Short answer: AI voice cloning can copy a voice from a few seconds of audio — a voicemail greeting, a podcast clip, a social video — well enough to fool the people who know it best. The scam is the old "urgent request from the boss," upgraded with the boss's actual voice. Technology can't reliably detect it; process beats it.
How an AI voice cloning scam runs
An employee gets a call — the owner's voice, stressed, plausible: a vendor needs a wire before a deadline, a deal needs gift cards, a payroll change can't wait. The voice is right, the caller ID may be spoofed too, and the request always carries urgency plus a reason not to double-check. Variants target family businesses, bookkeepers, and anyone with payment authority.
Why your ear can't be the control
Cloned voices have gotten too good; under pressure, on a phone line, detection-by-listening fails routinely. Treat the voice as unverified, no matter how familiar. The defense has to live in procedure, not perception.
The controls that actually work
- Out-of-band verification, always. Any request to move money or change payment details is confirmed on a separate channel — call back the known number, or confirm face to face. The rule holds for the CEO, especially for the CEO: urgency plus secrecy is the fraud signature.
- A family/team code word. Low-tech and effective: a phrase the real person can produce that no clip of their public audio contains.
- Payment authority limits. Two-person approval above a threshold means one convincing phone call can't move real money alone.
- Brief your front line. The people who answer phones and pay invoices should hear about this scam from you before they hear the cloned voice. Pair it with business email compromise training — the two frauds travel together.
Reduce the raw material where it's easy
You can't unpublish an owner's speaking clips, but you can trim obvious sources: replace personal-voice voicemail greetings on finance lines and keep internal announcement recordings off public channels where practical. Treat it as reducing convenience for attackers, not as a primary defense.
If your business gets a suspicious call
Hang up; verify on the known number; if money moved, call the bank's fraud line immediately and report to the FBI's IC3. Then tell the whole team what the attempt sounded like — the second target hears it coming.
We cover deepfake-era fraud in our security training and layered defenses — see cybersecurity services or the free AI security assessment.
Frequently asked questions
Can AI really clone a voice from a few seconds of audio?
Yes. A voicemail greeting, a podcast clip, or a social video gives an attacker enough audio to produce a clone good enough to fool the people who know the voice best. Under pressure, on a phone line, detection by listening fails routinely, so treat any voice as unverified no matter how familiar.
How do you verify a caller is really your CEO?
Use out-of-band verification, always: confirm any request to move money or change payment details on a separate channel, by calling back a known number or confirming face to face. A team code word — a phrase no clip of public audio contains — and two-person approval above a payment threshold add further backstops.
Does caller ID prove who is calling?
No. Caller ID may be spoofed alongside the cloned voice, so neither the number on the screen nor the sound of the voice verifies a request. The fraud signature is urgency plus a reason not to double-check; the defense lives in procedure — hang up and call back the known number.
Sources and further reading
- FBI Internet Crime Complaint Center (IC3) — where these crimes are reported and tracked nationally.
Turn insight into action.
Take a free cybersecurity or AI readiness assessment, or book a call with a NetSys engineer — no obligation, no runaround.