The phone rings. It's the owner's voice, a little stressed: a deal is closing, the bank needs a wire in the next hour, and they can't talk long. It sounds exactly like them, because it was made from them. AI can copy a voice from a short clip, such as a voicemail greeting, a video on social media or a recorded webinar.
This guide covers how voice-clone calls work, the signs to listen for, and the code word that ends them.
How it works
- They get a sample. A few seconds of someone talking is often enough. Business owners are easy targets because their voices are on videos, podcasts and voicemail.
- They pick the moment. Often when the real person is traveling, in a meeting or hard to reach, which they may learn from social media or an out-of-office reply.
- They call someone who can move money. A bookkeeper, an office manager, a family member.
- They ask for something fast and hard to undo. A wire, a change to a vendor's bank details, gift cards, or a one-time code sent to your phone.
Sometimes the call comes with a follow-up email or text "from" the same person, to make it feel confirmed. Both can be fake.
What to listen for
A good clone sounds right, so listen to the request, not the voice.
- Urgency: "it has to go in the next hour."
- Secrecy: "don't mention this to anyone yet."
- A reason you can't call back: a bad line, a meeting, a dead battery.
- A payment method that's hard to reverse: wires, gift cards, crypto.
- A request to skip the usual approval "just this once."
- Questions you'd expect them to know the answer to, or a story that doesn't fit how they normally work.
The code word
Federal agencies, including the FBI, suggest agreeing a secret word or phrase with the people who can ask you to move money. It works because a clone can copy a voice but not a word it has never heard.
- Pick something that isn't online: not a pet's name, a street or a team.
- Share it in person, not by email or text.
- Use it for any request to move money or change payment details by phone.
- If the caller can't give it, hang up and call back on the number you already have.
A code word is a backup, not a replacement. The main rule stays the same: hang up and call back on a number you already have. A real boss won't mind. A scammer can't answer the real phone.
Make it your process
- Write down which requests need a call-back and a second approval: new payees, changed bank details, wires above an amount you choose, gift cards.
- Tell staff, in writing, that they will never be in trouble for slowing a payment down to check.
- Keep your public voice footprint in mind. You don't need to stop posting videos, but a voicemail greeting doesn't need the owner's voice.
Can this go into AI? A staffer wants to describe a strange phone call to a scam-checking tool and ask what it looks like.
Answer: Yes. Describe the call without passwords, codes or account numbers. Then call the person back on their known number.
If a call already led to a payment, call your bank's fraud team right away, then report it at ic3.gov. Our guide Stop the fake invoice has the full first-hour checklist.
Key points
- A voice on the phone is no longer proof of who's calling.
- Listen for urgency, secrecy and a reason not to call back.
- Agree a secret word, shared in person, for any money request by phone.
- Hang up and call back on a number you already have, every time.