When the Voice on the Phone Is Fake
Scammers can now copy your boss’s voice. Here is how to keep it from costing you.
The Short Version
Picture this. Your bookkeeper gets a call. It is the owner, clear as day, asking them to wire a payment to a new account before the end of the day. The voice is right. The request sounds normal. So the money goes out. The problem is the owner never made that call. A scammer copied the voice.
This is real, it is happening to ordinary businesses, and the tools to pull it off are now cheap and easy. The good news is that you do not need fancy technology to stop it. You need a simple habit: before anyone moves money on a phone call, they check first using a second way to reach the person. This article explains how the scam works and the few steps that shut it down.
Why a Phone Call Is No Longer Proof
For years we taught people to spot a fake email. Look for bad spelling. Check the sender. Do not click strange links. That advice still helps, but it was built for scams you read on a screen.
What almost nobody learned was to question a voice. And until recently, you did not have to. A scammer could not sound exactly like your boss. Now they can. With a short clip of someone talking, free software can copy that person’s voice closely enough to fool the people who know them. And there is plenty of audio to grab. A video on the company website, a podcast interview, a talk posted online, even a voicemail greeting can be enough.
That is what makes this so effective. There is no suspicious link to catch and nothing that looks off. There is just a familiar voice, a reasonable request, and a reason to hurry.
How the Scam Usually Goes
It tends to follow the same pattern, and knowing the pattern is half the battle.
- They do their homework. They figure out who handles the money and who the boss is, usually from your website and social media.
- They copy the voice using public audio of the person they want to impersonate.
- They make the call, often after a quick email or text first, so the call feels expected.
- They push for speed. It is urgent, keep it quiet, and it lands late on a Friday when nobody can double check.
None of this is high tech on your end. The scam works because most of us are wired to help the boss and to act fast when something sounds important.
What to Do About It
You will not win by trying to hear the difference. The fakes are too good for that. You win with a few simple rules everyone follows, every time.
- Hang up and call back. If a call asks you to send money or change where a payment goes, end the call and reach the person yourself on the number you already have for them. A real boss will be glad you did.
- Treat banking changes as a stop sign. Any request to change a vendor’s bank details or send to a new account gets confirmed a second way before you act, never on the say so of one call or email.
- Pick a code word. Agree on a simple word or phrase for money requests, shared only among a few people. If the caller cannot say it, the answer is no.
- Make it safe to slow down. Tell your team out loud that checking a request is doing their job right, even when the request seems to come from the top. The whole thing falls apart if people are afraid to pause.
That is the entire defense. No big budget, no new gadget. Just a habit of verifying before money moves, decided ahead of time so nobody has to make the call under pressure.
How Simulint Helps with BlueSphere
Most companies that train their people only practice spotting fake emails. That is a good start, but it leaves out the part that empties bank accounts today, the phone call and the video call. Someone who has only ever practiced ignoring a bad link has never practiced saying no to a familiar voice asking for money.
That is the gap we close. Through our partnership with Jericho Security, the BlueSphere phishing service runs safe, realistic practice scams across all three ways the bad guys come at your team: email, phone calls, and text messages. The drills are built around real tactics and your own business, so the first fake voice your bookkeeper hears is not the first one they have had to turn down. The point is not to trip anyone up. It is to make checking first a reflex.
Our Simulint vCISO and Security Leadership team also walks your people through a practice run of this exact situation, so your money and leadership staff know the plan before a scammer ever tests it. Realistic practice plus a plan everyone has rehearsed turns a good intention into a habit that holds up.
Learn more about BlueSphere: https://lnkd.in/eE9HTaw8
