AI Voice-Clone Scams: How Businesses Can Stop Them

What AI voice-clone scams are

An AI voice-clone scam uses software to copy how a real person sounds. A criminal takes a short clip from a webinar, voicemail greeting, podcast, social video or recorded meeting, then makes a call or voice note that sounds like that person.

In a business, the copied voice usually belongs to someone with authority: the owner, a manager, a vendor's account rep, an attorney or a bank contact. The FBI has warned that criminals use AI-generated audio and video to impersonate trusted people and make fraud more believable.

The key point: the voice is not proof. These scams succeed when a familiar voice is treated as approval instead of a reason to follow your normal checks.

Why small businesses are targets

Small and mid-size businesses move money, work fast and run on relationships. A bookkeeper knows the owner's voice; an office manager knows the vendor who calls every month. Urgent requests near payroll, closings or tax deadlines feel normal.

Criminals also do research. Names, job titles, email formats, vendor relationships and speaking clips are often public. A cloned voice is then paired with a spoofed number, a convincing email or a calendar invite. It is the old business email compromise playbook with a voice added.

How a fake voice becomes a payment

Research: find who can approve payments or change vendor records.
Voice collection: gather audio from public videos, voicemail greetings or online meetings.
Story: a confidential deal, an overdue invoice, a payroll fix or a bank security alert.
Contact: a call, voicemail or video meeting, backed up by email or text.
Pressure: speed, secrecy and a request not to check with anyone.
The ask: a wire, gift cards, cryptocurrency, a password, a one-time code or new bank details.

Most real cases are not cinematic. A fake boss call followed by a short email is enough when a business has no callback rule and no second approver.

Common impersonation scenarios

The owner needs a wire now. The caller is "in a meeting" or "boarding a flight" and says the matter is confidential. Junior staff hesitate to question the boss, which is exactly the point.
A vendor changes bank details. The call sounds like the rep you know and says billing moved to a new bank. One changed routing number can redirect payments for weeks.
Your bank's fraud team calls. The caller asks for online banking credentials, a one-time code or a "test" transfer. A real bank verification never needs your passwords or codes.
A video meeting adds pressure. Faces and voices can both be generated. If a meeting ends with a request to move money or share credentials, the same checks apply.

Warning signs your team should recognize

Cloned voices can sound right, so the warning signs are usually in the request, not the audio:

Urgency: "This has to go out in ten minutes."
Secrecy: "Don't mention this to anyone."
Authority pressure: "I'm the owner, just do it."
Unusual payment: gift cards, cryptocurrency, payment apps or a wire to a new account.
A request for passwords, one-time codes, MFA approvals or remote access.
A new phone number, personal email or unfamiliar messaging app.
Anger or excuses when you say you need to verify.

A verification routine that works under pressure

Call back on a known number. Hang up and call the person or company using a number already in your records, not the number on the caller ID, voicemail, email or invoice.
Use a code word for payment requests. Leadership and finance agree on a private phrase that any phone request for money must include. Change it when someone leaves or after a suspected attempt.
Require two people for payment changes. New payees, bank-detail changes, urgent wires and out-of-pattern payments need a second approver who verifies independently and records what they checked.
Train with realistic examples. Short, repeated sessions for finance, payroll, reception, executive assistants and anyone with bank access, using the scenarios above.

Owners should say it out loud: no payment is so urgent that it skips verification. Thank the people who slow down a suspicious request. Our guide to AI phishing emails covers the written side of the same attacks.

Payment and account controls that back it up

Written approval limits for wires, ACH batches and card payments.
Separate who creates vendors, who edits bank details and who releases funds.
Bank alerts for outgoing wires, new payees, failed logins and password changes.
Multi-factor authentication on email, accounting, payroll, banking and file sharing.
A rule that requests made by voice, text or chat never approve themselves.
A monthly review of who has payment or admin rights.

The first hour after a scam call or lost payment

Stop and call the bank. End the call, send nothing more, and ask your bank's fraud team to recall or freeze the transfer and contact the receiving bank. Have the amount, time, account and reference numbers ready.
Preserve evidence. Keep call logs, voicemails, emails, texts, meeting links, invoices and confirmations. Write a timeline while memories are fresh.
Report to the FBI. File at IC3.gov as soon as possible, with the transaction details; fast reports help the FBI work with banks on recovery.
Report to the FTC. File at ReportFraud.ftc.gov as well. It adds to the record but does not replace the bank or IC3.
Lock accounts down. If codes or passwords were shared, reset them, end active sessions and review MFA devices. Tell leadership, IT, your insurer and the person who was impersonated.

Where ASL fits

If an unknown number or a suspicious message is behind the request, Aya Scam & Privacy Lookup researches the number or message and shows what its sources say, including when the result is uncertain. Our guides on checking whether a number is a scam and stopping spam calls go further.

For payment approval steps built into your own systems, our custom software development service can add second-approver and callback checks, or contact us to talk it through.

Frequently asked questions

What is an AI voice-clone scam?

A fraud where software copies a real person's voice from a short recording so a criminal can call or leave a message that sounds like them, usually to get money, passwords or changed payment details.

How can I tell if a voice on the phone is cloned?

Often you cannot. Judge the request instead: urgency, secrecy, unusual payment methods or requests for codes are warning signs. Hang up and call back on a number you already have.

What is a good code word for business payments?

A private phrase that is not public or easy to guess, shared only with the people who request or approve payments, required on any phone request for money and changed whenever someone leaves.

What should I do if we already sent money?

Call your bank's fraud team immediately to recall or freeze the transfer, preserve all evidence, file a report at IC3.gov and ReportFraud.ftc.gov, and reset any credentials that were shared.

Does a video call prove the person is real?

No. Faces and voices can both be generated. Any meeting that ends with a request to move money or share credentials needs the same independent verification as a phone call.

Related guides

Explore the complete product

Read features, current access and limitations

Your Boss Didn't Call: How to Stop AI Voice-Clone Scams