Say you run a workshop with four people. Marta does the admin. On a Tuesday afternoon her phone rings and it's you. Same voice, same slightly impatient tone. You tell her an audit is coming, a machine has to be paid for today, and here are the bank details. Would she question it?
Most of us would not. That is the whole point of the trick.
A real case, not a thought experiment
Spain's national cybersecurity institute, INCIBE, publishes real cases from its 017 helpline. One of them goes like this. A company got a call that seemed to come from one of its main CEOs, asking for a phone meeting with several employees. The caller's voice, the employee said, was "exactly like the CEO's". In the meeting, the fake CEO said an audit was imminent and the company needed to buy a machine to pass it. Before hanging up, he gave bank details. The staff paid right away so the machine would arrive on time.
A few days later someone spoke to the real CEO, and the penny dropped. INCIBE's explanation: a deepfake technique called deepvoice, where a person's voice is cloned to impersonate them.
Notice what was missing. No hacked system, no virus. Just a convincing voice, a deadline, and people who wanted to be helpful.
How a voice gets cloned (the short version)
A voice-cloning model listens to recordings of someone and learns the pattern of that voice: its pitch, rhythm, the way sentences rise and fall. Then it can say any new sentence in that pattern, just from typed text. Think of an impressionist who has studied you, only the impressionist never gets tired and nobody hears the effort.
Where do the recordings come from? Anything public: a video on your website, a voice note, a podcast, an Instagram story. Press reports say a short clip can be enough. I could not confirm a precise number, so treat that as a warning rather than a measurement.
Why "I'd recognise the voice" is not a defence
Your ear was built to recognise people, not to catch machines. And a scam call is rarely calm. It comes with urgency: today, before closing, the auditor is waiting. Urgency switches off the part of you that would normally say "hang on".
The FBI's public alert from May 2025, about AI-generated voice messages impersonating senior US officials, makes the same point in plainer terms: AI voice clones can sound nearly identical, so check the request, not the sound. That alert was about officials, not small firms, but the mechanism is the same one INCIBE describes.
The rule that works: money never moves because of a phone call
INCIBE's own advice for that company is not about spotting fakes. It is about procedure:
- Payments must be authorised by email or in person, never by phone.
- Bigger payments need approval from more than one person.
- If something feels odd, check with the person on a channel you know is genuine, not by calling back the number that just called you.
- Train whoever handles payments, because that is who gets called.
The FBI adds two cheap ones: never give a verification code to anyone, and agree a secret word with family so a panicked "it's me, I need money" call can be tested.
This is the same idea behind any good approval step: the request and the permission travel on different roads. If a request arrives by voice, the OK has to come by another route. I wrote about the way such checks quietly decay in When Human Review Becomes a Rubber Stamp, and about limiting what any one person (or agent) can do in Should Your AI Agent Get a Key to Your Business?.
Phones are starting to help, a little
This week Google announced Gemini-based scam detection for Android's Messages app, as reported by Hipertextual. It looks at conversations with unknown senders, checks links before you tap, and Android will warn before call forwarding is switched on in the background. Google says the analysis happens privately. That is Google's own claim, which I cannot check. The report gives no date for Spain or the EU, and says nothing about how often it gets it wrong.
Useful, probably. But it watches your messages, not a voice call that arrives as a normal phone call. A rule in your head beats a filter in your phone.
Where this advice falls short
A payment rule will feel slow. Marta will sometimes have to say "I'll just confirm that by email" to a real, slightly annoyed you. Tell her in advance that it is fine. Also, a rule only works if you apply it to yourself: the owner who says "just this once, I'm in a hurry" is exactly the voice a scammer imitates.
And a rule does not cover everything. A cloned voice can also try to get passwords, codes or customer data, not only transfers. For those, the same habit applies: the request does not prove itself.
One thing to do this week
Tell whoever handles your money one sentence: "If I ever ask you to pay something by phone, you hang up and ask me by email." Then write the rule in two lines and stick it where the payments are done. It costs nothing, and it works whether the voice is real or not.