Deepfake Voice Scams: How to Stop a Fake Boss From Moving Your Money
A caller who sounds exactly like the owner asks the bookkeeper to wire money right away, and to keep it quiet. Until recently that call would have been easy to doubt. Now voice cloning software can copy a voice from a short recording, such as a voicemail greeting, a video or a conference talk. Scams that used to arrive as a fake email can now arrive as a phone call from someone who sounds like your boss.
How the voice cloning scam works
This is a new version of an old fraud called business email compromise. The pattern stays the same:
- Research. The scammer learns who is in charge, who handles payments and how the company talks, from your website, social media and public records.
- Contact. An email, text or phone call arrives that appears to be from a manager, an owner or a vendor, often during a busy or travel period.
- Pressure. The request is urgent and confidential: pay this invoice today, change the bank account on file, buy gift cards, send a copy of the payroll file.
- Move the money. Once a wire or transfer is sent, getting it back is difficult and the chance falls quickly with each hour.
The FBI’s Internet Crime Complaint Center reported about $2.8 billion in losses from business email compromise in 2024, one of the costliest kinds of online crime it tracks. The FBI has also warned that criminals are using AI-generated voice messages to impersonate trusted people. These are reported losses, so the real figure is likely higher.
Why it works
The scam works because it exploits trust and urgency, not technical weakness. People want to be helpful to the boss, they do not want to question a request, and a familiar voice feels like proof. Hearing something is no longer enough to confirm who is speaking.
Rules that stop it
You cannot reliably spot a cloned voice by listening, so protect yourself with process. These rules work whether the fake arrives by email, text, phone or video:
- Verify by a second channel. Any request to send money, change bank details or share sensitive data is confirmed by calling the person back on a number you already know, not the number that called or the one in the message.
- Require two people for payments. Set a threshold above which a second person must approve, and make sure that rule applies to the owner too.
- Treat bank detail changes as high risk. If a vendor says their account has changed, confirm using a known contact before changing anything.
- Slow down on urgency. A request that insists you must not tell anyone, or must act in the next hour, is a warning in itself.
- Agree on a verification phrase for emergency requests that come by phone, known only to the people who need it, and change it if it may have been exposed.
Write these rules down, tell everyone including the owner, and make it clear that nobody will be criticized for checking. The person who calls back and says “I just wanted to confirm” should be thanked, even if the request was real.
Reduce what scammers can use
Think about what is public. A voice sample from a video, a list of who handles payments, or an out-of-office message that says the owner is traveling all help an attacker. You do not need to disappear, but review what your website, social media and email auto-replies reveal, and be careful with automatic replies that name who is away and for how long.
Protecting your email accounts also matters, since many of these scams begin with a stolen mailbox. Use multi-factor authentication, ideally with phishing-resistant methods, as described in our post on moving beyond SMS codes. Protect your domain from being impersonated, as covered in how to stop scammers from sending emails in your company’s name.
If it happens
Act within hours. Call your bank right away and ask for a recall or a hold on the transfer, then report it to the FBI through ic3.gov, to your insurer, and to your IT provider. The faster the bank is told, the better the chance of recovering funds. Keep the messages, numbers and any recordings.
How we can help
Protecting email accounts and helping your team recognize scams are part of our cybersecurity services, and our consulting services can help you put payment rules like these in writing. A free security review is a good first look at who can get into your systems and how your accounts and passwords are protected.
Frequently asked questions
Can a cloned voice really fool people?
Yes. Modern tools can produce a convincing copy of a voice from a short sample, and many people cannot tell the difference, especially on a phone call under pressure. Verification rules protect you even when the voice sounds right.
How can we tell if a call is a deepfake?
Often you cannot. Odd pauses or a strange tone may be clues, but do not rely on them. Hang up and call back on a known number before you act on any request involving money or sensitive information.
What is a safe way to verify a payment request?
Call the person using a number from your own records, not the number in the message, and confirm the amount, the recipient and the reason. For vendor bank changes, use contact details you already had on file.
Does multi-factor authentication stop these scams?
It stops many of the account takeovers that feed them, but it cannot stop someone from being talked into sending money. You need both protected accounts and payment verification rules.
What should we do first if we lose money to a scam?
Call your bank immediately to try to recall the transfer, then report it to the FBI’s Internet Crime Complaint Center at ic3.gov, your insurance carrier and your IT provider.