money, credentials, or secrecy before you can verify anything. are the clearest early warning signs.
How to identify it
- The request bypasses written approval and asks for a new bank account immediately.
- The caller or video pushes for money, credentials, or secrecy before you can verify anything.
- The scam depends on emotional urgency rather than a normal institutional process.
- Slow the call or message down. A real family or authority emergency can survive independent verification.
- Treat secrecy, urgency, and pressure to move money immediately as primary scam signals.
- Call the relative, institution, or agency back using a number you already know instead of the one provided in the message.
What to do now
- ✓Freeze the change until the executive confirms through the normal payroll process.
- ✓End the interaction and verify the person or situation through a trusted number or second channel.
- ✓Use a known family or business verification phrase for unexpected emergencies.
What to save before reporting
- ✓Save screenshots of the call log, voicemail, messages, and any payment instructions.
- ✓Write down the phone number, display name, callback number, and exact time of contact.
- ✓Keep any money-transfer details, gift card receipts, or app transaction IDs before disputing anything.
How big is this problem
You are not alone — this scam affects millions of people.
These numbers come from government agencies and official reports. If you have been affected, know that this is a widespread problem — not something that only happens to careless people.
FTC 2024 fraud losses
$789M
Government imposter losses in 2024
FTC says government imposter scams alone cost consumers $789 million in 2024, showing how profitable authority-driven pressure still is.
$23M+
Emergency scam losses in Canada
The Canadian Anti-Fraud Centre says emergency scams, including grandparent-style variants, caused more than $23 million in reported losses.
History and evolution
- Family-emergency and authority-impersonation scams existed long before generative AI. Voice cloning mainly makes the first contact sound more convincing.
- This scam family keeps evolving with whatever communication channel feels intimate first: phone calls, voice notes, and now synthetic media.
- Synthetic voice and video quality keeps improving, but the urgency pattern remains highly consistent.
Recovery and follow-up
- ✓Save the messages, receipts, account alerts, and transaction details before you block or delete anything.
- ✓Report the scam through the official platform or government channel that best matches where it happened.
- ✓Freeze the change until the executive confirms through the normal payroll process.
- ✓End the interaction and verify the person or situation through a trusted number or second channel.
- ✓Use a known family or business verification phrase for unexpected emergencies.
Why this pattern keeps working
This scam family existed before AI. Voice cloning mainly makes the first contact feel more believable; the pressure pattern is still secrecy, urgency, and fast money movement.
Scammers often add a second fake authority figure because victims are more likely to trust a lawyer, police officer, or hospital worker than the original caller alone.
Synthetic voice and video quality keeps improving, but the urgency pattern remains highly consistent.
Expanded launch family covering consumer and business deepfake impersonation patterns.
Where to report it
If you have been targeted by this scam, reporting it helps authorities track the pattern and protect others. Global has dedicated agencies that handle fraud reports.
Report cross-border scams
econsumer.gov (ICPEN)
International Consumer Protection and Enforcement Network portal for reporting cross-border online scams. Reports are shared with consumer protection agencies in 40+ countries.
Interpol financial crime guidance
Interpol
International policing guidance on online financial fraud, romance scams, and investment fraud operating across borders.
Report phishing emails
Anti-Phishing Working Group
Global industry coalition for reporting phishing emails and URLs. Forward phishing to [email protected].
Explore further
Understand the bigger picture
Who is most at risk
Who this scam targets
Primary targets
Payroll staff, HR teams
Geographic concentration
Global
Primary channel
Signal — AI impersonation
Why this group is vulnerable
Payroll staff are particularly vulnerable because this scam exploits trust in familiar brands, authority figures, and time-sensitive decisions. The rapid increase in reports suggests that awareness among this demographic remains low.
Sources and methodology
How we verify this information
OpenScam tracks scam patterns using a combination of government consumer protection databases (FTC, IC3, Action Fraud), platform-specific fraud reports, and verified consumer complaint data. Each entry is cross-referenced against at least two independent sources before publication.
Severity ratings are based on financial impact potential, reversibility of damage, and volume of reports across multiple reporting channels. Trend velocity reflects the rate of change in report volume over the most recent 90-day window.
This page was last verified on 2026-04-03. Red flags, recovery steps, and reporting resources are reviewed quarterly against current agency guidance.
Evidence and indicators
- Synthetic voice and video quality keeps improving, but the urgency pattern remains highly consistent.
Source notes
- Expanded launch family covering consumer and business deepfake impersonation patterns.
Frequently asked questions
Common questions about deepfake payroll change voice note scam
How does the deepfake payroll change voice note scam work?+
Attackers collect public voice, image, or video material from social platforms, voicemail, or prior leaks. They use synthetic media to create a convincing identity signal and then create urgency before the target can verify it. The pressure usually aims at fast payments, confidential data, or internal approval changes.
What are the warning signs of deepfake payroll change voice note scam?+
The request bypasses written approval and asks for a new bank account immediately. The caller or video pushes for money, credentials, or secrecy before you can verify anything. The scam depends on emotional urgency rather than a normal institutional process.
What should I do if I encounter deepfake payroll change voice note scam?+
Freeze the change until the executive confirms through the normal payroll process. End the interaction and verify the person or situation through a trusted number or second channel. Use a known family or business verification phrase for unexpected emergencies.
Who is most at risk for deepfake payroll change voice note scam?+
This scam primarily targets Payroll staff, HR teams. It is most commonly reported in Global and typically appears on Signal.
Is deepfake payroll change voice note scam getting worse?+
Deepfake payroll change voice note scam is currently surging — reports are increasing rapidly. It has been reported across Global. Last updated 2026-04-03.
Related scams
Similar scams to watch out for
AI impersonation
↑ 34%AI voice clone family emergency scam
A caller sounds exactly like a family member in distress and pressures the victim to send money immediately before verifying the story.
What to do first
Hang up and call the family member back directly using a known number.
Targets
Parents
Seen in
U.S.
AI impersonation
↑ 34%AI school injury parent call scam
A caller with a child's cloned voice says there has been a school injury and demands immediate payment before the parent verifies the story.
What to do first
Call the school or student directly using a known number before taking any action.
Targets
Parents
Seen in
U.S.
AI impersonation
↓ 14%Fake boss wire approval voice note scam
A finance employee receives a convincing voice note from what sounds like the CEO approving an urgent same-day wire.
What to do first
Call the executive or use the internal approval flow before sending funds.
Targets
Finance teams
Seen in
Global
Help someone avoid this scam.
Scammers succeed because people do not talk about it. If you or someone you know has been affected, there is no shame in it — it happens to millions of people every year. Share this page with friends and family so they know what to look for.