That Silent Phone Call Might Be Recording Your Voice. The One Habit That Stops Voice Clone Scams.

You ever get one of those calls where you pick up, you say hello a couple of times, nobody answers, and then they just disconnect?

It happens to all of us. Most of the time it's an autodialer checking whether your number is live. But one of the possible things happening is this: someone just got a recording of your voice. Now they can reproduce that voice, call someone else at your company, and use it to get that person to do something.

That used to sound like a movie plot. It isn't anymore.

A few seconds of audio is enough

Microsoft published research in 2023 on a voice model that could imitate a speaker it had never heard before from a three-second recording. Three seconds. That's "Hello? Hello? Who is this?" The tools have only gotten cheaper and easier since, and plenty of them are free.

Think about how much of your voice is already out there. Voicemail greetings. Webinars. Podcasts. Videos on LinkedIn and YouTube. If you're the owner or a manager, your voice is exactly the one an attacker wants, because yours is the voice people at your company say yes to.

The attack itself is simple. Your bookkeeper's phone rings. It's you, or it sounds exactly like you. You're in a hurry, you're about to board a flight, and a vendor needs a wire today or the deal falls apart. You'll explain later. Can they just take care of it?

Most people say yes. They're trying to be helpful, and the voice is right.

A hack isn't always someone breaking into a computer

When people picture hacking, they picture someone in a hoodie typing into a black screen. A lot of the time it's nothing like that. Sometimes it's just a phone call. Or it's an email asking you to change a vendor's payment details, or to send someone's paycheck to a new account.

These are the attacks that actually cost businesses money:

• In 2023, attackers reportedly called MGM Resorts' IT help desk, impersonated an employee using details pulled from social media, and talked their way into a password reset. The attack has been widely reported to have cost around $100 million.
• In 2024, an employee at the engineering firm Arup joined a video call with people who looked and sounded like the company's CFO and colleagues. Every one of them was a deepfake. The employee sent $25 million.
• The FBI's most recent Internet Crime Report puts business email compromise losses at $2.77 billion for 2024 alone, and that's only what got reported.

None of those needed a single piece of malware. They needed someone to believe the voice, the face or the email, and act.

What we tell every client: hang up and call back

One of the things we recommend to all of our clients is a two-factor process for anything that moves money, set up ahead of time.

Here's how it works. Say your boss calls and tells you to wire some money. Ahead of time, the two of you have already agreed on this: "If I ever call and ask you to wire money, you're going to hang up, call me back on my cell phone or a number you know is mine, and ask me for the password we set up."

If the voice on the first call was a clone, the real person picks up the second one and has no idea what you're talking about. The scam dies right there, and nobody had to be a security expert to stop it.

1. Any process that moves money gets a verification step. Wires, ACH payments, gift cards, payroll changes, vendor payments. If it moves money, someone confirms who is asking before it happens. No exceptions for urgency, and no exceptions for the boss.

2. Call back on a number you already have. Never the number that called you, and never a number in the email asking for the payment. Use the one in your own records: the cell number in the company directory, the vendor's number from the contract. Calling a known number from your own data, instead of trusting the inbound call, is the whole trick.

3. Agree on a password ahead of time. A word or phrase the two of you set up in person, never sent by email or text. A cloned voice can say anything, but it can't know a word that was never written down.

4. Bank detail changes get verified with the vendor directly. When a vendor emails to say they have a new bank account, call them on the number you've always used. Don't reply to the email, and don't call the number in it.

5. Paycheck changes get confirmed in person or on a known number. "Can you send my direct deposit to this new account?" is one of the most common versions of this scam, and it usually arrives as a perfectly normal-looking email from an employee's real name.

Why this works when the technology doesn't

You can buy tools that try to detect deepfake audio. Some of them are good. All of them are in an arms race with tools that get better every month.

The call-back doesn't care how good the clone is. It doesn't depend on anyone noticing that something sounds off, which matters, because the whole point of a good clone is that nothing sounds off. It moves the decision away from "does this sound like my boss?" to "did I verify this the way we agreed?" That's a question anyone at your company can answer correctly, on their worst day, under pressure.

It also takes the awkwardness out of it. Nobody wants to tell the owner, "I'm not sure that's really you." When the rule is written down and everyone follows it, hanging up is just how money moves at your company, and nobody takes it personally.

Where to start

This doesn't cost anything, and it doesn't need a project. It takes one conversation with your team.

1. List every process at your company that moves money: wires, payroll, vendor payments, refunds, gift cards.
2. Write down the verification step for each one, including the known number to call back.
3. Set up the shared passwords in person with the people who approve payments.
4. Tell the whole team, out loud, that the boss will be hung up on, and that's the point.

Doing things like this prevents some of the more common hacks we see. As you go through your day, think about how you can apply a little more security to the things you already do every day.

---

One question to answer this week: if someone called your bookkeeper today in your voice and asked for a wire, what would stop it? If you're not sure, book 15 minutes and we'll help you put the process in writing, or run our free external scan to see what an attacker can already find about your company. And if your cyber insurance renews soon, take our free Cyber Insurance Readiness Score: the twenty questions carriers ask, scored in six minutes.

Keith Parker is the CEO of Methodology IT, a managed IT services provider in Los Angeles that has supported healthcare practices, nonprofits, and growing businesses across Southern California since 1997.

Sources: Microsoft Research, VALL-E, Jan 2023 · CNN, May 16, 2024: Arup $25 million deepfake scam · FBI IC3 2024 Internet Crime Report · Adaptive Security: the MGM attack