The phone rings on a Thursday afternoon, and the voice on the other end belongs to your CFO. It has the same cadence, the same slight rasp, the same habit of getting straight to the point. There is an acquisition in motion, it is confidential, and a wire needs to go out before the close of business. Everything sounds exactly right, because for years the sound of a familiar voice was proof enough. That assumption is the vulnerability, and attackers have learned to exploit it at scale.
I run a managed security and incident recovery firm, and the calls I take from business owners have shifted over the past year. The question used to be about firewalls and email filters. Now it is about a wire that left the building because someone on the finance team heard a voice they trusted. The technology behind that voice has gotten cheap, fast, and good enough to fool people who were actively trying not to be fooled.
What voice cloning actually is now
A voice clone is a synthetic copy of someone’s speech, generated by an AI model trained on recordings of how they talk. The part that surprises most people is how little raw material it takes. Current research shows a convincing clone can be built from as little as three seconds of audio, and even the more conservative estimates land around twenty to thirty seconds. Your executives produce that much audio constantly without thinking about it: earnings calls, conference keynotes, podcast interviews, webinar recordings, a voicemail greeting, a short video on a LinkedIn profile. Any of it is enough source material. The barrier that used to protect you, the sheer difficulty of imitating a specific human voice, has effectively disappeared.
This is not a theoretical risk
The losses are real and well documented. In 2024, the global engineering firm Arup confirmed that an employee was tricked into sending roughly $25 million across fifteen transactions after joining a video call where the CFO and other colleagues were all AI-generated. Earlier, a UK energy company lost about €220,000 when an employee followed instructions from what sounded exactly like the chief executive. In March 2025, a finance director at a multinational in Singapore authorized $499,000 after a video meeting that turned out to be entirely fabricated.
The pattern is not limited to large enterprises. The FBI’s 2025 Internet Crime Report logged more than 22,000 complaints tied to AI-enabled fraud, with reported losses above $893 million, and researchers believe the true figure is far higher because most victims never report it. Deepfake-enabled voice attacks in the United States surged more than 1,600% in the first quarter of 2025 compared with the previous quarter. This is now a volume business for criminals, and small and midsize companies sit squarely in the target set, because they tend to have fast-moving finance teams and fewer formal checks.
Why your people are the target, not your firewall
Here is the part I want every owner to sit with. None of this is a hack in the technical sense. There is no malware to catch, no exploit to patch, no suspicious attachment for your email filter to quarantine. A voice cloning attack walks straight past your security stack because it targets a person rather than a system. It works by stacking three pressures that humans are wired to respond to: authority, because the request appears to come from a senior leader; urgency, because there is always a deadline; and secrecy, because you are told to keep it quiet and not to check with anyone. When those three show up together on a phone call, the goal is to get someone to act before they think. Learning to recognize that combination is worth more than any single piece of software.
The one step that stops it
There is a single, low-tech move that reliably defeats this attack, and a Ferrari executive demonstrated it perfectly. In 2024, someone used a cloned voice of the company’s CEO, southern Italian accent and all, to push an executive toward an urgent and confidential transaction. The voice was nearly flawless. Instead of complying, the executive asked one question only the real CEO could answer: the title of a book the CEO had recommended to him days earlier. The caller could not answer, and the call ended on the spot. That one question saved the company from a major loss.
The principle behind it is called out-of-band verification, and it is the heart of the defense. When a request involves money, payment details, or sensitive access, you do not verify it through the same channel the request arrived on. You stop, and you confirm through a separate, pre-established path. The attacker controls the inbound call. They do not control a callback to a number you already had on file, and they cannot answer a question only the real person would know.
How to make that one step automatic
A defense only works if it does not depend on someone feeling suspicious in the moment, because the entire attack is designed to suppress suspicion. The fix is to make verification a rule rather than a judgment call. A few things we put in place for the businesses we work with:
- Set a hard rule that any request to move money, change banking or payment details, or grant unusual access is verified by calling the requester back on a number already on file, never a number provided during the request itself.
- Agree on a verification word or phrase in advance for your leadership and finance teams, so a quick challenge can confirm identity on a live call.
- Require dual authorization for wire transfers and payment-detail changes above a set threshold, so no single person can be pressured into acting alone.
- Give every employee explicit permission to slow down and verify a request from leadership, and make clear they will never be penalized for it. Urgency and secrecy are the tools of the scam, so removing the fear of questioning leadership removes the leverage.
None of these require new software. They require a decision and a little discipline, and they hold up even as the cloning technology keeps improving.
What this means for businesses in the CSRA
The companies I work with across Augusta and the wider CSRA are not too small to be targeted. If anything, the opposite is true. A growing business with a lean finance team, real cash flow, and leaders who are visible online is an efficient target. The defense is not about being the most technically sophisticated company in the room. It is about having one verification habit that everyone follows, every time, without exception.
If you want help building that verification process into how your team actually operates, that is the kind of work we do at Alchanis Technical Services. You can learn more at alchanistech.com.
The voice on the phone can now be faked. The verification step behind it cannot, as long as you decide to use it.
