Business email compromise worked because people trust a familiar name in a From field. Voice cloning is the same attack with a far more convincing channel, and the countermeasure most organisations rely on — "if the email looks odd, phone them to check" — is precisely the control it defeats.
What has actually changed
Synthetic speech used to require a substantial sample and produce something that sounded almost right. Current tooling needs seconds of audio and produces speech that carries the speaker's accent, cadence and hesitations. The source material is not hard to find: a conference talk, a podcast appearance, a voice note in a group chat, a recorded webinar, a video on the company website.
The pattern we see
The attack is almost always the same shape:
- An urgent, confidential matter — an acquisition, a regulatory issue, a supplier about to halt delivery.
- Pressure to bypass the normal process, framed as a one-off because of the urgency.
- Authority, real or borrowed: the CEO, the CFO, occasionally an external lawyer or auditor.
- Secrecy, so the victim cannot verify through a colleague.
- A deadline short enough to prevent reflection.
The voice is the delivery mechanism. The attack is social engineering, and it is aimed squarely at the gap between your written process and what people actually do when someone senior is on the phone sounding stressed.
Controls that still work
Detection technology for synthetic audio exists, but it is an arms race and you should not build your finance controls on top of it. Build them on process instead.
Out-of-band verification, always
Any payment above a threshold, any change to supplier bank details, any transfer outside the normal pattern — verified through a separate channel, using a contact detail you already hold rather than one supplied in the request. Not a reply to the email. Not the number the caller gave you.
Dual authorisation with real separation
Two approvers, and crucially, two people who can each refuse without career consequences. Dual authorisation is theatre if the second approver is a direct report of the first.
A shared verification phrase
Low-tech and effective. A word or phrase known to the executive team and finance, never written in email, used to confirm identity on any urgent voice request. It costs nothing and defeats a cloned voice entirely.
Permission to pause
The most important control is cultural. Staff must know, explicitly and from the top, that they will never be penalised for delaying a payment to verify it — even if the caller really was the CEO and really was annoyed. If your culture punishes the delay, your process will lose to the pressure every time.
Test it before someone else does
Run the scenario as a tabletop exercise with your finance team. Not to catch them out, but to find out where the written process and the real one diverge. In our experience they always do, and the gap is where the money leaves.