A finance manager gets a call from her director. The voice is unmistakably his. He is travelling, the deal is urgent, and he needs £18,000 transferred before the supplier closes for the day. She hesitates for a moment, then authorises it. The director never made that call. The voice was generated by AI from a few seconds of audio scraped from a public video.

This is not a far-fetched scenario. AI voice cloning has moved far enough from the lab into mainstream criminal use that it is now a business risk every organisation needs to take seriously, not just the large ones.

What is happening

AI-enabled fraud has grown sharply. In 2025 alone, AI-assisted scams were estimated to have accounted for over $6 billion in losses in the United States. Globally, the picture is no different. Voice cloning sits at the heart of a growing category of attack that researchers call “vishing” — voice phishing. Instead of a fake email pretending to be the CEO, you get a fake phone call that genuinely sounds like the CEO.

Hany Farid, co-founder of GetReal Security and one of the world’s leading researchers on AI deepfakes, has said: “Imagine getting a call at 02:00, a voicemail, a video call, a loved one saying they’re in trouble. Or maybe it’s your CEO, screaming that he needs help logging in. The average consumer is not ready for this.”

The technology required is not sophisticated or expensive. A few seconds of someone’s voice, from a public LinkedIn video, a Zoom recording, or a conference talk, is often enough to create a convincing clone. Most business leaders have that kind of audio publicly available without realising it.

Why small businesses are at risk

Large enterprises typically have multi-stage approval processes for financial transactions. A small business or charity often does not. If the owner calls and asks a bookkeeper to move money, it can happen with a single conversation and no secondary check.

That is precisely where the risk lies. Fraudsters target the path of least resistance, and in a small team, that path can be a single phone call.

Nonprofits face an additional exposure point. Many publish contact details, event recordings, and video messages from their leadership. That audio is, unintentionally, a training dataset for voice cloning.

Three things to watch for

There are patterns that distinguish a cloned voice call from a real one, if you know what to look for.

• Urgency and pressure. Legitimate requests from senior people in your organisation rarely demand instant financial action with no time to verify. If the call insists there is no time to double-check, that is a warning sign, not a reason to comply.
• Unusual instructions. A request that bypasses your normal processes, such as sending money to a new account, not looping in the usual person, or keeping it quiet, should always trigger a pause.
• No callback option. If the caller discourages you from hanging up and calling back through a number you already have, treat the call as suspect.

What you can do about it

The good news is that practical defences do not require expensive technology.

The most effective one is a code phrase. Security experts recommend that teams establish a shared word or phrase that only internal people know. For any unusual financial request made by phone, staff ask for it. If the caller cannot provide it, the transaction does not happen. It sounds almost too simple, but it works because AI can clone a voice but it cannot know a secret your team agreed on last Tuesday.

Beyond that, a few process changes make a real difference. A rule that no financial transfer above a set threshold can be authorised by a single phone call, without a follow-up via a second channel, removes most of the attack surface. Adding a callback step, where a staff member hangs up and redials using a known number, is a low-cost control that catches most attempts.

Staff awareness matters too. The people most likely to be targeted are not the business owner but the administrators, bookkeepers, and finance staff who handle transactions day to day. They need to know this threat exists, what the red flags look like, and that they are empowered to pause and verify without embarrassment.

AI voice cloning is not going away. It will become cheaper, faster, and more convincing. The organisations that take a few minutes now to establish internal verification habits will be in a much stronger position than those that assume it will not happen to them.

If you would like help reviewing your organisation’s security posture or putting basic controls in place, we offer an IT health check that covers exactly this kind of risk.

https://www.in-the-sky-it.com