Why this matters
A bookkeeper gets an urgent email from a vendor she knows: "we changed banks, pay today to the new account." Then a voicemail that sounds like the owner says the same thing. AI makes the email flawless and the voice easy to fake, so it no longer looks like a scam.
The money is usually gone once it is sent. The fix is not better detection. It is a habit that does not depend on how convincing the message is: call back on a number you already have, have a second person approve any bank change, and slow down when it is urgent. Claude is useful for the check and for writing the policy, but the phone call is yours.
Practice
Do every step yourself in a practice copy of the real tool. It checks your work, and “Do it for me” finishes any step you get stuck on.
What you’ll build
You are Priya, bookkeeper at Harbor & Pine Bookkeeping (made up). A vendor email with new bank details arrives, and a voicemail backs it up. You paste both into a new Claude chat as text and read the red flags.
Then you keep three verify-before-you-pay rules, and ask Claude for a one-page Vendor Bank Change Policy with a callback log and a short staff alert.
What you need
- Nothing to start the practiceClaude is a practice copy, and the fake email and voicemail are ready to paste.
- The fake email and voicemail transcript, to try it on your own accountDownload it below. It is made up, with fake bank numbers. The voicemail is typed text.
- A Claude account, to do it for realclaude.ai. The free plan is enough. Use a new chat, on your own account.
- No real vendor detailsNever paste real account numbers, and never clone a real person's voice to practice.
Concepts
A convincing message is not proof
Scammers now use AI to write clean, personal emails and to copy a voice from a few seconds of audio. The tells are no longer typos. They are the shape of the request: changed bank details, urgency, a threat, no way to call, and a second message pushing the same thing.
In our test, Claude named all five and called it a textbook vendor-impersonation scam. It also pointed out that the voicemail does not confirm anything: two channels pushing the same request is a tactic.
Three rules that do not depend on spotting the fake
Call back on a number you already have, from an old invoice, your vendor file or their website, never the one in the email. Do not reply to the email to check, because a scammer will simply confirm.
A second person approves any change to bank details, and the person who made the callback cannot be the only approver. Slow down when it is urgent: a real vendor accepts a one-day delay.
Let Claude write the policy, then you decide
Ask for a one-page Vendor Bank Change Policy built on the three rules, with a blank callback log (who called, number used, date, time), and a short staff alert. In our test Claude put the policy in a document panel and wrote the alert in the chat.
Read both and edit them for your office. Claude drafts, you decide, and you send the alert yourself.
Do it for real
Now repeat it in your own account. Tick each step as you go.
Downloads
- Fake bank-change email + voicemail, rules and callback log (.txt)The made-up email and voicemail, the three rules, the follow-up request and a callback log.
Quick check
3 questions to check you’ve got it.
1. A vendor email says "we changed banks, pay today" and a voicemail in your boss's voice agrees. What do you do?
- Pay, since two messages agree
- Call the vendor on a number you already have, and get a second person to approve the change
- Reply to the email to confirm
Show the answer
Call the vendor on a number you already have, and get a second person to approve the change. Two messages can both be fake. A callback on a known number and a second approver do not depend on how convincing the message is.
2. Which phone number do you call to verify a bank change?
- The number in the email
- The number in the voicemail
- A number from your own files, such as an old invoice or their website
Show the answer
A number from your own files, such as an old invoice or their website. A scammer controls the numbers in their own messages. Use one you already trust.
3. Claude says the email has red flags. Can you skip the phone call?
- Yes, Claude checked it
- No, the callback and second approval are the real protection
- Only if the amount is small
Show the answer
No, the callback and second approval are the real protection. Claude can miss things or be wrong. It helps you check and write the policy, but the verification is a call you make.
Connect your tools: Google Drive, Gmail and Calendar
You can check a payment request and have a policy for it. Next, see what an AI assistant can reach when you connect your Drive, Gmail and Calendar, and keep that reach as small as the job needs.
Start module 5 →