AI Voice Cloning Scams: How to Verify an Urgent Payment Request

An urgent phone call can make a normal approval process feel slow. A manager sounds stressed. A supplier needs a payment today. The caller knows names, roles and details that seem private.

That familiarity is no longer enough proof. AI can imitate a voice from a short recording and scammers can collect business details from public websites, social media and previous data leaks.

The short answer

Never approve a payment, bank-detail change or release of sensitive information from an unexpected call alone, even if the voice sounds familiar.

End the call and verify the request using a contact method you already trust. Use a saved number, an established email thread or an internal approval channel. Do not use a number or link supplied by the caller.

Why voice is no longer reliable proof

For a long time, hearing a colleague or family member seemed like a useful identity check. Voice-cloning tools have weakened that assumption. The US Federal Trade Commission warns that scammers can clone a person’s voice from a short audio clip and use it to make a crisis story feel real.

The same tactic can target a business. A caller may sound like an owner, finance lead or supplier contact. They may ask for a transfer, a new account number, a password reset code or a confidential document.

The request may contain real details because those details are not always secret. Job titles, staff names, invoices, meeting announcements and phone numbers can be public. A convincing voice plus familiar context can create pressure to act before anyone checks.

Treat urgency as a signal to slow down

Urgency is not proof of fraud. It is a reason to use a stronger check.

Pause when a caller asks you to:

• Pay an invoice through new bank details.
• Send money outside the normal payment process.
• Share a password, recovery code or multi-factor authentication code.
• Buy gift cards, cryptocurrency or another hard-to-reverse payment method.
• Keep the request secret from a colleague.
• Skip a normal approval step because someone is unavailable.

A legitimate urgent request can survive a short verification call. A scam often depends on preventing one.

Use a second trusted channel

The most useful response is simple: end the unexpected call and start a new conversation through a known route.

• Call the person using a saved contact or number from your company directory.
• Contact the supplier through a number on a previous verified invoice or its official website.
• Send a message in the internal channel your team already uses.
• Ask another authorised person to confirm any unusual payment request.

Do not ask the caller to prove who they are by repeating information they may already know. Do not call back the number shown on your screen if the caller gave it to you. Use information you had before the request arrived.

Build a payment process that does not depend on one person

The strongest defence is a process that does not let a single call move money.

Set a rule that bank-detail changes require confirmation through a second channel. For high-value payments, use two people with separate roles. Keep a current list of approved supplier contacts and decide in advance who can approve exceptions.

This is not distrustful. It protects staff who are trying to help under pressure. A clear rule also gives someone an easy way to say no to an unusual request without having to judge whether a voice sounds real.

Prepare a simple verification phrase

For a small team, a private verification phrase can help when a trusted caller needs to make an unusual request. It should not replace an approval process and it should never be written in public posts, email signatures or shared documents.

Use it only as an extra signal. If a request involves money, account access or sensitive data, still verify through an independent channel.

Avoid questions with answers that can be found online, such as a pet name, school or birthday. Pick a process your team can remember without placing the secret in an easily copied note.

If you think a call was a scam

Write down the number, time, request and any payment details before you delete anything. Tell the person or supplier the caller claimed to be. Alert the people who could receive the next call.

If money was sent, contact the bank or payment provider immediately. If you shared a password or a code, change the password from the official site and review account activity. Report the attempt to the relevant local fraud-reporting service.

The sooner people know, the more likely it is that another payment or account action can be stopped.

The bottom line

A familiar voice can now be copied well enough to create pressure. It should not be treated as approval for a payment or account change.

Use a known contact route, keep independent approval for sensitive actions and make verification a normal part of the work. The few minutes it takes can prevent a much larger loss.

Sources

• Federal Trade Commission: Scammers use AI to enhance their family emergency schemes
• Federal Trade Commission: Imposter scams
• CISA: Business email compromise