You are halfway through a busy afternoon when your phone rings.
The caller ID shows your CFO’s name. The voice sounds right. The request seems plausible: an urgent wire transfer for a confidential transaction. The CFO says the banking details are in an email and asks you to handle it immediately.
There is only one problem.
Your CFO never called.
This is the new face of business email compromise. Criminals are combining stolen information, spoofed email accounts, caller ID manipulation, and artificial intelligence to impersonate executives with unsettling accuracy.
For small and medium-sized businesses, especially those without large finance or security departments, one convincing phone call can create a six-figure loss before anyone realizes something is wrong.
The good news is that the strongest defenses do not depend on identifying a perfect deepfake. They depend on building business processes that do not trust a voice, an email, or a caller ID by itself.
A familiar voice is not proof of identity. Verification is proof of identity.
What Is an AI Voice-Cloning Scam?
AI voice cloning uses machine-learning software to generate speech that sounds like a real person. Criminals may collect audio from public interviews, webinars, podcasts, company videos, social media posts, voicemail greetings, or other online content.
The attacker does not need hours of recordings. A short, clear sample may provide enough material to create a convincing imitation, particularly when the call takes place over a mobile phone or VoIP connection.
The cloned voice can then be used to:
- Request an urgent wire or ACH payment
- Change a vendor’s banking information
- Ask an employee to purchase gift cards or cryptocurrency
- Request login credentials or sensitive documents
- Pressure staff to bypass a second approval
- Confirm instructions already sent by email
- Impersonate a CEO, CFO, attorney, vendor, or banking representative
The technology is only one part of the attack. The more important part is the social engineering surrounding it.
The criminal may first research your company, employees, vendors, financial processes, and current projects. They may compromise an email account or imitate an executive’s writing style. Then they add the cloned voice as “confirmation.”
That combination creates a powerful illusion:
- An email appears to come from the CFO.
- A phone call appears to come from the CFO’s number.
- The voice sounds like the CFO.
- The request includes accurate company details.
- The employee feels pressure to act immediately.
Each individual clue may seem convincing. Together, they can overwhelm normal judgment.
The Attack May Start Before the Phone Rings
Some sophisticated voice-cloning scams begin with extensive research into the targeted business, its employees, and its financial processes.
Step 1: The attacker studies the business
Public websites, LinkedIn profiles, social media accounts, press releases, and company announcements can reveal:
- Who handles accounts payable
- Who reports to the CFO
- When executives are traveling
- Which vendors the company uses
- Whether the company is involved in a merger, acquisition, or expansion
- How employees communicate
- Which executives speak publicly or appear in videos
A small business can unintentionally publish a useful organizational chart through its website and social media activity.
Step 2: The criminal builds a believable story
The request may involve a confidential acquisition, an overdue supplier payment, a real estate closing, a tax issue, or an urgent legal matter.
The story does not have to be completely invented. A criminal can use a real project or legitimate invoice and change only the payment instructions.
This is why familiar details are not enough to establish trust. Attackers often know just enough about a business to sound credible.
Step 3: AI creates the voice
The attacker uses collected audio to generate new speech in the executive’s voice. The goal is not always perfect imitation. A voice that sounds “close enough” can work when combined with urgency, authority, and a believable context.
Step 4: The scammer adds pressure
The caller may say:
- “I need this completed before the end of the day.”
- “This is confidential, so do not involve the rest of the team.”
- “The bank is waiting for confirmation.”
- “I am about to walk into a meeting. Just follow the email.”
- “We cannot use the normal process this time.”
- “Stay on the line while you complete the transfer.”
The pressure is intentional. It gives the employee less time to think and makes normal verification feel like disobedience.
The FBI Is Treating AI-Enhanced Fraud as a Business Risk
The Federal Bureau of Investigation has warned that criminals are using generative AI to create convincing text, images, audio, and video for financial fraud.
In its 2024 public service announcement on generative AI, the FBI specifically identified vocal cloning as a tool criminals can use to impersonate people and elicit payments. The agency also warned about real-time video chats featuring alleged company executives or other authority figures.
The FBI’s 2025 Internet Crime Report shows the scale of the broader problem:
- IC3 recorded 24,768 Business Email Compromise complaints in 2025.
- Reported BEC losses exceeded $3 billion.
- IC3 received 22,364 complaints that included an AI-related descriptor.
- AI-related complaints represented more than $893 million in reported losses across all crime categories.
- Businesses reported more than $30 million in losses from BEC scams involving AI. That figure covers AI-assisted BEC generally, including text-based impersonation and other AI-assisted techniques, not only voice-cloning scams.
- The report specifically notes that voice cloning may be used to request wire payments or provide instructions.
These numbers reflect reported complaints. Many victims do not report fraud because of embarrassment, uncertainty, or the belief that reporting will not recover the money.
The figures also do not mean every BEC scam uses AI. Traditional account compromise, phishing, and executive impersonation remain common. AI is making those existing methods faster, cheaper, and more convincing.
Real-World Examples Show How Quickly Trust Can Collapse
One widely reported case involved employees at engineering firm Arup’s Hong Kong office. An employee joined what appeared to be a video meeting with senior company leaders and was instructed to transfer approximately $25 million. The meeting appeared legitimate, but the participants were reportedly deepfakes.
The important lesson is not that every video meeting is suspicious. It is that visual and audio confirmation can no longer be treated as conclusive proof of identity.
The FBI’s 2025 Internet Crime Report also describes several Business Email Compromise cases involving fraudulent wire instructions. These are examples of broader BEC, not confirmed AI voice-cloning scams.
In one example, a Missouri homebuyer received an email impersonating a legitimate title company and sent more than $1.3 million to a fraudulent account. The FBI worked with banking partners to freeze the fraudulent recipient account. In another, an Oregon city office was targeted in a BEC incident involving a wire of more than $6 million. After the FBI connected the transfer to an account previously flagged in the Missouri investigation, the originating bank issued a recall.
These cases involve different combinations of email compromise, impersonation, and social engineering. The shared pattern is clear:
- The request appeared to come from a trusted party.
- The transaction involved a large or irreversible payment.
- The victim acted before independently verifying the instructions.
- Speed mattered once the fraud was discovered.
Why Connecticut SMBs Are Attractive Targets
Connecticut has thousands of small and mid-sized companies across professional services, manufacturing, healthcare, construction, real estate, finance, and technology.
Many of these companies have valuable payment capabilities but limited internal security resources. That creates an attractive environment for fraud.
A smaller company may have:
- One person handling accounts payable
- A controller who also manages payroll and operations
- Executives who communicate informally by text or phone
- Limited separation between payment preparation and approval
- Vendors with long-standing relationships
- Employees who know each other well and trust familiar voices
- Publicly available information about leadership and projects
- No formal playbook for suspicious payment requests
According to the Federal Trade Commission, Connecticut consumers reported approximately $90.3 million in fraud losses in 2024. Although this figure is not specific to businesses or AI-powered scams, it illustrates the significant financial impact of fraud throughout the state.
The FBI’s 2025 Internet Crime Report recorded 9,714 complaints associated with Connecticut and more than $219 million in reported losses across crime types. Those figures are not limited to businesses or BEC, but they reinforce the need for Connecticut organizations to take cyber-enabled fraud seriously.
An older Connecticut Business & Industry Association cybersecurity survey from 2018 also found persistent gaps in training, vulnerability testing, security budgets, and incident response planning. The survey is dated and should not be treated as a current measurement of every Connecticut business, but its central lesson remains relevant: uncertainty about cybersecurity creates room for attackers to operate.
Warning Signs of an AI Voice Scam
You may not always be able to identify a cloned voice by listening. Audio quality, background noise, stress, and poor phone connections can make a real person sound unusual.
Instead of relying on detection alone, watch for behavioral and process warning signs.
Urgency
The caller wants action now and discourages delay.
Urgency is common in legitimate business situations, but it should never override payment controls. A genuine executive should understand that a large transfer requires verification.
Secrecy
The caller says the request must remain between you and them.
This is one of the most important warning signs. Criminals want to isolate the employee from coworkers who might recognize the fraud.
A new or changed bank account
A vendor’s banking information suddenly changes. A new beneficiary is added. The account is located in a different state or country. The request may arrive just before a payment deadline.
Never approve a payment change based only on an email or phone call.
Pressure to bypass normal procedures
The caller says:
- “You do not need a second approval.”
- “The normal process is too slow.”
- “I will take responsibility.”
- “This is a one-time exception.”
- “Do not wait for the controller.”
A request to bypass controls is not evidence of authority. It is evidence that the controls are working.
An unusual communication channel
The message arrives through a personal email account, text message, WhatsApp, social media, or an unfamiliar collaboration account.
Channel switching can also be suspicious. For example, an attacker may send an email and then call to make it feel more legitimate.
The voice is almost right
Possible audio clues include:
- Unnatural pauses
- Odd pacing
- Repeated phrases
- Digital artifacts
- Missing or unusual background sounds
- Incorrect emotional tone
- Strange pronunciation
- Responses that do not fit the question
However, do not make voice quality your primary defense. A high-quality clone may sound natural, and a legitimate caller may sound unusual.
The Most Important Defense: Call Back Using a Trusted Number
If a phone call requests money, sensitive information, credentials, or a change to payment instructions, end the call.
Then contact the supposed executive using a number you already trust.
Do not call back using:
- The number shown on caller ID
- The number provided by the caller
- A number included in the suspicious email
- A number found through a questionable search result
Use the company directory, an established contact record, a known mobile number, or another independently verified method.
Your policy can be simple:
No significant payment request is valid until the requester is independently verified.
A callback is not rude. It is a standard business control.
You can also create an internal verification phrase or challenge question. Keep it private, rotate it periodically, and do not use information that appears on the company website.
The phrase should support your process, not replace it. For large transfers, use both an independent callback and a second approval.
Build Multiple Layers of Protection
An AI voice scam is a human deception problem, but it can be supported by compromised email, weak identity controls, exposed systems, or poor monitoring.
That is why businesses need defense-in-depth cybersecurity.
Defense in depth means no single security measure is expected to stop every attack. Instead, multiple layers reduce the chance that one mistake becomes a major loss.
1. Payment controls
Create written rules for:
- New vendor onboarding
- Vendor bank-account changes
- Large wires and ACH payments
- International payments
- Emergency payment requests
- Gift cards and cryptocurrency
- Executive overrides
Require two people to approve significant transfers. The second approver should independently verify the payment details rather than simply click “approve.”
Where possible, use bank controls such as transaction limits, dual authorization, payment alerts, and call-back procedures.
2. Identity and access controls
Enable multifactor authentication for email, banking, remote access, and administrative accounts.
Use separate administrator accounts. Apply least privilege so employees can access the systems and payment tools required for their jobs, but not everything.
If an attacker compromises an executive’s email, MFA and conditional access policies may limit what the criminal can do next.
3. Email and domain protection
Your email environment should be configured to reduce spoofing and impersonation.
Ask your IT provider to review:
- SPF
- DKIM
- DMARC
- External sender warnings
- Suspicious forwarding rules
- Mailbox login alerts
- Impossible-travel and unusual-login detections
- Executive impersonation protections
These controls will not stop every phone-based scam, but they can make it harder for criminals to establish the first stage of the story.
4. Vulnerability scanning and patch management
Vulnerability scanning does not detect whether a voice is fake. It protects another part of the attack chain.
If an unpatched firewall, remote-access tool, workstation, or cloud application is compromised, criminals may gain access to email threads, invoices, contact lists, and internal conversations. That information can make a later voice scam much more convincing.
Regular vulnerability scanning, prioritized patching, endpoint protection, and secure configuration reduce the information available to attackers.
5. Network and cloud identity monitoring
Traditional network monitoring watches traffic, devices, and access to business systems. It can help identify unusual connections, unauthorized remote tools, and movement between devices on your network.
seeing that the real CFO’s mailbox was accessed from an unfamiliar location, or that a finance employee’s account is behaving abnormally, generally requires monitoring of cloud identities, such as Microsoft Entra ID sign-in logs, Microsoft 365 audit logs, and identity-threat detection tools that alert on unusual sign-ins and account activity.
Both layers matter. Firewalls and network monitoring alone will not tell you who signed in to a cloud mailbox; identity monitoring alone will not see what is moving across your network.
Strong network security combines prevention with visibility. You cannot respond to activity you cannot see.
6. Backups and incident response
A voice scam may cause financial loss without encrypting a single computer. However, the same compromised account or weak security control could support ransomware, data theft, or business disruption.
Maintain tested, protected backups. Create an incident response plan that includes:
- Who contacts the bank
- Who contacts your IT provider
- Who reports to law enforcement
- Who informs leadership
- How evidence is preserved
- How employees communicate during an incident
- How payment systems and accounts are reviewed
Security Awareness Training Must Include Voice Scams
Traditional phishing training often focuses on suspicious links and attachments. That is no longer enough.
Employees who manage money, vendors, payroll, or sensitive data should practice scenarios involving:
- A cloned CEO or CFO voice
- A fake vendor payment-change request
- A suspicious video meeting
- A demand for secrecy
- A request to buy gift cards
- A caller who refuses independent verification
- An urgent request received outside normal business hours
Training should make the correct response clear:
- Stop the transaction.
- Do not argue with or challenge the caller.
- End the call.
- Verify through a trusted channel.
- Notify the designated person.
- Preserve the email, voicemail, call details, and transaction information.
This is the practical goal of IT security awareness training in Connecticut and anywhere else: employees should know what to do under pressure, not merely recognize cybersecurity vocabulary.
A good policy also protects employees from executive pressure. Staff should be told that following verification procedures is expected, even when the request appears to come from the owner, CEO, or CFO.
What to Do If You Already Sent the Money
If you believe an AI voice scam or BEC incident has occurred, act immediately.
Contact the bank
Call your financial institution’s fraud department using an official number. Ask whether the transaction can be stopped, recalled, or frozen.
Time matters. The FBI’s Recovery Asset Team works with financial institutions to help freeze funds in certain cases, but recovery is never guaranteed.
Preserve evidence
Save:
- Emails and full email headers
- Voicemails
- Phone numbers and call logs
- Text messages
- Screenshots
- Payment instructions
- Bank transaction details
- Names of recipients and financial institutions
- Relevant video meeting information
Do not delete suspicious messages before preserving them.
Report the incident
File a report with the FBI’s Internet Crime Complaint Center, even if the amount was small or the attempted fraud failed.
You may also report fraud through the Federal Trade Commission. Depending on the circumstances, contact local law enforcement, your cyber insurance carrier, legal counsel, and your managed IT provider.
Secure potentially compromised accounts
Change affected passwords, revoke active sessions, review mailbox forwarding rules, inspect MFA settings, and check for unauthorized users or payment changes.
Your IT team should investigate whether the scam involved only social engineering or whether an email account, endpoint, or network resource was compromised.
A Practical Policy for Connecticut Business Owners
Every SMB can adopt the following rule:
A voice can request. A trusted process must approve.
Document the process and make it easy to follow:
- No wire transfer based only on a phone call
- No vendor bank change based only on email
- No executive override without a second authorized person
- No secrecy requirement overrides company policy
- No use of caller ID as proof of identity
- No employee is penalized for pausing a suspicious transaction
- All suspected scams are reported immediately
Then test the policy.
A tabletop exercise can take 20 minutes. Have someone play the role of a CFO calling with an urgent payment request. Ask employees what they would do, who they would call, and where the decision would be documented.
The goal is not to embarrass anyone. It is to make the safe response familiar before a real criminal creates pressure.
How FoxPowerIT Can Help
AI voice scams are not solved by one product. They require people, processes, visibility, and technical safeguards working together.
FoxPowerIT helps Connecticut businesses build that foundation through managed IT services, proactive cybersecurity, network administration, security management, system maintenance, help desk support, and compliance assistance.
Our approach can include:
- Security and risk assessments
- Network security reviews
- Vulnerability scanning
- MFA and identity protection
- Email security configuration
- Network monitoring
- Backup and recovery planning
- Incident response preparation
- Employee security awareness training
- Layered defense-in-depth planning
If your company needs cybersecurity services for small businesses in Connecticut, start with a conversation about your current payment process, access controls, employee training, and response plan.
A scammer may be able to copy a voice. They should not be able to bypass your business process.
Protect the payment. Verify the person. Trust the process, not the voice.
Contact FoxPowerIT to discuss a practical cybersecurity strategy for your business.