Welcome to the age of AAA. Authorization, authentication and auditing. Where every action, whether over the phone, internet, or video chat needs to be verified externally with some kind of AAA system before that action can be verified and performed.

In this case, calling them back on a known phone number to verify their intent, or pushing a code to them over text or a third party authorization system (like duo or something) is required before action is taken.

IT and security folks have been preparing for this shit since before AI deepfakes were a thing. The general public, thus far, has not appreciated the extra security we have been requiring and at many levels, they've actively and even publically spoken out against it, or outright refused to participate.

You are vulnerable.