Bendigo Bank began deploying a voiceprint fallback for Bendigo Business Online payroll approvals after fraud investigators documented cases in which finance staff approved batched transfers while on active phone calls with synthetic voices mimicking directors, exploiting moments when hardware security keys failed or were left in home offices during hybrid work weeks.
What broke
Business banking fraud teams reviewed fourteen payroll incidents since May in which approvers authenticated with passwords and one-time codes but lacked a working FIDO key at the moment a scammer insisted “payroll had to clear before the banks closed.” In six files, callers spoofed Bendigo switchboard numbers and recited partial ABN and account details harvested from earlier phishing. Victims clicked approve on pending batches because the session already looked legitimate inside the browser.
Bendigo’s response pairs existing device binding with optional voiceprint enrollment: when a key is absent, the portal prompts the approver to read a rotating phrase into the laptop microphone, matching a template captured during in-branch or video-assisted onboarding. The bank said voice biometrics are not a replacement for keys—keys remain mandatory for high-value beneficiary adds—but they add a liveness check when approvers travel without tokens.
Who is liable
Australian Financial Complaints Authority guidance still treats multi-factor approval as strong customer authentication when devices are under customer control. Bendigo argues voiceprint plus device fingerprint restores informed consent; plaintiff firms counter that banks should block payroll releases whenever telemetry shows concurrent calls to known scam ranges. The pilot will feed AFCA test cases expected after ASIC’s quarterly deepfake scam updates.
Payroll bureaus using delegated access said they need clarity on whether voice enrollment travels with individual users or firm-level credentials. Bendigo told partners that each named approver must enroll separately and that bureau staff cannot substitute phrases on behalf of directors.
Why keys alone were not enough
Regional businesses adopted security keys aggressively after 2024 credential-stuffing waves, but key loss and shared finance desks created predictable gaps. Bendigo’s fraud unit said hybrid rosters mean approvers sometimes begin sessions at home without keys, then take scam calls on mobile while the browser session stays open at the office.
Competitors have emphasized payee name-matching and callback policies rather than voice-aware step-ups. Bendigo’s rollout targets firms with more than fifty employees and weekly payrolls above $250,000, though the bank said it will extend enrollment to agribusiness seasonal payrolls if decline rates stay manageable.
What Bendigo will measure
The bank will track false rejection rates on voice challenges, time added to approval workflows, and quarter-on-quarter drops in “CEO urgency” scam reports tied to payroll batches. Early data remain internal; Bendigo Business Online serves tens of thousands of Australian SMEs, giving the pilot a broad denominator.
ASIC has asked majors for updates on synthetic-voice fraud since Westpac’s 2026 warnings. Bendigo’s experiment may influence whether regulators mandate call-aware authentication for business banking or treat voice scams as purely education problems.
Practical defenses
Relationship bankers are telling clients to establish verbal passphrases for any phone-initiated payroll change and to hang up if a caller stays on the line during approvals. Bendigo help pages reiterate that actionable batches should match internally initiated workflows; anything else is a deny-and-callback event using the number on the back of the business card, not caller ID.
Voice cloning tools remain legal for many commercial uses, so Bendigo is not betting on voice alone. Slowing the last mile—forcing a liveness phrase while a scammer is still talking—buys doubt long enough for approvers to compare payee lists against the genuine payroll register.
Until enrollment closes, Bendigo said it will review reimbursements where call metadata and approval timestamps show clear impersonation, preserving goodwill while lawyers debate how much friction regulators will ultimately require for SME payroll rails.
Accountants advising family companies urged directors to split approver roles so no single voiceprint gates an entire payroll run. Bendigo’s fraud desk echoed that advice, noting that synthetic callers target the one person who both answers the phone and holds signing rights—a pattern voice biometrics can slow but not erase without governance changes at the board table.
Telecommunications providers said they are testing network flags for calls that spoof major bank numbers, but coverage remains patchy outside capital cities. Until carriers block those routes reliably, Bendigo’s voiceprint layer is the bank’s primary lever on the approval screen itself.
