Payroll Diversion via Deepfake Audio Call — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 30, 2026

Severity: HIGH | View Full Scam Details

Payroll Diversion via Deepfake Audio Scam in India 2026: A Rising Threat on WhatsApp

In 2026, Indian organisations face a high-risk fraud pattern where scammers use deepfake audio calls to trick HR staff into diverting payroll payments.

What Is the Payroll Diversion via Deepfake Audio Call?

This scam targets companies’ payroll departments by exploiting trust within internal communication channels. Fraudsters create artificially generated voice recordings—or “deepfakes”—that sound convincingly like senior executives or trusted colleagues. They then use these fake audio calls to instruct HR personnel to reroute employee salaries into fraudulent accounts.

In India, this scam is emerging due to increased adoption of AI voice synthesis technologies combined with the widespread use of WhatsApp and phone calls for workplace communication. Scammers gather voice samples from social media profiles such as LinkedIn and sometimes from leaked data to craft their deepfake calls. These calls often coincide with the urgent payroll processing period at month-end, pressuring HR employees to respond quickly without verifying identities.

While exact figures on this scam remain hard to confirm, cases reported to Indian cybercrime cells and platforms like the I4C (Indian Cyber Crime Coordination Centre) suggest it is growing rapidly. CERT-In has included alerts about impersonation frauds and deepfake abuses in their advisory bulletins, warning Indian organisations to strengthen verification protocols.

How This Scam Works — Step by Step

1. Voice Sample Collection: Fraudsters collect publicly available audio or video clips of company executives or HR staff from LinkedIn, YouTube, or leaked conversation repositories.

2. Deepfake Audio Creation: Using AI voice synthesis tools, scammers create a realistic-sounding voice message that mimics the targeted person’s tone and speech patterns.

3. Initial Contact via WhatsApp or Phone Call: The caller impersonating the executive initiates a WhatsApp voice or traditional call to HR, claiming an urgent payroll change.

4. Urgent Payroll Diversion Request: The deepfake voice instructs the HR employee to change the salary payment Aadhaar-linked bank account or UPI ID to a new account (controlled by the fraudsters), citing an emergency or new policy.

5. Psychological Pressure: The caller uses stress tactics—demanding confidentiality, warning of consequences if the change is delayed, or invoking fake approvals from top management.

6. HR Compliance and Fund Transfer: Under pressure, the HR staff modifies payroll instructions and transfers funds, which are then quickly withdrawn or moved through multiple accounts, making recovery difficult.

7. Delay in Detection: Victims only realize the fraud after employees report non-receipt of salaries or after reconciliation issues appear, by which time the money is often unrecoverable.

Real Warning Signs to Watch For

• Unsolicited voice calls demanding urgent payroll changes, especially near payday.
• Unverified requests asking to change bank accounts or UPI IDs for salary credit.
• Calls insisting on secrecy, refusing to provide written confirmation or email trails.
• Voice that sounds slightly “off” or robotic despite high similarity to known executives.
• Pressure tactics mentioning fake deadlines or consequences for delays.
• Requests that bypass regular approval hierarchies or internal procedures.
• Message or call coming from new or unknown phone numbers, even if on WhatsApp contact list.

What Happens to Victims

When payroll diversion scams succeed, companies face direct financial losses running into lakhs or crores of INR. Employees affected by missed salary payments encounter personal financial distress, such as inability to pay rent, EMIs, or daily expenses. In India’s context, reversal of fund transfers via UPI or bank systems is often difficult once processed, especially if the fraudsters quickly withdraw cash or transfer funds to multiple accounts.

Victims may also experience emotional stress and loss of trust within their organisation. The scam can lead to investigations by internal audit and regulatory authorities, causing business disruption. In some cases, Aadhaar-linked bank accounts used for diversion have faced wider identity misuse or linked SIM swap frauds, aggravating the damage.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) has issued guidelines emphasizing strict verification processes for digital payments and company payroll transfers. RBI’s warnings on phishing and impersonation frauds highlight the need for multi-factor authentication and transaction monitoring.

CERT-In has included voice-based scams and AI-synthesized deepfakes in their cyber threat advisories, urging organisations to implement employee awareness programs and validate any unusual requests through multiple channels. The Cybercrime Helpline 1930 also encourages victims to report such incidents immediately to aid timely investigation.

Additionally, I4C (Indian Cyber Crime Coordination Centre) promotes collaboration between corporates and law enforcement to tackle AI-driven financial fraud and recommends continuous monitoring of social media leaks that enable voice cloning.

How to Protect Yourself

1. Always verify any payroll change requests through multiple trusted channels, such as official email or in-person confirmation.
2. Do not rely solely on voice calls or WhatsApp messages for urgent financial instructions.
3. Implement strict multi-level approval workflows for salary account updates.
4. Train HR and payroll teams about deepfake and phishing scams regularly.
5. Restrict sharing of internal audio or video content on public platforms that can be used for voice cloning.
6. Use official company communication apps with enhanced security features rather than personal WhatsApp numbers.
7. Report suspicious calls immediately to your IT or security department and preserve all related call/audio records.

What to Do If You've Been Targeted

• Immediately inform your company’s cybersecurity or HR department.
• Freeze the affected bank accounts or UPI IDs through your bank or payment app right away.
• File a complaint at the national cybercrime portal (cybercrime.gov.in) under financial fraud.
• Call the 1930 cybercrime helpline for guidance and assistance.
• Report the incident to RBI helpline if related to payment systems.
• Do not try to negotiate or transfer money further without expert advice.
• Keep all proof such as WhatsApp chats, call recordings, and bank statements ready for investigations.

Frequently Asked Questions

Q: How can I tell if a voice message is a deepfake?
A: While deepfakes are improving, subtle glitches such as unnatural pauses, robotic tone, or mismatched lip movements on video can be clues. Verification by cross-checking through a different communication method (like email or direct face-to-face) is always recommended.

Q: Can UPI transactions be reversed if money is sent to fraudsters?
A: Generally, UPI payments are instant and irreversible. However, if reported quickly, banks may block accounts and assist in recovery efforts depending on circumstances, so timely reporting is critical.

Q: Is WhatsApp safe for official payroll communication?
A: WhatsApp offers end-to-end encryption but is not designed for secure official payroll processing. Use dedicated, secure organisational communication tools and payment approval workflows to reduce risks.

Ensure you verify any suspicious message or call related to payroll or payments on BharatSecure.app and report fraud attempts immediately at the 1930 helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.