A caller sounds like the owner of the business and asks for an urgent payment. They know the supplier's name, say the matter is confidential and want it completed before a deadline.
The voice may be genuine. It may also be a recording, an imitation or an AI-generated copy. Staff should not have to decide by listening closely. A clear payment process is a safer test.
Why a familiar voice is not proof
Scammers already pretend to be managers and suppliers by email. Voice tools give them another way to make the request feel personal.
Audio of a business owner may be available in a social media video, webinar or public presentation. A criminal can also combine a fake voice with information gathered from websites, email accounts or previous conversations.
Caller ID is not proof either. The number shown on a phone can be misleading, and an account belonging to a real person may be compromised.
What the scammer wants
The request usually creates pressure and limits the victim's chance to check. It may involve:
- paying a new bank account
- buying gift cards
- sharing payroll, customer or staff information
- resetting an account or sign-in method
- keeping the request secret from colleagues
Urgency and secrecy are warning signs, even when the caller sounds familiar.
Do not rely on detecting a fake voice
A poor fake may sound unnatural, but a convincing call may not. Background noise, a bad connection and stress can also make a genuine caller sound unusual.
Training staff to hunt for audio flaws puts the decision in the wrong place. The business should use the same verification steps for every unusual request, regardless of how convincing the caller sounds.
Verify through a known contact method
For a payment, bank detail change or release of sensitive information, pause the request and confirm it separately.
Call the person back using a number already stored in the company directory or another trusted record. Do not use a number provided during the call. You can also start a new message through the business's usual internal system.
The confirmation should state the important details, including the supplier, amount, bank account or information requested. A vague "Did you call me?" may not catch a changed payment detail.
Require approval for important changes
Set an approval level for payments and changes to supplier bank details. The person entering a change should not be the only person checking it.
Write the process down and apply it to directors as well as staff. A scammer will often claim that the usual rules can be skipped because the matter is urgent. The policy should make clear that urgency does not remove the check.
A private verification phrase may help in some situations, but it should not replace a call back or second approval. Phrases can be overheard, shared or forgotten.
Train the people most likely to receive the request
Finance staff, receptionists, executive assistants and anyone who can reset accounts or disclose records need practical training. Use short examples that include a phone call, a video meeting and a follow-up message.
Staff also need permission to slow down and challenge a request from a senior person. A good process protects them from having to choose between security and pleasing the boss.
Plan for a fake recording
A false recording can be used to damage trust as well as steal money. Decide who will assess a suspicious recording, who can speak for the business and how customers or staff will be contacted through trusted channels.
Keep original messages, call details and related evidence. Report suspected financial fraud to the bank and the appropriate authorities as quickly as possible.
Make the verification rule easy to find before an urgent call arrives. The JCPIT Invoice Fraud Checklist gives finance staff a short call-back and approval process to follow.
For the account side, contact JCPIT to check whether email or administrator access could be used to bypass those steps.
