- A familiar voice on the phone is no longer proof of who's calling.
- Don't judge the voice. Check the request, on a channel you already trust.
- Urgency plus secrecy is the pattern to watch for, whatever the medium.
- Simple agreed rules, like call-backs and two-person approval, do most of the work.
How voice-clone fraud works
CEO fraud is an old trick. Someone pretends to be the boss and asks a colleague to move money, quickly and quietly. For years it arrived by email, and a careful reader could often spot that the sender's address was slightly off.
Voice cloning moves the same trick to the phone. Some AI tools can produce a convincing copy of a person's voice from a short clip, and short clips are easy to find: a company video, a podcast interview, a conference talk, even a voicemail greeting. The fraudster types what they want "the boss" to say, and the tool says it in the boss's voice.
Deepfake video takes this a step further, with a familiar face on a video call. It's harder to pull off live, but the principle is the same: something you'd normally treat as proof of identity can now be faked.
For a small team, the risk is real precisely because everyone knows each other. When the managing director rings the office manager, nobody asks for ID.
The warning signs
You can't count on hearing something wrong with the voice. A clone may sound slightly flat, or the caller may blame a bad line, but a good one can be hard to tell apart on a short call. The reliable signs are in what's being asked.
It's urgent and secret
"Before five", "don't tell anyone yet", "I'm counting on you". Urgency stops you thinking; secrecy stops you checking. When the two arrive together, treat it as a signal to slow down.
The caller can't be reached
They're boarding a plane, in a meeting, abroad with a dead phone. Every excuse has the same job: to stop you calling them back on their usual number.
Money or details are moving somewhere new
A new supplier, a changed account, a one-off transfer, gift cards for a client. Often the call is backed up by an email, so each one makes the other feel more real.
Five habits that stop it
None of these need new software. They need a short conversation with your team and a bit of practice.
- Call back on a known number. Hang up and ring the person on the number you already have saved, not the one that called you or the one in the email. If it was really them, they won't mind.
- Agree a code word. Pick a simple word or question that's never written down in email or chat. If an "urgent" caller can't give it, stop.
- Use two-person approval for payments. No single person, however senior the caller, can send money on their own. A second person checks and approves.
- Never change bank details on a call. Changes to supplier or payroll details are only made after checking with the supplier using contact details you held before the request.
- Slow down when urgency meets secrecy. Make it a team rule: anyone can pause a request that feels rushed and hush-hush, with no questions asked afterwards.
The last habit matters more than it looks. People act on fake calls because they don't want to let the boss down. If the boss has said, in advance and out loud, "I'll never mind you checking", that pressure loses its grip.
Making it stick in a small team
Write the rules down on one page and walk through them at your next team meeting. Keep it short: who can approve payments, how bank detail changes are checked, and the code word (said aloud, not written in the doc). Make sure new starters hear it in their first week.
Then practise. Many voice scams start or end with an email: the "details I've just sent you" or the follow-up asking for confirmation. Lureproof doesn't simulate phone calls, but it does send realistic practice emails to your team on Google Workspace or Zoho, including the urgent-boss and changed-bank-details kind. If someone clicks, they get a 60-second lesson on the spot, so the habit of checking gets built before it's needed. You can browse examples in our lure library.
If the worst does happen and money has gone, call your bank straight away using the number on your card, or 159. Speed matters. Then report it to Report Fraud (reportfraud.police.uk, which replaced Action Fraud) in England, Wales and Northern Ireland, or to Police Scotland on 101.
FAQ
Can you tell a cloned voice from a real one?
Not reliably. A good clone can sound natural, especially on a short or noisy call. Rather than judging the voice, check the request: hang up and call back on a number you already have.
What's the simplest protection for a small business?
A rule that no payment or bank detail change is ever approved on the strength of a single call or message. Confirm on a known number, and have a second person approve payments.
What should I do if I think we've paid a fraudster?
Call your bank straight away using the number on your card, or 159, and ask them to try to stop or recall the payment. Then report it to Report Fraud (reportfraud.police.uk, which replaced Action Fraud) in England, Wales and Northern Ireland, or to Police Scotland on 101 in Scotland.