In plain English
- What happened
- The Federal Trade Commission has warned consumers that scammers now use AI voice-cloning tools to mimic a family member's voice from a short audio sample and stage a fake emergency, pressuring the listener to send money fast. CISA, the FBI and the NSA jointly published guidance for organizations describing the same technique used against businesses, often as a fake urgent call from an executive or vendor demanding an immediate wire transfer.
- Why it matters to your business
- A small business owner does not need to be an AI expert to be targeted by this. The same cloned-voice trick used against a family member works just as well on an office manager who hears what sounds exactly like the boss asking for a rushed payment, and the thirty-minute window scammers create is designed to skip the one step that would catch it: a callback.
- Do this
- Agree on a short verbal codeword with family and with anyone at the business authorized to approve a payment, so asking for it on an unexpected urgent call feels routine rather than awkward.
The direct answer is yes. Current voice-cloning tools need only a few seconds of someone's real speech, often pulled from a voicemail greeting or a public video, to generate a convincing fake of their voice saying anything a scammer types. The FTC's March 2023 consumer alert describes exactly this pattern: a cloned voice, a manufactured crisis, and pressure to act before anyone can check.
How the scam works
The call arrives sounding like someone you trust, in a situation built to short-circuit normal caution. It might be a family member claiming to be in trouble, or in a business context an owner, a manager, or a long-time vendor asking for an urgent transfer or gift cards. The FTC alert notes scammers often ask the target not to hang up and not to call anyone else to check, which is itself a signal.
The joint advisory from CISA, the FBI and the NSA frames this as a threat to organizations specifically, not just individuals. Their guidance points out that synthetic audio and video are increasingly used to impersonate executives or partners in fraud attempts, and that the usual email filters and antivirus tools were never built to catch a voice.
The federal advisory recommends organizations build verification into their process before an incident, rather than trying to detect a fake in the moment it happens.
What to do before it happens to you
- 1
Agree on a codeword now
Pick a short word or phrase with family members and anyone who can approve a business payment. If a call claims an emergency and the codeword cannot be given, treat it as unverified.
- 2
Always call back on a known number
Never use a number given to you during the call itself. Hang up and dial the number already saved in your phone or in your business records.
- 3
Slow down the decision on purpose
Scammers build urgency because it works. Telling the caller you need two minutes to call them back is a normal, reasonable thing to say, even if they object.
- 4
Put a second approver on wire transfers
Any payment above a set amount should need a second person's sign-off by a separate channel, such as a text or an in-person check, before it goes out.
- 5
Report it if it happens
Both a failed and a successful attempt can be reported to the FTC and to the FBI's Internet Crime Complaint Center, which track these patterns nationally.
Reality check
There is no need to buy a voice-authentication app or a deepfake-detection subscription as the fix here. Detection tools lag behind the cloning tools they are meant to catch, and the advisories from CISA, the FBI and the FTC both point to verification habits, not software, as the actual defense.
Write a short, plain-language policy for my business titled 'Verifying urgent payment requests.' It should cover: (1) what to do if someone calls or texts claiming to be [owner's name] or a vendor asking for an urgent wire transfer or gift cards, (2) the callback rule — always call the number already on file, never the one given during the call, (3) who the second approver is for any payment over [dollar amount], and (4) what to say if the caller pressures us not to verify. Keep it under 200 words and written so a new employee could follow it without explanation.
None of this requires new technology or a compliance budget. It requires a habit that gets practiced before the call ever comes, because the thirty-minute pressure window a scammer builds only works if there is no faster, calmer step already waiting to replace it.
Sources
