The call sounds ordinary. Your boss is in a hurry, needs a payment handled right now, and asks you not to slow things down with the usual paperwork. The voice is familiar. The request seems plausible. So you act.
That is exactly the kind of moment an AI voice scam is designed to exploit.
AI tools can generate speech that sounds like a real person using audio samples available online. The FBI warns that criminals use AI-generated audio and other impersonation tactics to pressure people into sending money or revealing sensitive information. A voice that sounds right is no longer proof that the caller is who they claim to be.
For a small company, this is especially uncomfortable. When the boss calls with an urgent favor, that may be a normal Tuesday. Small teams often work through trust and quick conversations, without the payment controls or multiple approval layers found at larger organizations. The answer is not to distrust everyone. It is to make verification part of how urgent requests work.
How the scam works
The scammer first gathers information about the person they want to impersonate. Public videos, interviews, social media posts, and voicemail greetings can provide audio. A convincing message may be combined with details about the company, staff, or a current project.
Next comes the contact. The scammer may call, leave a voice message, or use a messaging app. They pose as an owner, manager, colleague, supplier, or another person whose request would carry weight.
Then they create pressure. The request might be to pay an invoice, change a supplier’s bank details, buy gift cards, share a password, provide a login code, or move a conversation to another platform. Urgency and secrecy are useful tools because they discourage the recipient from checking with anyone else.
A familiar voice can make the request feel legitimate, but it does not authenticate the request. The FBI advises independently identifying a phone number for the person and calling to verify suspicious requests. The FTC has also described voice-cloning scams and recommends using a number you already know to verify the caller.
Why small teams are exposed
Small businesses often rely on close working relationships. An office manager may handle invoices, scheduling, client communication, and the occasional last-minute request from the owner. A few employees may share responsibilities that would be split across finance, IT, and operations in a larger company.
That flexibility is valuable. It can also leave fewer built-in checks. If one person is authorized to send a payment and the boss asks them to do it, there may be no standard second approval. If the request comes by phone, familiar habits can take over before anyone stops to verify it.
That does not mean small businesses are helpless. A simple protocol can add a verification layer without adding a department, new software, or a pile of forms. This is the same basic lesson behind understanding social engineering: scams work by manipulating people and normal business routines, not just by defeating technology.
Five safeguards a lean team can put in place
These steps can be written down and practiced internally. You do not need to wait for a security project to begin using them.
1. Call back using a known number
If a request involves money, account access, private information, or a change to payment details, end the call. Call the person back using a number already saved in your contacts or company directory. Do not use a number provided during the unexpected call or in a follow-up message.
If the caller says they cannot be reached through the usual number, treat that as a reason to pause, not a reason to make an exception.
2. Agree on a private code phrase
Choose a simple phrase that your team can use as an additional signal for an unusual, urgent request. Share it in person or through a trusted channel, not in a public document or social media post. Keep it private and change it if it may have been exposed.
A code phrase is only a supplemental check, not proof of identity or a replacement for callbacks and normal approval. If someone cannot provide it, stop and verify another way.
3. Make unusual requests invalid by default
Write a clear rule: a request to move money, change bank details, share a password, disclose an MFA code, or send sensitive files is not valid if it arrives outside your normal process.
That means a request does not become approved just because it sounds like the owner, arrives after hours, or includes a convincing reason to skip the rules. No employee should be asked to share an MFA code. No one should be pressured to bypass a payment check.
4. Train the person who handles payments
If one office manager or employee handles wires and vendor payments, make sure they know the verification steps and have permission to pause a request. Talk through a made-up example together: a familiar voice asks for an urgent payment to a new account. What does the employee do next? Who can confirm it? What happens if the caller objects?
A procedure that only exists in the owner’s head will not help the employee receiving the call.
5. Keep the normal process, even when it feels awkward
Use the same approval steps for urgent requests as for routine ones. For example, require two authorized people to confirm new payment details, using contact information already on file. Keep credentials and account recovery codes out of phone conversations.
FBI guidance says to independently verify suspicious contacts by finding a trusted phone number and calling it. A legitimate manager may be impatient about a callback. That is still safer than sending money to the wrong account.
The setup takes minutes. The payoff depends on what it prevents.
The figures below are rough planning examples, not measured results or guarantees. Setup time varies with how your business handles requests. Time saved depends on what a successful scam would have required you to do afterward. “Money retained” means money that would otherwise have been sent in the hypothetical example. It is not new revenue.
| Verification step | Example setup time | Possible benefit | Illustrative money retained |
|---|---|---|---|
| Save a trusted callback number for key contacts | About 10 minutes | May avoid time spent investigating and correcting a misdirected payment | If it stops a hypothetical $2,500 transfer, $2,500 stays in the business |
| Agree on a private code phrase and when to use it | About 10–15 minutes | May prompt a pause, but must not replace an independent callback or approval | Depends on the value of the payment or information at risk |
| Write down which requests are invalid outside normal channels | About 15–20 minutes | Gives staff a clear next step instead of a prolonged back-and-forth | Depends on what the rule helps prevent |
| Review the steps with the employee who handles payments | About 15–30 minutes | May reduce confusion and time spent sorting out what happened | Depends on the transaction stopped |
The amounts in the table are examples to help you think through the tradeoff, not predictions. The practical return on the time spent is clarity: an employee can pause, verify, and explain why without having to decide whether to defy the boss.
If a request feels off, pause before you act
A cloned voice may sound convincing. A caller may know real details about your business. Neither is a reason to bypass your process.
Take a breath. End the call. Use a known number or an established approval channel. Do not send money, credentials, or confidential information until the request is independently verified. The extra few minutes are not an inconvenience. They are the control.
For more practical security habits, see the FTC’s guidance on voice-cloning scams and trusted-number callbacks and the FBI’s advice on independently verifying AI-generated voice messages. The rule to remember is simple: a familiar voice can start a conversation, but only a trusted verification process should approve an unusual request.
