Would your team question a payment request if the caller sounded exactly like you? If your employees are used to taking instructions from you over the phone, a call about an invoice may not seem unusual.

But a scammer using a copy of your voice could ask your bookkeeper to change a supplier's bank details and say you've already approved it. The fix isn't learning to spot a fake voice. It's making sure no payment depends on recognizing one.

The short version

A few seconds of recorded audio can be enough to copy a voice, and caller ID can be faked.
Confirm every payment change by calling back on a number you already have, never one the caller gives you.
If money already went out, call the bank first. Investigate second.

How a familiar voice gets borrowed

If you've posted a video or appeared on a podcast, that recording could be used to copy your voice. Even a short recording can be enough. Caller ID can be faked too, so a familiar voice and a familiar number don't prove who's calling.

Payment checks that don't rely on a voice

A routine your team follows every time, so nobody has to judge whether a voice sounds right.

Call back on a number you already have. For an unexpected payment or a change of bank details, your employee can say, "I'll call back to check that." They should use a number from your staff directory or supplier records, not one supplied by the caller or printed on the invoice they're checking.
Confirm the details on that call. Check who requested the payment or change and confirm the bank details. Keep a record of what was confirmed and follow your usual approval process.
Speak to the supplier directly. The caller might insist you've already checked with the supplier. Your employee should still speak to the supplier themselves, and a second approver should be able to see who confirmed what.
Don't confirm by reply email. A follow-up email from the caller isn't confirmation. If that account has been taken over, the scammer can answer your questions too.

Why the routine works

The scam depends on a few assumptions. Each check removes one.

What the scam counts on

A voice that sounds like the boss.
A caller ID you recognize.
Pressure to act before checking.
A reply email the scammer controls.

What stops it

Callbacks on numbers from your own records.
Direct confirmation with the supplier.
Permission to make the boss wait.
A second approver who can see what was checked.

Account resets and help desk calls

Bookkeepers aren't the only target. Help desks are too.

Someone impersonating you could tell IT you've lost your phone and ask them to change how you approve sign-ins. Copied voices can be used to fool help desks, not just bookkeepers.

Next time you talk with your IT provider, ask, "If I lost my phone and called for help, how would you check it was me?" Agree on a check that doesn't rely only on your voice or caller ID. Staff should keep sign-in codes private and decline any login request they didn't start. For another way attackers go after Microsoft 365 sign-ins, see our device code phishing alert.

Make checking the normal thing to do

Let your team know it's fine to make you wait while they check a payment. If someone calls back to confirm a real request from you, thank them for checking. That one habit does more than any policy document.

Whoever covers for your bookkeeper will need the same supplier contacts and instructions, including who can approve a payment when you're unavailable. And when someone reports an attempted scam, tell the rest of the team, even if nobody sent money or shared any information.

If someone already acted on the call

Call the bank first. Investigate second.

Move quickly, and don't wait until you've finished investigating. The FBI's Internet Crime Complaint Center (IC3) gives the same first step for any fraudulent transfer: contact your financial institution and request a recall of the funds.

What happened, and who to call first
What happened	What to do
Money was sent	Call your bank or payment provider right away. Say the payment was fraudulent and ask whether it can be stopped or recalled. Don't assume recovery is possible.
Bank logins or financial details were shared	Tell your bank exactly what was given out and follow its advice.
Someone approved a sign-in for the caller	Tell IT which account was involved and when it happened.
Any of the above	Keep the payment instructions, messages, recipient details, call times and any voicemail. Write down what was said while it's fresh.
Someone was impersonated	Let that person or supplier know, and report the incident at ic3.gov. If personal or confidential information was shared, get advice on whether anyone else needs to be notified.

Common questions

Quick answers to what people ask us most about this.

Can a scammer really copy a voice from a short clip?

Yes. A public video or podcast appearance can provide enough audio, which is why the checks above never rely on how a caller sounds.

Isn't caller ID enough to confirm who's calling?

No. Caller ID can be faked, so a familiar number proves no more than a familiar voice. Call back on a number from your own records.

What should our IT provider ask before resetting a sign-in?

Agree on a check in advance that doesn't depend on voice or caller ID alone, so a convincing caller can't talk their way into a reset.

Sources: FBI IC3, Business Email Compromise public service announcement; FBI Internet Crime Complaint Center.

Put a second check on every payment

We'll look at how payment changes and sign-in resets are verified today and where a simple check would close the gap.

Start with a free assessment Call 541.696.5555

Already a client? Email support@systech.io or call Option 1.

How to protect your business from AI voice scams