Your phone rings and it's your boss's voice. She's in a hurry, about to walk into a meeting, and needs you to make a payment today. The tone is hers, and so are the little verbal habits. A few years ago, recognising the voice was enough to feel safe. Not anymore: a voice can now be cloned with artificial intelligence, and the trick has become a version of CEO fraud that every company should have on its radar.

In this article I explain what a voice deepfake is, how it has already been used against a company in Spain and, above all, how to check a suspicious call without relying on your ears.

◢What is a voice deepfake?

What matters for a business is how it gets used. A cloned voice lends credibility to a request that would already look suspicious by email: an urgent transfer, a change of bank details, a set of login credentials.

◢Has it already happened?

Notice that nobody did anything foolish. They got an instruction from someone with their boss's voice, with a believable reason, and they followed it. It's the same mechanism I describe in CEO fraud: how to spot it, with one difference: the check many people relied on, "I heard him, it was him", no longer works.

◢Can you tell a cloned voice from a real one?

In the same alert, the FBI mentions signs such as lag on the call or a voice that doesn't quite match. They're useful clues, but if your company's plan is for the finance team to spot the fake by ear, the plan depends on luck.

That's why the right approach is different: don't try to guess whether the voice is real, verify the request through a route the attacker doesn't control.

◢How to check whether a call from your boss is real

These are the checks that work. Almost all of them come from INCIBE's and the FBI's advice:

• ▹Hang up and call back yourself. The FBI advises finding the person's number independently and calling them to verify. INCIBE says to always double-check through other channels you already use with that person. Never call back the number that called you, or one you're given during the conversation.
• ▹Be wary of a change of channel. If someone you know contacts you from a new number or app, the FBI recommends confirming that contact through a channel you had already verified.
• ▹Ask something only the real person would know. It doesn't need to be an interrogation: a detail from your last meeting or an internal project is enough to throw an impostor off.
• ▹Look at the context, not just the voice. The FBI stresses judging whether the request makes sense. An urgent, confidential payment outside the usual process is suspicious however perfect the voice sounds.
• ▹Never give codes or passwords over the phone. The FBI warns that scammers may try to talk you into reading out a two-factor code so they can take over the account.

None of these checks needs any technology. What they need is for the person taking the call to be allowed to hang up on the boss without consequences.

◢What your company can do so it doesn't work

The best defence is making sure that a phone call, however convincing, is never enough to move money. In the fake CEO case, INCIBE recommends that payments be authorised by email or in person, never by phone, and that large amounts be approved by more than one person.

On top of that, I would add:

If you want the procedure to hold up against emails too, here's how to tell if an email is phishing.

◢What if you've already made the payment?

In the real case above, INCIBE recommends contacting the bank straight away to try to cancel the transfer and, if it doesn't respond, taking the case to the Bank of Spain. It also advises blocking the number, warning all staff, keeping the evidence (call logs, numbers, recordings) and reporting it to the police. The executive who was impersonated can report it too.

And one human detail: whoever made the payment often takes a while to say so out of embarrassment. The sooner it's known, the better the chance of stopping the money.

◢Can you train your team for this?

You can, and it's where you gain the most. Reading that cloned voices exist doesn't change what you do when the phone rings and the boss is in a hurry. What changes the reaction is having practised beforehand: I hang up, I call the number I already have, and that's fine.

It's one of the scenarios I work through in my cybersecurity and AI training for companies, with examples designed for non-technical teams.