Voice deepfake phishing: how to defend

Why do voice deepfakes matter for B2B?

Spear phishing has always worked on trust: a message that seems to come from a colleague, leader or partner. A voice deepfake adds a phone call or voice message that sounds like that person. An employee who would question an odd email may act when the familiar voice of the CFO seems to back it up.

This is a live risk, not a forecast. The FBI says criminals "can use AI-generated audio to impersonate well-known, public figures or personal relations to elicit payments".^[1] Its 2025 annual report notes that voice cloning "can also be used to request wire payment" in business email compromise.^[5]

How does a voice deepfake work?

The model learns the pitch, rhythm and accent of a voice and produces new speech in it. Research systems need very little audio: in a 2023 lab study, a model synthesized speech "with only a 3-second enrolled recording of an unseen speaker".^[6] That is a research result, not a measure of the tools criminals use. The FBI warns that AI-generated voice cloning can "sound nearly identical" to the real person.^[2]

That is all a defender needs to know about the mechanics. The practical point is that hearing a familiar voice is no longer evidence of who is speaking.

Why does a call feel trustworthy?

• Urgency and pressure. A live call leaves little time to think, and a voice message can be timed for when the real person is traveling.
• Authority. People find it harder to push back on a senior voice than on a written request.
• Spoofed caller ID. The US Federal Trade Commission notes that "Scammers can make any name or number show up on your caller ID."^[7] A call that seems to come from an internal number proves nothing.
• Channel switching. In one campaign the FBI tracked, contact began by text or voice message, followed by "a request to move communication to a secondary, encrypted mobile messaging application" almost immediately.^[3]

Where are B2B companies most exposed?

Payments. The classic case is an urgent call from a "CEO" or "CFO" asking for a transfer to a new supplier account. Voice fraud often runs alongside email: the email carries the request and the call confirms it.

Supplier changes. Accounts payable teams can receive a call from a cloned supplier contact asking to update bank details on an invoice.

Public voices. Keynotes, earnings calls, podcasts and webinars give attackers clean recordings of your leaders to copy.

Help desks and credentials. A caller posing as IT support may ask an employee to read out a sign-in code, or a caller posing as an employee may ask the help desk for a password reset. The FBI's advice is never to share two-factor codes with anyone over email, text or messaging apps.^[3]

Video is next to voice. The FBI warns that scammers generate videos for real-time video chats with alleged company executives.^[4] Our guide to executive impersonation covers the wider pattern.

Can technology detect a cloned voice?

Some security vendors analyze call audio for signs of synthetic speech, and some telephony systems compare callers against stored voiceprints. Treat these as an extra signal, not a gate. The FBI's 2025 report says AI-enabled synthetic content "is becoming increasingly difficult to detect and easier to make".^[5] A detector that misses one call, or a voiceprint matched by a good clone, should never be the only thing between a caller and a payment.

The stronger technical controls sit around the call. Phishing-resistant sign-in methods mean there is no code for a caller to collect. Our guide to AI spear phishing defenses covers them, along with the email side of these attacks.

Which process controls work?

The defenses that hold are the ones that do not rely on judging a voice:

• Callback to a known number. The FBI advises verifying a caller "by hanging up the phone, researching the contact" and calling the number directly.^[1] Use the number on file, never one the caller gives.
• Second approver for money. Any payment or bank detail change above a set threshold needs a second person, confirmed outside the call.
• Code words. The FBI suggests that families agree a secret word or phrase to verify identity.^[1] For a business, agree one between leaders, assistants and finance for urgent requests, and change it if it may have leaked.
• Training with rehearsals. Run tabletop exercises in which a "CEO" calls with an urgent request, so pausing and calling back becomes habit.
• Smaller public footprint. Leaders can be selective about long, clean audio online, though for many roles this is not realistic. Procedure matters more.

Who handles a call that worked?

If money has moved, call your bank at once and report it; in the US, that means IC3. Forensic work, legal action and incident response are done by specialist firms or counsel you contract with directly. Write their names down before you need them.

Where should a team start?

Treat voice as an unauthenticated channel, like email. Write down which requests always need a callback and a second approver, tell every leader that the rule applies to them too, and rehearse it with finance and the help desk. Our executive cybersecurity checklist lists the personal steps for leaders, and our guide to social media hijacking covers the accounts attackers use for reconnaissance. Our impersonation detection service reviews the public signals attackers use as part of our digital asset security work.