Someone Cloned a Voice and Called Your Business

The call sounds right. It is your supplier's account manager, the one you have spoken to a dozen times, saying their bank details have changed and could you send this month's payment to the new account. The voice is correct. The manner is correct. The request is the oldest fraud in commerce wearing a new coat.

The uncomfortable part is that nothing about the audio will save you, and the research says so more clearly than the marketing does. What saves you is a procedure that does not care what the voice sounds like.

This piece is about the procedures a small business can run without buying anything, and about why the detection products are a weaker answer than they appear.

How much audio does someone need to clone a voice?

Very little, and the amount keeps falling. The FTC's consumer alert on the subject describes a scammer needing only a short audio clip of the person's voice to produce a convincing imitation.

For a business owner this changes the threat model in a specific way. If you have ever recorded a voicemail greeting, appeared on a podcast, posted a video introducing your products, or spoken at a local event that somebody filmed, the raw material exists. There is no exposure decision left to make about it, which is why the defence has to sit on the procedure side rather than the prevention side.

The same alert gives the household version of the fix, and it transfers directly to a business: call back on a number you already know is theirs, and ask something only the real person would know. Wire transfers, cryptocurrency and gift cards are named as payment red flags, and that list has not changed in years because it does not need to.

Why detection software is the weaker half of the answer

Because detectors are trained against the fakes that existed when they were built, and the thing that breaks them is novelty rather than quality. This is not a vendor complaint. It is the finding of a paper that set out to answer precisely this question.

In Harder or Different? Understanding Generalization of Audio Deepfake Detection, published in June 2024, the authors decompose the gap between a detector's performance on familiar data and on unfamiliar data into two parts: whether newer fakes are simply harder, or whether fakes from a different generator are fundamentally different. Their experiments find the hardness component practically negligible, with the gap attributed primarily to the difference component. They state the implication directly: merely increasing model capacity, which they describe as the currently dominant research trend, may not effectively address the generalisation challenge.

Translate that into a purchasing decision. A detector that scores well in a demonstration is scoring on generators it has met. The call that reaches your business will come from whatever tool the caller happened to use, and the odds that it is one your detector was tuned against are not something you can influence or verify.

The FTC reached the same place from a different direction. Its voice cloning challenge sought ideas across prevention, monitoring and evaluation, named small businesses among the targets of these schemes alongside families, and stated that the risks posed by voice cloning and other AI technology cannot be addressed by technology alone.

What is actually being attacked?

Not your voice. Your payment process. The clone is a delivery mechanism for the same request that used to arrive as a forged email, the request that still arrives that way in most supplier invoice fraud aimed at small shops, and the money moves the same way it always did.

The scale of that underlying crime is documented. The IC3 public service announcement Business Email Compromise: The $55 Billion Scam reports 55,499,915,582 dollars in exposed domestic and international losses between October 2013 and December 2023, across 305,033 incidents including 158,436 United States victims. Its description of the scam is worth reading as a definition rather than a headline: a scheme targeting businesses and individuals who perform legitimate transfer of funds requests.

That phrase, legitimate transfer of funds requests, is the whole thing. The attack does not create an unusual transaction. It redirects an ordinary one you were always going to make, which is why anomaly detection on payment amounts finds nothing.

The right hand column is the useful one. Every item in it is a thing people instinctively rely on, and every one of them is now cheap to fake.

The rule that does the work

One sentence: bank details never change on the strength of an incoming contact. Any change is verified by you, outbound, on a number you held before the request arrived.

The direction is the entire security property. An inbound call proves nothing about who is calling. An outbound call to a number from your own records reaches whoever actually holds that number, and a fraudster would need to control your records or the phone line to defeat it. That is a much higher bar than cloning a voice from a podcast.

Three details make it survive contact with a real week. Store the verification number separately from the invoice, because a compromised email thread will helpfully supply a new one. Require the callback even when the request is expected, since "we were waiting for this" is exactly the situation the timing was chosen to exploit. And make the second approver a person rather than a rule in software, because the attack is social and the countermeasure should be too.

Who in a small team actually gets called?

Whoever pays the invoices, which in a business of three people is often the owner and in a business of twelve is often the newest administrator. Attackers work this out from your own website, and social engineering starts with an organisation chart you published yourself.

The vulnerability is not naivety. It is the combination of authority and hurry. A person who has been told the owner is in a meeting abroad, who receives a call that sounds like the owner, and who has never been explicitly told that they may refuse, will resolve that tension by paying. The fix is to remove the tension in advance by stating, in writing, that nobody will ever be criticised for delaying a payment to run a check.

Vishing, the voice equivalent of phishing, works on exactly that pressure. The cloned audio only has to be good enough to get past the first ten seconds, because after that the urgency does the work. Small business security fails at the social layer far more often than at the technical one, and no amount of software addresses a member of staff who believes that checking would be rude.

Run the exercise once, out loud, at a team meeting. Say the sentence somebody would hear, and let the person who would receive it practise saying "of course, I will call you back on the number we have." Once said aloud, it stops feeling like an accusation.

What about a shared phrase?

It works, with one condition: it must never travel over the channel it protects. A code word agreed in person or in a channel the attacker does not control is a cheap and effective check, and it is why the FTC suggests households agree one.

For a business the practical version is a question rather than a password. Something drawn from a shared history that is not written down anywhere: which supplier delivered late in the week the roof leaked, what was wrong with the first pallet in March. A model can clone a voice from public audio. It cannot retrieve a fact that exists only in two people's memory and your private records.

Avoid anything that appears on your website, in a company profile, or in the email thread the request arrived in. A surprising amount of what feels private is one search away, and the attacker who bothered to clone a voice has certainly read your about page.

Where AI does help on this problem

On the boring side, and it is worth being precise because the useful applications are not the ones being sold.

Transcription and logging is the first. If your calls about payments are recorded and transcribed with consent, you have a record of exactly what was asked and when, which matters enormously in the hours after a suspected incident when everybody's memory is reconstructing rather than recalling.

Pattern spotting on your own records is the second. A supplier whose bank details changed twice in a year, an invoice whose formatting drifted, a contact who moved from one email domain to another: none of these is proof and each is worth a flag. The same restraint applies as everywhere else in fraud work, which we set out in why a wrongly blocked order costs more than the fraud it prevented. A flag prompts a call. It does not refuse a payment.

Third, and least glamorous, drafting the procedure itself. A model is genuinely good at turning your intention into a one page document your staff will read, which is the same argument as writing an AI policy short enough that people actually follow it. The value is in the document existing, not in who typed it.

A payment fraud procedure that fits on one page

Keep it to six lines and pin it where payments get made. A fraud procedure nobody can recite is a document, not a control.

Line one: bank details for any supplier change only after an outbound call to the number in our own records. Line two: the person who makes that call is not the person who received the request. Line three: any payment above an amount you choose needs two approvals, and the requester is never one of them. Line four: we never move a conversation about money to a different app or number because we were asked to. Line five: any request marked urgent and confidential is automatically slowed down rather than sped up. Line six: nobody is ever penalised for using this procedure.

The IC3 announcement lists its own defensive measures alongside the loss figures, and several map onto the same idea: two factor authentication on account changes, verifying that sender addresses match who they claim to be, watching for misspellings in domains, and never sharing credentials or personal information by email. Those are the written channel equivalents of the same discipline, and supplier fraud usually arrives through a combination of the two rather than a call alone.

Review the list once a year and after any near miss. The specific tactics move faster than the principles, but the principles have not changed since the scam involved a fax machine.

If it already happened

Speed matters more than accuracy in the first hour. Call your bank and ask for a recall on the payment before you finish working out what happened, because recovery windows are short and shrink once funds move on.

Then report it. The IC3 exists for exactly this and its figures are built from reports like yours, which is a small argument for filing even when you expect nothing back. Tell the supplier whose identity was used, since they are almost certainly being used against others in the same week. And write down the sequence while it is fresh, including which check would have caught it, because that is the sentence that changes your procedure.

Resist the instinct to blame the person who took the call. They were targeted by something designed to be convincing, and a process that depends on an individual being suspicious at the wrong moment was never a process. If you want a broader look at where your credentials and connected tools sit in all this, we went through it in the keys your AI tools hold that nobody is watching.

Does this change what you publish about yourself?

Barely, and it is worth saying so plainly because the instinct after reading about voice cloning is to take things down. Removing your own voice from the internet is a large sacrifice for a small reduction in risk, since the clip needed is short and the sources are many.

There is one exception worth acting on. Voicemail greetings recorded in your own voice, naming you and your company, are a gift of clean studio quality audio attached to a verified phone number. Replacing that with a synthetic or generic greeting costs nothing and removes the tidiest sample you were offering.

Beyond that, keep marketing. Video, podcasts and talks are how a small business gets found, and trading them away for a defence that a procedure already provides is a bad exchange.

The uncomfortable summary

Voice is no longer evidence of identity, and it is not coming back, in the same way that a shopfront is no longer evidence of a business now that a convincing brand impersonation takes an afternoon and a prompt. Every control you built on recognising someone has quietly expired, and the replacement is not a better ear or a better detector. It is a rule about direction: you call them, on a number you already had, before money moves.

That rule costs one phone call and it is not subject to a research race. If you want to check how the rest of your systems are set up against this kind of impersonation, our notes on how MaShop handles security cover the account side of the same question. The phone side is yours, and it is fixed with a sentence rather than a subscription.