Deepfake Scams: Protect Your Business From Fake Voices
A phone call that sounds exactly like your business partner, or a video call where your "boss" asks for an urgent transfer, can now be faked with AI. You cannot out-listen a good deepfake, but you can make sure no voice or face alone is ever enough to move money. Here is how to build that protection into your business.
Key takeaways
- AI tools can clone a voice from a short audio clip and create convincing fake video calls.
- Do not rely on spotting the fake. Rely on verification steps that work no matter how realistic the call is.
- Call back on a known number, use agreed code words or verification questions, and never approve a payment on the strength of a voice or video alone.
- Urgency and secrecy are the scammer's main tools, so make slowing down an official rule.
Deepfakes are audio, images or video generated or altered by AI to make someone appear to say or do something they never did. For a long time, they were mostly a concern for public figures. Now the tools are cheap and easy to use, and criminals have found an obvious business use: impersonating owners, managers, suppliers and customers to get money or information.
For a small business, the danger is not that the technology is perfect. It is that people naturally trust a voice they recognize, especially when it sounds stressed and in a hurry. A deepfake call often arrives alongside other tricks, such as a matching email or text, which makes the whole story feel consistent. This guide explains how these scams typically work and the simple, low-cost rules that defeat them. It builds on our guides to spotting phishing and stopping invoice fraud.
How deepfake scams target businesses
You do not need to understand how the technology works to defend against it. What matters is recognizing the situations in which it is used.
Cloned voice calls
Criminals can clone a voice from a short audio clip. Sources are easy to find: a video on your website, a podcast interview, a social media clip or even a voicemail greeting. The cloned voice is then used in a phone call or voice note, often to someone who handles payments, asking for an urgent transfer or a change of bank details.
Fake video calls
Video can also be faked. A scammer may set up a video call where one or more participants appear to be colleagues or executives. The picture may be slightly low quality, with the excuse of a poor connection, which also hides imperfections.
Multi-channel stories
Deepfakes are most convincing when combined with other messages. For example, an email "from the director" sets up a confidential deal, a text follows saying "call coming in five minutes", and then a cloned voice confirms the payment. Each step seems to confirm the others.
Beyond payments
Not every deepfake scam asks for money directly. Some ask a staff member to reset a password, share a login code, send customer data or approve access for a "new contractor". The goal is the same: get someone to act on a voice or face they trust.
Common mistake
Training staff to listen for robotic voices or glitches in the video. Some fakes have obvious flaws, but many do not, and the technology keeps improving. If your protection depends on noticing that something sounds wrong, it will eventually fail. Build verification steps that work even when the fake is flawless.
Why these scams work
Deepfake scams rely on the same psychological pressure as other social engineering, just with a more convincing delivery.
- Authority: the request seems to come from someone senior, so staff feel they should comply.
- Urgency: "This must go out in the next hour or we lose the deal." Time pressure stops people from checking.
- Secrecy: "Do not mention this to anyone yet, it is confidential." This prevents the most effective defense, asking a colleague.
- Familiarity: the voice or face is recognized, so the usual doubts never arise.
Once you see these levers, you can design rules that remove them. If no single person can move money alone, authority loses its power. If slowing down is always allowed, urgency loses its grip. If secret payments are never permitted, secrecy becomes a red flag.
Verification rules that beat deepfakes
The best protection is a short set of rules that apply to every unusual request, regardless of who seems to be asking or how real they sound.
- Call back on a known number. End the call and phone the person back on a number from your own records, such as the staff directory or supplier file. Never use a number given during the call or in a message.
- Use code words or verification questions. Agree a code word, or a set of questions only the real people would know, for payment and access requests. Do not store it in email or anywhere a criminal might read it, and change it if you think it has leaked.
- Never approve on voice or video alone. A payment, bank-detail change or access request must always pass your normal written approval process, however convincing the call.
- Require a second approver. For payments above a set amount, or for any new payee, a second person must approve. Make sure they verify independently, not just by asking the first person.
- Slow down urgent requests. Make it a written rule that anyone may pause an urgent payment or access request to verify it, and that nobody will be blamed for doing so.
Pro tip
Ask a question that a scammer could not answer from public information or stolen emails, such as something discussed in last week's team meeting. Keep it friendly. A real colleague will understand, and a scammer will usually find a reason to end the call.
Turn the rules into policy
Verification only works if it is expected. Put the rules in writing so that following them is the normal, safe choice, not an awkward exception.
Write a short payment and access policy
| Request type | Minimum check | Who approves |
|---|---|---|
| New payee or changed bank details | Callback on a known number | Two people |
| Urgent or unusual payment | Callback plus code word or verification question | Two people |
| Password reset or MFA change | Identity check through an agreed process | IT admin, never on a call alone |
| Sharing customer or staff data | Confirm purpose and recipient through a known channel | Data owner or manager |
| Gift card or crypto purchase request | Treat as suspicious by default | Owner, in person |
Lead from the top
Owners and managers must follow the rules too, and say so openly. If staff see the boss happily answer a code-word question, they will feel comfortable asking it. If the boss gets irritated at being checked, staff will stop checking, and that is exactly the gap a scammer needs.
Think about your public audio and video
You do not need to vanish from the internet. Videos, podcasts and social posts are valuable marketing. Just accept that your voice and face can be copied, and make sure your verification rules mean a copy is useless for moving money.
Example
Imagine a fictional marketing agency, Bright Fern Studio. Its finance assistant receives a call that sounds exactly like the founder, who is traveling. The "founder" says a new client deal needs a deposit paid to a partner agency within the hour and asks her to keep it quiet. Following the agency's policy, she says she will call back, then rings the founder's mobile from the staff list. The founder is in an airport lounge and has made no such call. The payment is never made, and the agency shares the story at its next team meeting as a reminder.
Train your team without scaring them
Staff need to know deepfakes exist, but fear alone does not help. Focus training on the steps people should take.
- Keep sessions short and regular. A ten-minute discussion of a realistic scenario works better than a long annual lecture.
- Practice the callback. Role-play a "boss on the phone" scenario so the response becomes automatic.
- Praise people who verify. Thank staff who pause and check, even when the request was genuine.
- Make reporting easy. Give one clear contact or channel for suspicious calls and messages.
- Use free material. In the UK, the NCSC offers free "Top Tips for Staff" e-learning. In the US, CISA publishes free resources on social engineering and fraud.
If you think you have been targeted
If a suspicious call or video came in but nothing was paid or shared, tell your team so they recognize a repeat attempt, and note what was asked. If money was sent, act fast.
- Call your bank immediately to try to stop or recall the payment.
- Report it. In England, Wales and Northern Ireland, report to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101. In the US, use the FBI's IC3 at ic3.gov, and the FTC at ReportFraud.ftc.gov for scams.
- Secure accounts if any logins or codes were shared, starting with email, and change passwords from a clean device.
- Keep evidence: call logs, numbers, voice notes, messages and a written timeline.
- Check your duties if personal data was shared, since a personal data breach may need to be reported. This is general information, not legal advice; check current guidance from the ICO, FTC or a qualified adviser.
Your deepfake defense checklist
- Written callback rule using numbers from your own records
- Agreed code words or verification questions for payments and access
- No payment or bank change approved on voice or video alone
- Two-person approval for new payees and large payments
- Written permission for anyone to pause urgent requests
- Password and MFA resets never done on a call alone
- Owners and managers following the same checks
- Short, regular training with a callback role-play
- One clear channel for reporting suspicious calls
Frequently asked questions
Can I detect a deepfake with software?
Some tools claim to detect AI-generated audio or video, but none is reliable enough to be your only defense. Verification steps such as callbacks and code words work regardless of how good the fake is.
How much audio does a scammer need to clone a voice?
Only a short clip may be enough, which is why public videos and voicemail greetings can be used. Rather than hiding your voice, make sure a cloned voice cannot authorize anything on its own.
What should a code word look like?
Choose something memorable but not guessable from public information, and share it in person or through a secure channel. Change it if staff leave or you suspect it has been exposed.
Are small businesses really targeted with deepfakes?
Any business that makes payments can be a target. Small teams often have fewer approval steps, which can make a convincing call more likely to succeed without good rules in place.
Related reading
The bottom line
Deepfake scams turn a familiar voice or face into a weapon, but they still need someone to act without checking. Remove that opening with callbacks on known numbers, code words, two-person approval and an explicit right to slow down. When no voice or video alone can move money, the quality of the fake stops mattering.
