Your bookkeeper receives a call that sounds like you. The caller knows a vendor’s name, says a payment is urgent, and asks for the money to go to a new bank account. They also say there is no time for the usual approval.
Would your employee send it—or stop and verify the request?
Voice cloning gives scammers another way to impersonate someone your staff trusts. Your protection needs to depend on how a request is verified, rather than whether the caller sounds convincing.
What is a deepfake CEO scam?
A deepfake uses artificial intelligence to create or alter audio, video, or images that appear authentic. In a business impersonation scam, someone may use a cloned voice or manipulated video to pose as your owner, executive, colleague, or vendor.
The Federal Trade Commission warns that a voice resembling your boss can make a request for money or information more believable. It is not proof that the request came from that person.
Your business needs verification procedures that work whether a suspicious request arrives by phone, email, text, or video.
How does voice cloning relate to business email compromise?
Business email compromise, or BEC, commonly involves someone abusing a trusted business email account or identity to redirect money. A cloned voice can reinforce a fraudulent email: the message changes the payment details, and a follow-up call appears to confirm the change.
Voice cloning adds another method of persuasion; it does not replace email fraud. A convincing call may also occur without any access to your email system. Your employee still needs to verify the transaction.
The FBI’s guidance on AI-enabled fraud describes criminals using synthetic audio and video to make impersonation more believable. Warning signs such as strange wording or an unnatural voice can help, but their absence should not become permission to bypass your controls.
Which requests should your staff stop and verify?
Build verification into sensitive actions, including:
- New or changed payment details: a vendor’s replacement bank account, revised wire instructions, or a different destination for a refund.
- Unusual spending: an urgent transfer, gift-card purchase, or payment outside your normal process.
- Payroll changes: a request to replace an employee’s direct-deposit account.
- Sensitive records: instructions to send customer information, employee details, or financial reports to a new recipient.
- Account access: requests for a password reset, login code, or approval of an unexpected sign-in.
Urgency, secrecy, and pressure to skip another person’s approval should prompt extra scrutiny. Make it clear that the rule applies even when the request appears to come from you.
Use a verification process your staff can actually follow
Call through a contact route you already trust
End the incoming call and contact the person using a previously verified number from your records. Do not use a replacement number supplied in the suspicious message, and do not treat caller ID as proof of identity.
If you cannot reach the person, keep the request on hold or use your documented escalation process. Replying to the same email or moving to a messaging link the sender provides is not independent verification.
Separate approval from entering the transaction
For higher-risk transactions, require another authorized person to review the request before money leaves your account. Have that reviewer check the actual recipient and payment details, not simply whether someone else said it was approved.
Write down your approval thresholds and exceptions. A process that disappears whenever someone says “the CEO needs this now” gives an impersonator an obvious way around it.
Let employees delay a request without fear
Tell your staff that verifying a sensitive request is part of their job. Support them when they pause a legitimate payment to follow the procedure. Otherwise, your written policy and the expectations employees feel under pressure may be very different.
Include these scenarios in your Security Awareness Training and internal procedures. Staff need to know who to contact, which records to use, and what to do when a caller insists on secrecy.
Protect the accounts scammers may use to support the story
Use multi-factor authentication, appropriate access permissions, and monitoring for your business accounts. Employees should never share login codes with a caller or approve a sign-in they did not initiate. The FBI’s impersonation guidance covers both independent verification and protecting authentication codes.
For Microsoft 365, your IT provider should review account security and investigate suspicious activity. An attacker using a real mailbox may appear in an existing conversation, so a familiar email address still does not replace your payment-verification process.
Your cybersecurity protections and Microsoft 365 management help address account and email risks. They need to work alongside your financial controls; a phone impersonation attempt may never pass through an email filter.
What if someone already acted on the request?
If money was sent, contact your bank or payment provider immediately and ask about stopping or recalling the transfer. Notify your leadership and IT provider at the same time so account access and related activity can be investigated.
Preserve emails, messages, call details, and transaction records. If credentials or login codes were shared, tell your IT provider exactly what happened so it can address affected accounts promptly.
The FBI recommends contacting your bank quickly and reporting BEC to IC3. Reporting and rapid action can help the response, but they do not guarantee that money will be recovered.
Make verification part of running your business
At Unified Technology Solutions, Security Awareness Training and account protection are part of the security work we can discuss within your managed IT services relationship. Your leadership also needs to establish and enforce the approvals that govern payments and sensitive information.
If you want to review your business account security and Security Awareness Training, contact UTS. We work with businesses in Vero Beach, Sebastian, Fort Pierce, and the surrounding Treasure Coast.