AI voice clones and fake documents at hotels: verifying payment and bank-detail requests

Deepfake fraud is a request for money or a record change that arrives in a form that looks and sounds genuine: a cloned voice, a fluent letter, an edited photo. The defense is procedural. Verify through a channel you already had, require a second approver, and keep a written record.

The call comes at 17:40 on a Friday. It is the owner's voice, it is urgent, and the supplier's new bank details are already in your inbox. Nothing about the request looks wrong, and that is the problem. This article walks through where fake requests land in a hotel, how to verify them, and what to do in the first hour after money has moved. Every scenario ends in the same three controls: a call-back, a second approver and a record. For background on the vocabulary, see our guide to cybersecurity terms for hoteliers: phishing, ransomware and two-step sign-in.

What has AI actually changed about fraud at a hotel?#

It changed the cost of imitation, not the shape of the trick. A fraudster no longer needs to sound wrong or write broken Turkish; a short recording and a template are enough to pass the checks hotels used to rely on.

Voice is the clearest case. A few seconds of ordinary speech, a conference talk, a television interview or a voicemail greeting give enough material for a synthetic call. A forty-second call about a transfer does not need a perfect imitation, only a familiar one.

Written text has changed just as much. Fluent, correctly addressed Turkish with the right titles, the hotel's name and a plausible invoice layout is now a commodity. Spelling mistakes were a weak signal before and are no signal now.

Images changed too. A damaged room, a bank transfer slip, a doctor's note or an identity document can be edited or generated. A screenshot proves that someone sent an image, not that the event happened.

What did not change matters more: the fraud still needs a person inside the hotel to move money or change a record. The attack targets the approval step, not the software. That is why the old checks no longer hold, checks like "I know his voice", "the letterhead is right", "it came from his own address", "the photo shows the damage". The replacement is procedural, not technical. No detection tool should be the only gate in front of a payment; treat any such tool as a filter that helps, never as the control itself.

Where in a hotel does a fake request land?#

Money and records leave a hotel through a small number of desks, and each one has a habit that a fraudster can learn from the outside.

Accounting holds the vendor master file and the payment run; a change of bank details is the highest-value request in the building. The general manager's office holds approval authority, and a message that appears to come from the owner removes the approver from the loop. Purchasing receives quotes and confirmations from suppliers it may never have met in person, so a new account number looks like ordinary business. Reservations handles deposits, group blocks and refunds, often under time pressure from a client who is "on a plane". The night desk is thin, senior cover is absent, and a request that would be questioned at 11:00 is processed at 02:00.

The most exposed person is usually the one who prides themselves on knowing the owner or the supplier well. Familiarity is the door the request walks through.

For the booking-side version of the same problem, see fake booking messages and extranet takeovers: protecting the hotel and its guests.

How do you verify a request you cannot trust?#

Verify through a channel you already had, never the one the request arrived on. If it came by email, call the number in your supplier file; if it came by phone, confirm through the portal or the address on the contract.

The principle is simple: the fraudster controls the channel he opened. A caller ID, a reply-to address, a messaging profile photo and a letterhead are all things he sets before he contacts you. "Already had" means a number or address recorded before the request existed, ideally in the contract or the vendor master file, and read out by a second person.

Keep a verified contact list per supplier and per bank, with the date each entry was last confirmed in writing. Confirm the list once a year, not once per request.

Deadlines deserve their own rule. A stated deadline is the attack, not the context. Write into your policy that a deadline is a reason to slow down, and that no one is criticised for missing a payment window because a verification was pending.

On the call-back, ask the supplier to state their account holder name and IBAN from their side. Never read the new number back and ask "is this correct?", because a fraudster will simply say yes. If the call-back cannot be completed today, the request waits. A payment made a day late is a conversation; a payment made to the wrong account is an incident.

For a broader set of checks, see our hotel cybersecurity checklist for owners and general managers.

How do you handle new bank details from a supplier or a tour operator?#

Treat every change of bank details as if the supplier were new, whatever the letterhead says and whoever appears to have signed it.

Call back on the number in your file. If the named person cannot be reached, the change waits; a message asking you to use a mobile number "because the office line is down" is itself the warning. Require two approvers, and neither of them is the person who received the request: the receiver prepares, someone else confirms.

Write the record: who called, which number was dialled, when, what was said, who approved, and where the old details were archived. Do not delete the old details; mark them superseded with a date, so a later "correction" has something to be compared against. Watch the second act as well: after a genuine change, a fraudster may send a quiet correction a week later, when the file is no longer being looked at.

The mirror case matters as much. A tour operator or agency asking the hotel to change the account its deposits are paid into is the same request from the other direction, and it deserves the same routine.

What do you do with an urgent transfer call from "the owner"?#

A transfer approved by voice alone is not approved. The voice is identification at best, and identification is no longer evidence.

The pattern is stable: the call comes when the owner is travelling, late in the day, on a poor line, with a reason not to call back, such as "I am in a meeting, just do it". The general manager's office is not exempt from this routine; the person who can approve is exactly the person the fraudster is trying to reach.

Agree a code word or shared phrase in person, change it periodically, and never write it in email or a messaging app. Set a waiting rule with the owner in advance, in writing: above a stated amount, a transfer needs confirmation through a second channel even when the owner is the one asking.

Then call the owner back on the number you already hold, not the one on the screen, and be willing to say out loud that you are doing it because of a rule. Design the rule to protect the staff member, not only the money. Someone who is punished for delaying an owner's request will not delay the next one.

What do you check in photos and documents sent with a complaint or a refund claim?#

Check the claim against your own records before you check the image. A document proves that someone produced a document; your own system proves what happened at the hotel.

What gets faked: a damaged room photo, a medical note, a police report, a bank transfer slip, an identity document, a signed cancellation letter. The checks that still work: does the room, date, guest name and bill match your records; does the document number exist in the issuing system; can you reach the issuer on a number you already hold.

File metadata is weak evidence in both directions. It can be stripped, altered or simply absent after a normal share, so do not build a decision on it. Keep the file exactly as received, unedited, together with the message it arrived in; an edited copy is worth much less later.

Two payment rules close this section. Refunds go back to the original payment instrument; a request to send money to a new account supplied inside the complaint is a different request and needs the full supplier routine. And a bank transfer slip is not a payment: the money is confirmed by your own bank statement, not by an image of a slip.

If the complaint involves personal data or AI-generated material, our reading of KVKK's generative AI guide for hotels explains what the regulator covers and what to take to your adviser.

What should happen in the first hour after a suspected fraud?#

Stop the money, keep the evidence, then report, in that order. The internal investigation can wait an hour; the bank cannot.

Call the bank immediately and describe the transaction. The bank decides what can be stopped or recalled; this article does not promise that anything can be recovered. Do not format or wipe the affected phone or computer. The Cyber Crime Department of Türkiye's General Directorate of Security advises against it, and for an attacked company server it advises having IT staff export all event logs for the attack period (EGM, Siber Suçlarla Mücadele Daire Başkanlığı FAQ (opens in a new tab), 2026).

For bank and card cases, the same guidance says to obtain the statement of the suspicious transactions from the bank first. Then report. The EGM states that legal action needs a personal application by the victim, with a signed petition describing the crime, taken by hand to the police station responsible for the place where the crime was committed, the Chief Public Prosecutor's Office for that place, or a Cyber Crime Branch. A scanned petition sent by email is not the route. For offences prosecuted only on complaint, an individual application is required; confirm how your own case is classified with a legal adviser.

Write the internal record while it is fresh: timeline, who spoke to whom, what was paid, what was changed in any system, what was restored and when. This article does not decide liability, bank refunds or the outcome of a complaint; those belong to the bank, your counsel and the authorities.

What to do next#

Write the two rules this week, before the next request arrives: a call-back to a number you already hold, and a waiting rule with a code word that applies to the owner too. Every scenario in this article is the same rule applied at a different desk, and the record you keep is what turns a suspicion into something your bank, your counsel and the authorities can act on.