It sounded like the boss. That should not be enough to move the money.

Imagine being asked to question a voice you recognize, apparently giving you an urgent instruction. That is not a fair place to put the entire burden of a company's financial security. A payment process should work even when a convincing conversation turns out to be false. In a November 5 announcement, US prosecutors alleged that three defendants participated in an impersonation scheme that stole more than $129 million from companies. The alleged use of generated executive voices and images sits at the center of the case. The charges are accusations, and the defendants are presumed innocent unless proven guilty. The release's use of the term super intelligence does not establish a technical capability level; AI-enabled impersonation is the supported description. The practical lesson is not that employees should become perfect deepfake detectors. The FBI's existing guidance recommends independently verifying a caller through a contact obtained separately. That principle is useful because a convincing voice or picture should not be the same thing as authorization. Our recommendation is to connect it to a routine payment process: independently confirmed instructions, a second authorized reviewer where appropriate, and a protected way for staff to pause an unusual request. There is an organizational consequence here. If people are praised for responding instantly but punished for questioning apparent authority, a security policy may exist only on paper. Conversely, excessive checking can delay legitimate work, so controls need to be designed around consequential transactions rather than every conversation. The court process will determine the allegations. Organizations do not have to wait for that outcome to ask whether their own approval rules rely too heavily on familiarity, urgency or hierarchy.