AI has reached a point where some models can pass a Turing test under specific conditions, create convincing photos and videos of real people, and copy voices.
An AI voice-cloning fraud is particularly dangerous in corporate finance because it can imitate a voice used to verify someone’s identity.
But even without bypassing voice recognition, it’s a very dangerous tool – someone can impersonate a CEO, police chief, politician, or anyone else with authority to make decisions.
Imagine a fake CEO calling accountants to transfer money for unexpected expenses. Such cases have already happened.
We already have troubling results overall with AI using voice cloning: McAfee researchers found that one tool needed only three seconds of audio to produce an 85% match to the original speaker, according to their own assessment. In a 2023 McAfee survey, 1 in 10 adults said they had been personally targeted by an AI voice scam, while 15% said it had happened to someone they knew.
The technology behind voice cloning and synthetic audio
From audio sampling to real-time generative models
In a 2023 McAfee survey, more than half of adults surveyed in seven countries said they shared their voice at least once a week online or on social media. This can make it easier for scammers to get an audio sample.
Moreover, modern neural networks can learn and reproduce features of a voice, such as timbre, pitch, cadence, and regional accent, so cloned voices can sound less robotic than older ones.
With some voice-cloning tools, a scammer can speak into a microphone and sound like someone else. The result can be convincing enough that some people won’t notice the difference.
This is why deep-fake audio scams are dangerous and really work.
Social engineering 2.0: why voice deepfakes succeed
Before, social engineering was scripted: scammers called and pretended to be someone else.
Now, with CEO fraud voice cloning, you can just get a call from your “boss” with new directives.
In the same survey, out of 7,054 people across seven countries, 70% said they weren’t confident they could tell a cloned voice from a real one. This research is from 2023, and AI has only gotten better at doing this since then.
Open an account
in Genome online
Common deepfake attack vectors in corporate finance
CEO impersonation and urgent wire transfers
Every CEO call is urgent, but not every one demands a confidential transfer for closing a deal or settling a supplier dispute you have never heard of before.
Real-life case from 2019: this is one of the first publicly reported cases of suspected CEO fraud voice cloning.
The head of a UK energy firm took a call from someone who sounded like the chief executive of his German parent company, including the accent, according to the insurer Euler Hermes. He sent approximately €220 000 to a Hungarian bank account supposedly belonging to a supplier within the hour. The caller phoned again to claim the money had been reimbursed, then a third time to ask for more money. The promised reimbursement hadn’t arrived, and the third call came from an Austrian number, raising the executive’s suspicions.
Here’s another one: in January 2024, a finance employee at engineering firm Arup’s Hong Kong office joined a video call with the “CFO” and several colleagues, who appeared as deepfake recreations. First, he received an email asking him to transfer money, which he thought was just a phishing email.
Then the scammer invited him to a call, where he met a “CFO” of his company.
He made 15 transfers totaling approximately €23.3 million. Arup confirmed that fake voices and images were used.
Vendor impersonation and bank detail redirection
But CEO fraud voice cloning is not the only dangerous fraud type nowadays. Deepfake audio scams can target anyone, really.
Sometimes a scammer can clone the voice of a supplier’s account manager and spoof their phone number. Then they claim there’s an “emergency change” to the account where the next invoice should be paid.
This type of payment redirection is a critical focus area for financial fraud prevention, as it often forms part of Business Email Compromise (BEC), even when voice cloning isn’t explicitly used. The FBI’s Internet Crime Complaint Center’s 2025 report recorded $3.05 billion in reported BEC losses across 24,768 complaints in 2025. Those are only the cases reported to the IC3.
Executive credential theft and IT helpdesk social engineering
Internal help desks are also potential targets. The USA’s Financial Crimes Enforcement Network flagged a rise in suspicious activity reports involving suspected deepfake media, particularly fraudulent identity documents used to bypass identity checks at financial institutions.
Synthetic voice impersonation aimed at the internal helpdesk can lead to a password reset, a reset of a 2FA method, or approval of access to a payment portal.
The help desk staff are trained to be helpful, which scammers can exploit when asking for access or account changes as part of the synthetic voice impersonation.
Without reliable identity checks, a successful reset can give an attacker access to an employee’s account, resulting in an AI voice-cloning fraud.
Detecting synthetic voice fraud: practical red flags
There is no foolproof way to tell where a person ends and the AI begins. Also, AI voices keep improving. But some characteristics, at least for now, can be signs of a voice deepfake.
Acoustic and conversational anomalies
This is tricky: a voice can sound unnatural because it isn’t a perfect replica; on the other hand, a convincing copy may sound just like the person, including their verbal quirks.
The possible red flags:
Monotone pitch or flat emotion during a high-stress request.
Unusual latency, unnatural pauses before answers, or background audio that cuts in and out.
Metallic distortion, robotic clipping on vowels, or a repetitive speech rhythm.
Behavioral warning signs
Behavioral voice deepfake red flags can be useful alongside acoustic ones. They are also common in deepfake audio scams and other types of BEC fraud:
Insistence on immediate action and refusal to use established internal channels.
Heavy emphasis on secrecy, such as “keep this confidential until the board approves.”
Deflection when asked open-ended questions about shared memories or non-work topics.
These signs don’t always prove a request is fraudulent, but they are still something you need to pay attention to.
Defense strategies for financial fraud prevention: how organizations can prevent voice-cloning losses
AI voice-cloning fraud uses technology to impersonate people and manipulate employees. Verifying unusual requests in person, where possible, can add another layer of security.
Other than that, you can reduce the risk of deepfake audio scams by doing this:
Mandatory out-of-band verification
Don’t approve a request based on an incoming call alone. Use a separate, verified, pre-established communication channel to confirm requests to move funds, change payment details, or lift a limit.
For example, end the call and call the person back using a number already on file, even if the incoming call appeared to come from a known number.
A video call alone is no longer reliable proof of identity either.
Dual-control authorization and maker-checker workflows
Don’t make scammers’ lives easy: consider requiring two people to approve payments, particularly high-value or unusual ones.
Require two independent authorized signers for payments covered by your company’s approval policy, whether they are domestic payouts or cross-border transfers. Both should check the payment details independently.
If you work in an office, encourage employees to visit each other in person if they have doubts.
Establishing corporate verification phrases and internal security culture
They can replicate someone’s voice, but a private verification phrase can provide an extra check. Keep the phrase secure and use it alongside other verification and approval procedures.
A phrase is not foolproof: criminals could learn it, overhear it, or persuade someone to reveal it.
Training should ensure employees verify unusual requests, regardless of the apparent seniority of the person making them.
Open an account
in Genome online
Securing your business finances with Genome
Process controls work best when the platform enforces them too. The best financial fraud prevention is when the platform simply doesn’t let you make mistakes in the first place.
Genome account security tools do just that. Our clients benefit from:
Regulated electronic money institution. The Bank of Lithuania supervises Genome and holds it to EU safeguarding and security requirements.
Mandatory two-factor authentication (2FA). Every login and outbound transfer requires dedicated 2FA authorization, so stolen credentials or a phone call alone cannot move funds.
Biometric access controls. App-based fingerprint and facial recognition block access from secondary devices.
Role-based permissions (shared business account). Business wallet owners can assign roles to employees who also manage accounts with strict limits and approval thresholds.
Institutional compliance. Built to PCI DSS standards and operational resilience principles aligned with the EU Digital Operational Resilience Act (DORA).
Access Genome account security tools, as well as a broad scope of financial services: start a business wallet inside Genome.
