That urgent call from the owner might be an AI. Verification beats detection.

The controller’s phone rings late on a Friday. It is the owner’s voice, unmistakably, the cadence, the impatience, the way he says her name. He is tied up in a meeting about the thing he cannot talk about yet, he needs a vendor payment released today and he will explain Monday. The voice is right. The story has just enough pressure in it. The real owner is on a plane, and a few seconds of his voice from a trade-show panel on YouTube was all the cloning software needed.

This is not a hypothetical anymore. Voice-cloning tools produce convincing speech from seconds of sample audio, cheaply and without skill, and finance teams at businesses of every size now field fraud attempts that sound like someone they know. The targets are not Fortune 500 treasuries. They are the 40-person company where one person can release a wire and everyone recognizes the owner’s voice, which is precisely what makes the voice such effective ammunition.

The instinct is to train people to detect fakes, listen for the robotic edge, the odd pauses. That instinct is already obsolete. The clones are good and getting better, and a detection strategy asks your controller to beat a machine at a perception game, under time pressure, on a Friday. The workable defense ignores the voice entirely.

Make the process immune to convincing

One rule does most of the work: money moves on verification, never on a voice. Specifically:

1. Callback on a known number, every time. Any payment request, banking-details change or “release it today” instruction that arrives by phone, voicemail, text or video call gets verified by calling the requester back on the number already in the company directory, not a number the caller provides. The clone can call you. It cannot answer the real owner’s phone
2. Two people for new or changed destinations. First payment to any new account, and any change to an existing vendor’s banking details, requires a second approver. This is the same control that blunts the email version of this fraud, and it works because it removes the single point of persuasion
3. No channel switching under pressure. A request that arrives with instructions not to verify, “do not email about this, it is confidential,” is treated as hostile by policy. Real confidential deals survive a callback to the CEO. Frauds do not
4. A code word for the inner circle, if you like. Some owners set a spoken phrase with their finance team for genuine out-of-band urgent requests. It is low-tech and slightly theatrical, and it works, provided it never appears in writing

Write these 4 rules down, have leadership sign them and, critically, have the owner say the sentence out loud to the finance team: “If a request sounds like me and skips this process, it is not me, and refusing it is doing your job.” The sentence matters because the fraud’s real weapon is not audio fidelity. It is the employee’s fear of telling the boss no.

Where the clones are showing up

The Friday wire call is the headline scenario, and three quieter variants deserve a mention in your next training session:

• The voicemail drop. A cloned voice leaves a message rather than risking live conversation, “call the attorney at this number”, handing the victim to a human accomplice. The callback rule covers it: known numbers only
• The vendor’s voice, not the boss’s. A supplier’s “accounts receivable manager” calls about updated remit-to details, sometimes cloned from the real person’s webinar appearances. Banking changes verify through the number on the existing contract, the same discipline suppliers should hold on their customer portals
• The HR angle. A cloned employee voice asks payroll to redirect a direct deposit. Same rule, verified through a known channel, plus a no-same-day-change policy for payroll banking

Fold 10 minutes on voice fraud into the security awareness rhythm you already run, with one real clip of cloned audio played aloud. Hearing how good it is does more than any memo, and it converts the policy from bureaucracy into obvious sense.

If a payment already went out

Speed is nearly everything. Call your bank’s fraud line immediately and request a recall and a SWIFT/wire trace, then call the receiving bank, then file with IC3. The useful window is measured in hours, and the full sequence, including the insurance notice and the evidence to preserve, is in wire fraud and the first 48 hours. Afterward, run the post-incident review without blame: the lesson is almost never “the controller was careless” and almost always “the process let one voice move money.”

The questionnaire footnote

Social-engineering fraud questions are now standard on cyber insurance applications, and several carriers price or sub-limit coverage based on whether callback verification and dual approval exist in writing. The 4 rules above, documented and trained, are the difference between full social-engineering coverage and a sub-limit that will not cover one bad Friday. They also answer the AI-risk questions beginning to appear on customer questionnaires, alongside the AI usage policy they complement: one governs the AI your people use, this governs the AI used against them.

Atticus Rowan writes these verification policies with clients, runs the training with the audio demo included and wires the approval controls into the banking and ERP workflows people actually use. If your payment process would currently bend for a sufficiently convincing voice, start a conversation before someone tests it.