How do you verify who someone is when faces and voices can be faked? Stop treating what you see and hear as proof, and verify through things a faker does not control: a channel you set up in advance, a secret only the real person knows, and a rule that any request involving money needs a second, independent confirmation. Layering two or three of these checks defeats almost every deepfake scam, however good the fake looks.
This guide is the complete version for families and small businesses. It compares the main verification methods and what each one really proves, shows how to build a protocol at home and in a company, walks through three realistic situations, lists the mistakes that quietly undo good habits, and explains when to involve the bank, the police or a specialist.
Why seeing and hearing are no longer proof
For most of history, recognising a face or a voice was good enough identification. Banks, families and businesses built habits around it: if the boss calls, you do what the boss says; if your daughter is on the phone crying, you help. Generative AI has broken that assumption. A short clip of someone’s face or voice, often taken from public social media, can be turned into a convincing imitation, and the tools to do it are widely available.
The useful response is not to become an expert at spotting fakes. Detection is an arms race, and the people most likely to be targeted, such as elderly parents or a junior accountant under time pressure, are the least able to win it. The useful response is to change what counts as proof. Instead of asking “does this look and sound like them?”, ask “did this request come through a channel I trust, and has it been confirmed in a way a faker cannot control?”
Out-of-band checks, and effort that matches the stakes
Security people describe this as verifying out of band: confirming a request through a separate channel from the one it arrived on. If a request comes by video call, you confirm by calling a saved phone number. If it comes by email, you confirm by phone. The faker controls one channel, usually a hijacked account or a new number, but rarely two.
The second principle is that verification effort should match the stakes. Nobody needs a protocol to chat with a cousin. But any request to move money, share a code, change bank details, install software or send documents should trigger the checks automatically, regardless of how familiar the person seems. Making the trigger the request rather than the suspicion matters, because good fakes do not feel suspicious.
The narrower skills still have a place. Knowing the visual checks that still help during a video call can buy you a moment of doubt, and a family code word against cloned voices is one of the cheapest defences available. This guide puts those pieces into a complete system.
Verification methods compared: what each one actually proves
No single method is perfect. The table shows what each check really establishes, where it fails and where it fits best, so you can combine them sensibly.
| Method | What it proves | Main weakness | Best used for |
|---|---|---|---|
| Recognising a face or voice | Only that the content resembles the person. | Can be generated from public clips; panic and noise hide flaws. | Never on its own for money or codes. |
| Calling back a saved number | That you reached the phone line you already associated with the person. | Fails if you dial a number given during the suspicious contact, or the SIM itself was swapped. | Any urgent request from family, staff or suppliers. |
| Shared secret or code word | That the caller knows something agreed privately in advance. | Leaks if written in chats or used carelessly; people forget under stress. | Family emergencies, small teams. |
| Asking a personal question | That the caller knows a private detail. | Many details are discoverable online or guessable. | A quick extra layer, not a main check. |
| Second person confirmation | That someone else independently confirms the story or the instruction. | Slower; the second person must use their own channel. | Large payments, family money requests. |
| Two-person approval for payments | That no single person can be tricked into moving money alone. | Needs discipline when the boss is “in a hurry”. | Every business payment above a set level. |
| Face verification in bank apps | That a live person matching the chip-based ID is using the app. | Protects the bank account owner, not the person being persuaded to transfer. | Logging in and authorising your own transfers. |
| Meeting in person | Physical presence, strongest for high stakes. | Impractical for distance or emergencies. | Changes to bank details, large contracts, onboarding. |
Notice that the bank’s face check protects the account but not the decision. If you are persuaded to transfer money to a scammer, you will pass the face check yourself. That is why the human protocol matters.
Building a verification protocol for your family
A family protocol works only if everyone knows it before a crisis. Set it up in one conversation, ideally in person, and repeat it once a year.
- List the triggers. Agree that any request involving money, OTP codes, passwords, installing an app or sending ID photos triggers verification, no matter who seems to be asking.
- Save trusted numbers properly. Make sure every family member has the real phone numbers of the others saved, and that elderly parents know how to find them quickly. A number received during an emergency call is never the callback number.
- Agree on a code word. Choose it face to face, never type it in a chat, and decide that the person receiving the call is the one who asks for it.
- Name a second contact. For each person, pick someone else who can usually reach them, such as a spouse, roommate or close colleague, to confirm stories about accidents or arrests.
- Set a rule for money. Money for family emergencies goes only to the family member’s own account, or directly to an institution you have contacted yourself, never to a third party named by the caller.
- Secure the accounts that start scams. Turn on two-factor authentication for Zalo, Facebook and email for everyone, including grandparents, and remove unknown logged-in devices.
- Practise once. Run a short rehearsal. Practice turns the rule into a reflex, and under panic only reflexes hold up.
Write the rule, not the code word, on a card next to the phone: “Money request? Ask the word. Hang up. Call the saved number.”
Payment controls that protect a small business
Two people for every significant payment. Set a threshold above which one person prepares a transfer and a second approves it. The second person must check the request independently, not just click.
Bank detail changes need a phone call. When a supplier writes that its bank account has changed, call the supplier on a number from your own records or contract, not from the email, before paying.
No exceptions for seniority. State in writing that even the director’s instructions follow the process. This protects staff who would otherwise feel unable to question the boss.
A separate callback list. Keep a list of verified phone numbers for directors, key suppliers and banks somewhere other than email and chat, so a hijacked account cannot change it.
Cooling-off for new payees. Payments to a new account wait a short period or require an extra check. Most fraud depends on money moving before anyone thinks twice.
Log and review. Keep a simple record of who requested, verified and approved each unusual payment. Reviews reveal weak spots before a scammer does.
Train with real examples. Show staff examples of fake invoices, fake voice notes and fake video calls described in the news, and explain the rule they should follow instead of the clues they should spot.
Protect the finance accounts. Use passkeys or authenticator apps for banking and accounting software, limit who has access, and remove access promptly when staff leave.
Three situations and how the protocol handles them
A grandmother and a crying grandson. An elderly woman in the Mekong Delta receives a call: her grandson’s voice, sobbing, says he crashed his motorbike in Ho Chi Minh City and a man was injured; a “police officer” takes the phone and says the matter can be settled if money is sent immediately to his account. Without a protocol, fear decides. With one, the card by the phone tells her what to do: ask for the code word, which the caller cannot give; hang up; call the grandson’s saved number. The grandson answers from his lecture hall. The whole episode takes four minutes and costs nothing.
An accountant and a video call from the director. A furniture exporter’s accountant gets a Zalo video call from what looks like the director, who is known to be travelling. The picture is a little blurred, the director says he is in a meeting and cannot talk long, and asks her to transfer a deposit to a new supplier today, with details to follow by message. The company’s written rule makes her job simple: new payee plus urgent request means callback and second approval. She calls the director’s number from the internal list; he is asleep in a hotel, and his Zalo account had been hijacked overnight.
A shop owner and a remote hire. A small online shop hires a freelance designer after a short video interview. Something feels slightly off: the candidate’s face looks oddly smooth and the camera keeps freezing when he turns. Rather than accusing anyone, the owner asks for a second short call at a time she chooses, checks a previous client reference by phone, and pays the first invoice only after receiving actual work. Whether or not the interview involved a filter, the business is protected, because trust is built on verified work and references rather than on a face.
Notice that none of these outcomes depended on spotting the fake. In each case the protocol triggered on the type of request, money or a new relationship, and the verification ran through a channel the scammer did not control. That is the whole design.
Common mistakes that quietly undo good verification
Calling back the number the caller gave. If the “hospital” or “police station” number comes from the suspicious call, you will reach the scammer’s accomplice. Look numbers up yourself.
Typing the code word in a chat. Once it appears in Zalo or Messenger, anyone who later hijacks the account can read it. Change it if this happens.
Letting rank override process. Staff skip checks because the request seems to come from the boss. The rule must say explicitly that seniority is no exception.
Trusting a familiar account. A message from a known Facebook or Zalo account only proves the account was used, not who used it. Hijacked accounts are the most common starting point.
Treating a clean video as proof. Passing a visual test, such as a hand wave, does not confirm identity. Good fakes pass; only the out-of-band check counts.
Feeling embarrassed to verify. People skip the callback because it feels rude. Agreeing in advance that verification is normal removes the awkwardness.
Keeping the protocol in one person’s head. If only one family member or one manager knows the rules, they fail when that person is unavailable. Write it down and share it.
Waiting too long after a mistake. Shame delays the call to the bank, and every hour reduces the chance of stopping the money. Report first, reflect later.
When should you call the bank, the police or a specialist?
If money has already left your account because of an impersonation, call your bank’s hotline immediately and ask them to stop or trace the transfer. Then report to the police, bringing screenshots of messages, the numbers and accounts involved, and the times of calls. Do not wait to gather perfect evidence; speed matters more. Be wary of anyone who contacts you afterwards offering to recover the money for a fee, which is a common second scam.
If your social media or messaging account was hijacked and used to impersonate you, use the platform’s official recovery process, warn your contacts through other channels, and change passwords on any service where you reused the same password. If you cannot regain control, a reputable IT security professional can help check your devices for malware.
Support for businesses and for shaken family members
For businesses, involve your bank’s business relationship manager when designing payment controls; banks see fraud patterns daily and can advise on approval settings. If an incident involves customer data or significant losses, consult a lawyer about your obligations, including any duty to notify affected people under current personal data rules, rather than guessing.
Finally, if the experience has left a family member frightened or ashamed, that is a normal reaction to a crime designed to exploit trust. Talk about it openly at home; the protocol works best in families where nobody is afraid to say “I almost sent money” or “I am not sure about this call”.
Frequently asked questions
What is out-of-band verification?
It means confirming a request through a different channel from the one it arrived on, such as calling a saved number after a video call. A scammer usually controls one channel but not two.
Does my bank’s face verification protect me from deepfake scams?
It protects your account from being used by someone else, but not from you being persuaded to send money. If you are convinced by a fake relative, you will pass the face check yourself.
How often should a family change its code word?
Whenever it may have leaked, for example after being typed in a chat or used in a real emergency, and otherwise at a yearly family gathering. Changing it too often makes it easy to forget.
What payment threshold should a small business use for dual approval?
There is no universal figure; choose a level where a loss would genuinely hurt the business, and apply dual approval to any new payee or bank-detail change regardless of amount. Your bank can advise on the controls its system supports.
Is it rude to verify my boss or my parents?
Not if everyone agreed on the rule beforehand. Framing verification as protection for everyone, including the person being verified, removes the awkwardness.
Who should I contact first after a deepfake scam?
Your bank, immediately, to try to stop or trace the transfer. Then report to the police with screenshots, numbers, account details and call times.
