Short answer
A voice cloning scam uses software to imitate someone you know, such as a principal or a long-time vendor. Reports suggest that a short audio sample can be enough for some tools. The caller usually asks for an urgent wire or a bank detail change and asks you to keep it quiet. The most reliable defense is a procedure instead of trying to judge whether a voice sounds real. Hang up and call back on a number you already had. Insurance for this kind of loss varies by policy, so review the actual wording.
How a voice cloning scam works
The scammer collects a recording of someone’s voice. Webinars, conference talks, social media videos and voicemail greetings can all provide audio. Software then generates new speech in that voice.
The scammer calls or leaves a voicemail that sounds like a partner, principal or established vendor. The request usually involves money. Because the voice is familiar, the person receiving it may not question the request.
Three warning signs of a voice cloning scam
Most of these requests share the same pattern:
- Urgency. The payment has to go out today, or something bad will happen.
- Secrecy. The caller asks you not to mention it to anyone else.
- A payment or bank change. The request involves a wire, a new payee or updated account details.
Any one of these deserves a pause. Together they are a strong reason to verify before doing anything.
Why a call-back rule works better than listening for flaws
Audio detection tools are not reliable enough to depend on, and a person on a stressful call has little chance of hearing a difference. A rule works because it does not require anyone to judge the voice.
The FBI issued a public service announcement in May 2025 about AI-generated voice messages impersonating senior U.S. officials. That warning concerned officials rather than businesses. Its advice still applies to firms, which is to verify by calling a known number and never to share codes or send money based on an unverified request.
A one-line office policy can capture this:
“Any new payee, changed bank detail or unusual payment request is confirmed by calling back on a number we already have on file, before any money moves.”
Use a number from a signed contract or an earlier invoice. Do not use a number given in the message that made the request. The phishing and IT security checklist includes this step.
Add a code word and a second approver
Two more habits strengthen the rule. First, principals and whoever handles payments can agree on a shared code word. The word should stay off email and shared documents. If a caller claiming to be a principal cannot supply it, the request waits.
Second, require two people to approve every wire and every new payee. A second approver gives the firm another chance to catch a bad request before the money leaves.
Real-world example
Consider a hypothetical six-person engineering firm. The bookkeeper gets a voicemail that sounds like one of the partners. The message says a subconsultant’s bank details have changed. It asks her to update them and send the invoice payment today, and to keep it between the two of them.
The voicemail shows all three warning signs. She hangs up and calls the partner on his cell number from the firm’s contact list. He knows nothing about it. She then calls the subconsultant using the number on the signed agreement, and the consultant confirms the old account is still correct. The payment goes out to the original account.
What to check in your office
Firms may want to review:
- Whether a written call-back rule exists and whether everyone who touches payments knows it.
- Whether staff feel comfortable saying no to a request from a principal.
- Whether two people approve every wire and new payee.
- Whether principals and the person who pays the bills share a code word.
- Whether the firm’s policy includes social engineering coverage and what its limit is.
What insurance may do if money still goes out
A loss like this is generally called a social engineering loss. Coverage often sits within a cyber or crime policy, and it may carry a sublimit that is lower than the main limit. The glossary entry on social engineering explains the term.
Many social engineering coverages often require the firm to have verified the request, commonly by a callback, before paying. Skipping the callback can reduce or void coverage. Terms vary by policy, so the wording matters.
Hardcover insight
Firms often treat the call-back rule as a security habit and nothing more. It can also be the step a policy expects to see. A written rule that staff follow every time helps prevent the loss and may support a claim if one happens. Rules that exist only in one person’s head are harder to rely on.
Related questions
How much audio does a voice cloning scam need?
Reports suggest some tools can produce a convincing clone from a short clip. The exact amount varies by tool and by what the scammer wants to do. Assume that public videos and voicemail greetings can provide enough.
Can I tell if a voice has been cloned?
Not reliably. Detection tools and human hearing both have limits. A verification procedure protects the firm even when the voice sounds right.
What should I do if I get a suspicious call from a principal?
Do not act on it. Hang up and call the person back on a number you already had. If the request involves money, a second person should approve it as well.
Does cyber insurance cover a voice cloning scam?
It depends on the policy. Coverage may fall under social engineering or crime provisions, often with a sublimit and verification conditions. Review the policy wording or ask a broker how a specific scenario would be handled.
Should every payment need a callback?
Many firms apply it to new payees, changed bank details and unusual requests. Applying it to every payment may not be practical. The firm should choose a rule it will follow consistently.