.png)
How to Protect Your Business from AI Voice Scams
Article Summary: AI voice scams use copied voices to impersonate owners, colleagues, or suppliers. A familiar-sounding caller may ask your team to send money, change bank details, or share a sign-in code. Confirm these requests through a number you already trust, and keep the usual approval checks in place even when the caller sounds like the boss.
Would your team question a payment request if the caller sounded exactly like you?
Your employees may speak to you every day and be used to taking instructions over the phone. If you’re away from the office, a call about an invoice might seem normal.
But a scammer using a copy of your voice could call your bookkeeper and ask them to change a supplier’s bank details, claiming you’d already approved it.
Before your bookkeeper makes that change, they need to check that the request really came from you.
How scammers can copy your voice
If you’ve posted a video on your website or appeared on a podcast, a scammer could use that recording to copy your voice. With voice-cloning software, they can create a new message that sounds like you’re saying it. Even a short recording can be enough to clone someone’s voice.
The FBI’s guidance on AI-enabled fraud describes criminals using AI-generated audio to impersonate trusted people and obtain payments. It also warns about fake video calls involving supposed company executives.
An awkward pause or unusual wording might make you suspicious. But if a caller sounds convincing, your team still needs to check a request involving payments or account access.
Caller ID and contact numbers
Scammers can make a call appear to come from someone else’s number, so recognizing the number on your screen isn’t enough to know who’s calling. You might also hear, “My usual phone isn’t working. Call me on this number instead.” Use a contact method you already trust to check whether they’ve changed numbers. Otherwise, you could end up asking the scammer to confirm their own instructions.
Checking payment requests
If a supplier asks you to use a different bank account, your employee can say, “I’ll call our usual contact to confirm that before I change the details.”
Apply the same checks to an unexpected request to send money, even if the caller knows the supplier’s name and the invoice amount.
End the incoming call and find a trusted contact number. Use your staff directory or supplier records. Don’t take the number from the message or invoice you’re checking.
Confirm the request with the real person. Ask whether they requested the payment or bank change, then check the amount, recipient, and account details.
Record what was confirmed and complete the normal approval process. Keep the confirmation with the payment record so whoever authorizes it can see how you checked the details.
A follow-up email from the caller doesn’t replace those checks. The message could come from a look-alike address or a supplier account someone has hacked. If you reply to check the bank details, the scammer could be the person answering.
If you can’t confirm the details, don’t send the payment yet. Your employee needs someone in the business to contact for help if the caller insists on an immediate payment or asks them to keep it secret.
When a caller says you’ve already approved the payment
If you approve payments, staff may be used to treating your approval as enough to proceed. A scammer impersonating you could claim you’ve already spoken to the supplier and checked the new bank details.
Your employee should still call the supplier to confirm the change, even if the caller says you’ve already done it.
For payments that need two approvals, include the callback confirmation in the record the second approver receives. Otherwise, both people could approve the request without either checking who made it.
If you’ve got enough people to split the work, one person can update the bank details and someone else can approve the payment. Your bank can explain whether you can set up separate approvals on your business account.
And if you’re the only person making payments, you can still call the supplier to confirm new bank details before you use them.
If a bill is due while you’re unavailable, your team needs to know who else can approve it and what that person can authorize.
Checking who’s asking for an account reset
If your phone is used to approve sign-ins, losing it may leave you unable to get into your email or other work accounts. You’d need IT’s help, and they’d need another way to confirm it was you before changing how you sign in.
Someone impersonating you could call with the same story. The Australian Cyber Security Centre warns that copied voices can be used to trick help desks and people who approve access.
So when you next speak to your provider, you could ask, “If I lost my phone and called for help, how would you check it was me?”
Talk through how you’d prove who you were without that phone and who would need to approve the reset. They shouldn’t be relying only on your voice or the number on their screen.
An employee might also get a call from someone claiming to be your IT provider. They can say, “I’ll check with the support desk first,” then use the support number they already have or contact your provider through the usual support portal.
Staff should keep sign-in and password-reset codes private and decline any login request they didn’t start, even if a caller says it’s to fix a problem. The FBI warns that scammers ask for these codes to get into accounts.
How to help staff check a suspicious call
It can feel awkward to tell your boss you need to check what they’ve just asked you to do, especially if they’re in a hurry.
You could tell your team, “If someone calls and sounds like me, I still want you to check any new payment details before you use them. I’m happy to wait while you do that.”
If an employee then calls you back to confirm a real request, thank them for checking.
You could try a practice call with whoever handles invoices or account resets. Let them show you where they’d find the right number, and talk through what they’d do if the caller insisted there was no time to check.
Someone covering for your bookkeeper may not know which supplier contact to call. They’ll need the same contact list and instructions as the person they’re replacing.
When someone reports an attempted scam, you can warn the rest of the team, even if nobody has sent money or shared any information.
What to do if someone has already acted on a scam call
If money has been sent, contact your bank or payment provider immediately. Explain that the payment was fraudulent and ask whether it can be stopped or recalled. Don’t wait until you’ve finished investigating, and don’t assume recovery will be possible.
If someone shared bank login details or other financial information, tell your bank exactly what was given out and follow its advice. The Australian Cyber Security Center advises contacting your bank immediately after sending money or banking details to a scammer.
Your IT provider will need to know what happened during the call. If an employee approved a sign-in because the caller said they were fixing their email, tell IT which account was involved and roughly when it happened.
Keep the payment instructions, messages, recipient details, call times, and any existing voicemail or recording. It also helps to write down what was said while the employee can still remember the details.
Let the person or supplier know someone has been pretending to be them. They may need to warn other contacts. Report the incident through the relevant police or fraud-reporting service in your country. If you shared personal or confidential information, get advice on whether you need to notify anyone else.
Frequently Asked Questions
Can someone copy my voice without hacking my phone?
Yes. A recording from a video or podcast you’ve posted could give them the audio they need.
Should I remove every video that includes my voice?
Deleting a video won’t remove copies someone has already saved. You can reduce what you share publicly, but your staff still need to verify payment changes and account requests.
What if the supplier really has changed their phone number?
Call the supplier’s main office using details from your existing records, or contact someone else you already know there. Ask to speak to someone authorized to confirm the new phone number and payment details. Don’t change the bank details until you’ve confirmed both.
Review the process with your IT provider
Your IT provider and whoever handles payments can walk you through the process, from the call to final approval. You can check where the contact details come from, how the request is confirmed, and who can help when the usual approver isn’t available.
And if you don’t have an IT provider, you can always reach out to us, and we’ll help you out.
Sources and Further Reading
—
Comments