Deepfakes make an old fraud more convincing. Whether the request comes by email, voice note or video call, the goal is the same: get someone to pay a new bank account or change a supplier's bank details. The strongest defence is a payment process that does not depend on recognising a face or a voice. Every bank detail change is confirmed through a second channel. Payments to new or changed accounts are held until then. The person who releases money is not the person who asked for it.
This guide sets out those controls, and how to build them into Odoo and NetSuite. Facts below were checked against the FBI, the Financial Times, Oracle and Odoo documentation on October 30, 2026.
Disclosure: OPS is an Odoo partner and a NetSuite partner, runs bookkeeping through Business as a Service and provides managed detection and response. OPS earns fees from that work.
What the attacks look like
- The fake executive on a call. In 2024 the Financial Times confirmed that engineering group Arup lost HK$200 million (about US$25 million) after fraudsters used a digitally cloned senior manager to order transfers during a video conference. Hong Kong police said the employee made 15 transfers to five bank accounts before the scam was discovered by following up with head office. We covered the case in Deepfake fraud: the $25M video call.
- The meeting that "isn't working". In 2022 the FBI warned that criminals use virtual meeting platforms in business email compromise (BEC). They join with a still picture of the CEO or deepfake audio, say their video is broken, then give payment instructions in the chat or a follow-up email.
- The supplier with new bank details. A message that looks like it comes from a real supplier asks you to pay future invoices to a new account. Odoo's own documentation describes this invoice fraud pattern and recommends calling the vendor on an official number you look up yourself. See also Vendor master fraud.
The FBI's Internet Crime Complaint Center reported US$55.5 billion in exposed BEC losses from 305,033 incidents between October 2013 and December 2023. Its advice includes using secondary channels or two-factor authentication to verify requests to change account information.
Six controls that do not depend on spotting a fake
- Bank details change only through a set process. One named team updates supplier bank details, never from the email or call that requested the change.
- Call back on a number you already hold. Confirm every new or changed bank account by phone, using a number from your records or the supplier's official website, not from the request.
- Hold the first payment. Payments to a new or changed account wait until the call-back is recorded.
- Split request, approval and release. The person who enters or approves a bill does not release the payment. Large payments need a second approver.
- No exceptions for urgency or seniority. Write it down: nobody, including the CEO, can skip the process by phone, video or message. Urgency and secrecy are warning signs in themselves.
- Review changes after the fact. Each week, someone outside the payments team reviews a report of supplier bank detail changes and first payments to new accounts.
If you run Odoo
According to Odoo's documentation on trusted accounts, vendor bank accounts must be marked as trusted before they can be used for an outgoing payment. All accounts start as untrusted, and you trust one by opening the vendor bank account and switching on Send Money.
What to do:
- Restrict who can switch on Send Money, and make that step the record of your call-back.
- Keep the people who trust accounts separate from the people who pay.
- Use Odoo's guidance as a checklist for staff: compare the communication style with earlier messages, be wary of urgency, question a switch from a bank account to a money transfer service, and check email domains and links.
- Check your version. The trusted accounts page above is from the Odoo 19 documentation. Confirm the behaviour in your own version and test it.
If you run NetSuite
According to Oracle's documentation:
- Vendor bill approval. With the Payables feature, vendor bills have an approval status. You can set the default to Pending Approval, and bills that are pending can be approved or cancelled. For more complex rules, SuiteFlow workflows can route approvals, for example to specific employees or based on conditions.
- Payment batch approval. With Electronic Bank Payments, you can turn on approval routing for payment batches. You set a payment limit above which approval is needed, and an approval hierarchy with ascending limits. Approvers receive an email when a batch needs them.
What to do:
- Set vendor bills to Pending Approval by default, so nothing is paid without a recorded approval.
- Turn on payment batch approval routing, with limits that match your delegation of authority.
- Restrict who can edit vendor bank details, and record the call-back before a payment to a new account is released.
- Review changes to vendor records and bank details regularly, and confirm with your partner which reports your account uses for this.
Where security and the back office meet
These frauds cross team lines. The fake request often arrives through a compromised mailbox, which is a security problem. The money leaves through accounts payable, which is a finance process.
- Security side. Watch for signs that a mailbox or account has been taken over, such as unusual sign-ins or new forwarding rules, and have a plan for the first hour after a suspected fraud. If money has been sent, the FBI's advice is to contact your bank immediately and ask for a recall of the funds.
- Back office side. The controls above only work if they run every day, including month-end and holidays. If someone else runs your bookkeeping, agree in writing who can change supplier bank details, who makes the call-back, who releases payments and how exceptions are reported to you.
Common questions
Can staff training alone stop deepfake fraud?
Training helps people pause, but a convincing fake can still get through. Process controls, such as call-backs on known numbers and split approvals, work even when the fake is good.
Should we stop using video calls for approvals?
No. Treat any payment instruction from a call or message as a request, then approve it through your normal process in the ERP.
What should we do if we have already paid?
Contact your bank immediately and ask for a recall of the funds. The FBI also advises reporting the fraud to the authorities as soon as possible.
Does Odoo or NetSuite stop these payments automatically?
Not on their own. Odoo can block payments to untrusted bank accounts, and NetSuite can route bills and payment batches for approval. Both depend on who has permission to change bank details and approve payments.
Sources
All checked October 30, 2026.
- Financial Times, Arup lost $25mn in Hong Kong deepfake video conference scam, May 2024
- FBI IC3, Business Email Compromise: The $55 Billion Scam, September 11, 2024
- FBI IC3, Business Email Compromise: Virtual Meeting Platforms, February 16, 2022
- Odoo, Trusted accounts (send money), Odoo 19 documentation
- Oracle, Vendor bill approvals
- Oracle, Setting up approval routing for payment batches
Related: Business email compromise outearns ransomware, Invoice fraud rises with automation speed and AI-generated phishing removes the obvious tells.