You're offline, showing the last version we saved.
Build with AI · Using AI safely

AI scams and deepfakes: protect your firm and your clients

AI can now make a voice, a face or an email look exactly like someone you know. Accounting firms are targets because you move money and hold data. A few habits stop most of it.

For beginners · Checked 11 November 2026 · Not advice

In plain English

Scammers use AI to copy a client’s voice from a short clip, put a fake face on a video call, or write an email in a colleague’s exact style. In 2024 a finance worker in Hong Kong paid out millions after a video call where the other “colleagues” were deepfakes.

One rule beats most of it: never change bank details or move money on a single message, however real it sounds. Check through a second channel you already trust.

What can go wrong

  • Cloned voice notes A voice message that sounds exactly like a client, asking to change payroll or bank details.
  • Deepfake video calls A call where a familiar face asks for an urgent payment or a password.
  • Perfect fake emails No spelling mistakes any more: an email in your client’s style, from an address that’s one letter off.
  • Fake IT support A friendly call from “IT” asking for a password or a code from your phone.
  • Fake ATO and myGov messages Official-looking texts and emails with links to fake log-in pages.

For beginners

Six habits that stop most AI scams

  1. Step 1: Agree a safe phrase

    A word or phrase the team, and key clients, use to confirm it’s really them on a call or voice note.

  2. Step 2: Call back on a number you already have

    Every change to bank or payment details gets a call to the number on file, never the one in the message.

  3. Step 3: Two people for money changes

    One person requests, another approves. A scammer has to fool both.

  4. Step 4: Treat urgency as a warning

    Pressure to act now, keep it quiet or skip the usual check is the scam’s favourite trick.

  5. Step 5: Never give a code or password on a call

    No real IT provider, bank or ATO officer needs your password or the code sent to your phone.

  6. Step 6: Tell your clients the rule

    Let clients know you’ll never ask them to change bank details by email or voice note. Copy the notice below.

Check it every time

Before you act on a request to move money or change details

Run through these, however real it looks.

  • Did it come through one channel only, such as an email, a voice note or a text?
  • Have you called back on the number already on file?
  • Did they use the safe phrase?
  • Has a second person approved it?
  • Is there pressure to rush or keep it quiet?

Copy and use

A notice for your clients

Add it to your email signature, invoices or next newsletter.

Protecting you from scams: [Firm name] will never ask you to change bank details, pay a different account or share a password by email, text or voice message alone. If you receive a request like that from us, please call us on [phone number on our website] before you do anything.

A rule for your team

Put it in your procedures and walk the team through it.

Payment and bank detail changes: we never act on a single message. Every change to a client's, supplier's or employee's bank or payment details is confirmed by calling the number already on file, and approved by a second person. If the caller doesn't know our safe phrase, we stop and check.

If you think you’ve been scammed

  1. Call your bank straight away to try to stop or recall the payment.
  2. Report it to ReportCyber at cyber.gov.au, and to Scamwatch.
  3. Change any passwords that may have been shared, and check multi-factor authentication is on.
  4. Tell any clients who may be affected, and assess whether it’s a notifiable data breach.
  5. Write down what happened and when, and tell your insurer.

Use these next

Please read: use these at your own risk

  • These prompts, guides and tools are general information, not professional, legal, privacy or IT advice. The Firm takes no responsibility for how they are built, changed or used, or for anything that results.
  • AI writes a slightly different tool each time. Whatever you build or download is yours to check, test and approve before you rely on it or use it with client data.
  • Check your AI provider’s current settings and terms for how your data is stored and whether it is used to train its models. Plans and settings change.
  • Bring your own judgement, and follow your firm’s AI policy and your professional and privacy obligations.

Questions firms ask

What is a deepfake scam?

A scam that uses AI to copy someone’s voice, face or writing so a request seems to come from a person you trust, such as a client asking to change bank details or a director asking for an urgent payment.

How do I protect my firm from AI voice cloning?

Never act on a voice message or call alone for anything involving money or bank details. Call back on the number already on file, agree a safe phrase with your team and key clients, and have a second person approve changes.

What is a safe phrase?

A word or phrase agreed in advance that a real colleague or client can give to prove it’s them. A scammer with a cloned voice won’t know it.

Where do I report an AI scam in Australia?

Report cybercrime to ReportCyber at cyber.gov.au and scams to Scamwatch. Call your bank first if money has moved, and check whether the incident is a notifiable data breach.