“It Sounded Exactly Like Him”

Picture a Friday afternoon. Your accounts manager gets a call from the managing director. The voice, the phrasing and the slight impatience are all exactly right. There’s a confidential deal closing today, a supplier needs paying urgently, and the MD is between meetings, so could they just get it done and he’ll explain on Monday?

The call is fake. The voice was generated by AI from a few seconds of audio taken from a podcast, a conference video, or even a voicemail greeting.

This isn’t a hypothetical. In 2024, engineering firm Arup confirmed that an employee in its Hong Kong office transferred around US$25 million after a video call in which the “CFO” and several “colleagues” were all deepfakes. Voice cloning tools that once needed hours of recordings now need seconds, and they’re cheap and widely available.

Why It Works

Deepfake fraud is an upgrade to an old scam. CEO fraud and invoice redirection have been around for years, usually by email. What’s changed is that a voice or video used to be the thing you checked against. “I’ll just ring them to confirm” was the safeguard. Now the phone call itself can be the attack.

The scam relies on the same pressure points every time:

• Authority: the request comes from someone senior
• Urgency: it has to happen today, before a deadline
• Secrecy: “keep this between us for now”
• Disruption of process: “skip the usual approval just this once”

Simple Checks That Stop It

The good news is that the defences are procedural, not technical, and cost nothing to set up.

Call back on a number you already have. If a payment request comes by phone, hang up and ring the person back on the number in your contacts or company directory. Never use a number given during the call or in the email.

Agree a verification phrase. Some businesses set a simple code word between directors and finance staff for urgent payment requests. A deepfake can copy a voice; it can’t know a word that was never recorded.

Require two people for payments and bank detail changes. No single person should be able to add a new payee or change a supplier’s bank details alone, however senior the person asking.

Make it safe to say no. Staff must know they will never be in trouble for pausing a payment to verify it, even if the MD really was on the line. Write that down and say it out loud at a team meeting.

Be mindful of what’s public. Recorded webinars, video posts and voicemail greetings are raw material for voice cloning. You don’t need to disappear online, but senior staff should know their voice can be copied.

The Five-Minute Action

This week, ask your finance team one question: “If I rang you right now and asked for an urgent transfer, what would you do?” If the answer is “I’d just do it”, you’ve found your gap.

We can help you put a written payment verification process in place and pair it with email controls that flag lookalike domains and unusual payment requests. It’s one of the quickest and cheapest security wins available.