AI-Generated Identities: How Can Businesses Verify Who They're Really Dealing With?

A supplier's photograph, a recognisable voice and an apparently routine email can all make a request feel trustworthy. None proves that the person making it has authority to change your payment instructions. As synthetic media becomes easier to produce, businesses need verification procedures that work even when a message looks and sounds convincing.

The UK Government's Stop! Think Fraud business guidance warns that criminals can use AI to create realistic fake documents and impersonations. This article considers the business controls, rather than repeating an unverified personal incident or claiming that every suspicious profile is fraudulent.

Impersonation has more than one channel

AI-generated profile images can support a fabricated identity. Voice cloning can make a call sound familiar. Synthetic video can make an online meeting appear more credible. Email impersonation may use a lookalike domain, an altered display name or a genuinely compromised account. Executive impersonation and supplier payment fraud can combine these methods.

The objective may be money, access to confidential information or a change to an account's security settings. A request does not have to be technically sophisticated to succeed: urgency, authority and an apparently familiar context can be enough to discourage checks. AI can strengthen the presentation without changing the basic need to verify the request.

Why familiarity is not verification

Recognising a voice establishes only that the voice seems familiar. Seeing a face establishes only what the video shows. A genuine email thread can be hijacked after an account compromise. Several convincing signals may all come from the same attacker-controlled channel, so they are not necessarily independent evidence.

Do not make staff responsible for reliably spotting tiny visual or audio defects. Those clues can be misleading, and a poor connection can affect genuine calls. Instead, define which business actions require a separate check regardless of how plausible the caller appears. Applying the procedure consistently also makes it easier for staff to challenge a senior person's request.

Make payment changes independently verifiable

Keep verified supplier contact records, with controlled changes to those records. For a new bank account or unusual payment, call a known contact using a previously verified number, not the number in the change request, attachment or email signature. Confirm the specific change and record who performed the check.

Use dual authorisation for sensitive payment changes and higher-risk transactions. One person checks the request; another approves within an agreed limit. Both should see enough information to make a genuine decision. Where available, use bank-provided payee checks as an additional signal, not as a replacement for verifying a suspicious instruction.

Apply similar controls to password resets, new administrative access and requests to export sensitive data. A caller who knows an employee's job title or manager should not automatically pass a helpdesk identity check. Provide a clear escalation route when a request cannot be verified.

What email authentication does—and does not—do

SPF specifies which systems may send mail for the relevant sending domain. DKIM applies a cryptographic signature that receiving systems can check. DMARC uses alignment with the visible From domain, an SPF or DKIM pass and a published handling policy, with reporting to support oversight. They address particular domain-spoofing risks.

They do not prove that a named person wrote the message or that an invoice is legitimate. A lookalike domain can authenticate its own messages. Mail sent from a compromised legitimate account may pass checks. Anti-phishing protection, suspicious-link analysis and well-configured mailbox controls provide additional layers, but cannot remove every impersonation risk.

Our DMARC guide explains deployment and monitoring. Authentication needs to be introduced carefully so that legitimate business senders are identified and tested before enforcement is tightened.

Protect accounts and support the people using them

Use MFA for business accounts and privileged administrators, minimise unnecessary permissions and review sign-in anomalies. Prefer phishing-resistant authentication where suitable and supported. Review suspicious forwarding rules and application permissions as part of an account-compromise investigation. A protected mailbox helps, but it does not validate every payment request received by telephone.

Train staff on the procedure, not just the threat. Give finance, sales and helpdesk teams examples of requests they should pause, and make prompt reporting safe and straightforward. A practical exercise can use clearly authorised fictional records without contacting real suppliers or initiating payments. Observe whether staff use trusted contact records and record approval properly.

What to do when something looks wrong

Stop the action, report it through the agreed internal route and preserve the original message and relevant records. If money may have been sent fraudulently, contact the bank promptly using a trusted channel. If credentials or accounts may be compromised, involve the responsible IT team to contain access and investigate without unnecessarily destroying evidence.

Review the process afterwards: were supplier contacts current, could staff find the escalation route, and did the approval record show an independent check? Altitude IT can review email and identity controls alongside these operational safeguards through an agreed independent assessment. Technology supports verification; it cannot replace clear authority and a process people can follow.

Primary sources

UK Government: protecting your business from fraud; NCSC email security and anti-spoofing guidance. Checked 2 November 2026. No unverified individual incident is used.