← All Blogs

The deepfake voice call your finance lead will receive this year

By Best IT MSP Editorial Team - Updated October 21, 2026 - 11 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

Will your finance lead really get a deepfake voice call this year?

Probably not this year. Most finance teams will not take a cloned call in the next twelve months, and the measured numbers say so. The attempt rate is climbing steeply enough that the control is worth writing down now, and the control costs nothing.

The Association for Financial Professionals asked the question directly. In its 2026 payments fraud research, only 6 percent of survey respondents reported a confirmed deepfake-related incident. The figure beside it is the more interesting one. 40 percent said they were unsure whether it had happened to them. That second number is the real finding, and we come back to it at the end.

The direction of travel is steeper than the current base rate. CrowdStrike's threat hunters recorded vishing intrusions in the first half of 2026 at twice the level of the second half of 2025. Vishing is voice phishing, a phone call doing the job an email used to do. FinCEN has separately observed an increase in suspicious activity reporting by financial institutions describing the suspected use of deepfake media, which is a regulator telling you the filings are arriving.

Here is the reassuring part, and it belongs near the top rather than buried at the end. Voice cloning fraud is defeated by the same payment controls that already stop ordinary invoice fraud. You do not need a detection product, a new license, or a technical skill. If your bookkeeper already calls a supplier back on a number from your own records before changing bank details, you have defended against this, and you did it before anyone used the word deepfake.

This post does three things the parent article on business email compromise is not phishing deliberately left alone. It explains why advice to spot a fake fails, it sets out what a call-back procedure has to look like to be worth anything, and it makes the case that a voice was never an authentication factor in the first place.

Why does learning to spot a deepfake not work?

Learning to spot a deepfake does not work because trained listeners still miss more than a quarter of synthetic audio. Researchers at University College London played genuine and generated speech to 529 people and found that listeners only correctly spotted the deepfakes 73 percent of the time. Roughly one fake in four went straight through.

Training moved that number barely at all. The same peer-reviewed study reports that increasing listener awareness by providing examples of speech deepfakes only improves results slightly. That single sentence ends the awareness argument for this particular attack. You can train a person to pause before clicking a link, because a link is a thing with properties. You cannot train an ear to a dependable score, and 73 percent is not a control.

The authors add a caveat that makes the picture worse rather than better. Their samples came from relatively old generation methods, so a tool released since then is likely harder to catch. The Federal Trade Commission put the same point in one phrase when it opened its voice cloning work, noting that cloned voices replicate a person in a way that is hard to detect by ear.

The input requirement is the other half of the story, and it is the part that surprises owners. A published research model synthesizes high-quality personalized speech with only a 3-second enrolled recording of an unseen speaker. Three seconds is enough to clone a voice. A voicemail greeting, a conference panel clip, a webinar introduction, the hold message on your own main line. The FTC notes that many of these systems are commercially available or even open sourced, so they can be easy for anyone to access.

Three consequences follow, and each one closes a door that detection advice tries to hold open.

• Sample scarcity is gone. Any owner who has spoken on a recorded webinar, a podcast, a conference panel or a voicemail greeting has published enough audio to work from.
• Audio quality is no longer the tell. A thin, flat, robotic voice was the old giveaway. Current synthetic audio carries breath, hesitation and accent, so the signal you were taught to listen for has gone.
• The listener is under pressure. A convincing pretext arrives with a deadline attached, and careful listening is the first skill that degrades when somebody is rushed.

So the defense cannot sit in the ear. It has to sit somewhere a cloned voice cannot reach.

Voice was never an authentication factor

A voice was never an authentication factor, and the standard that defines authentication factors says so in plain words. NIST Special Publication 800-63B, the federal digital identity guideline, states that a biometric characteristic is not recognized as an authenticator by itself.

Two more sentences from the same section finish the argument. NIST states that biometric characteristics do not constitute secrets, and that biometrics SHALL only be used as part of multi-factor authentication with a physical authenticator. A voice is a biometric. It is observable, recordable and reproducible, which is the precise opposite of a secret. Voice authentication on a bank line always rested on the cost of imitation rather than on secrecy, and that cost has now collapsed. A voice cannot authenticate anyone.

Recognizing a colleague's voice was therefore never a control either. It was a social cue. It held up for decades because faking it convincingly was slow and expensive, and that made the cue reliable enough that nobody examined it. The deepfake did not break your authentication. It removed the illusion that you had any.

A cloned voice does not defeat your controls. It reveals that the voice was doing a job no control had ever been assigned.

Caller ID is the same illusion wearing a different surface. Attackers spoof the number as readily as they clone the voice. The FBI's advisory on impersonated officials describes campaigns using software-generated phone numbers not tied to a subscriber, so the name on the handset is a display string rather than evidence. Caller ID spoofing has been cheap for years, and most people still read the screen as identification.

Accept that framing and the whole question changes shape. You stop asking how your staff will tell a real call from a synthetic one, which is unanswerable, and start asking what your process currently lets a phone call do. Those are two very different projects, and only the second one can be finished.

What makes a business deepfake call different from a phone scam

A business deepfake call differs from a consumer phone scam in one respect that decides everything. The caller already holds your context. They know the supplier's name, the invoice number, the amount and the due date, because somebody has been reading a mailbox.

That context comes from business email compromise, which is why this attack is a sequel rather than a new story. The FBI logged 24,768 business email compromise complaints in 2025, with $3,046,598,558 in reported losses. The AFP's 2026 research found business email compromise cited by 70 percent of survey respondents as the top avenue of attempted or actual fraud. The mailbox access is routine. The call is the finishing move.

Pretexting is the technique that joins the two. The attacker builds a believable situation first and asks second. The FBI describes the impersonation campaigns it tracked as using text messages and AI-generated voice messages to establish rapport before gaining access. Rapport first, request later. Nothing in the early contact looks suspicious, because nothing in the early contact asks for anything.

Three shapes account for most of what actually reaches a finance team.

• CEO fraud with a voice attached. An email appearing to come from the owner asks for an urgent transfer, and a call follows within the hour to confirm it. The call exists only to clear the hesitation the email created.
• A vendor bank-detail change plus a confirmation call. The email thread is genuine, because the supplier's mailbox is compromised. The call then confirms details your clerk was already half expecting to see change.
• A call to a help desk rather than to you. The attacker impersonates one of your employees to get a password reset or a re-enrolled authenticator. The doubling in vishing intrusions is largely this, and it is how the next attacker gets the mailbox.

Notice what the voice adds. It does not create the fraud. It removes the last doubt in a request the email has already made. The voice is the second factor the attacker supplies on your behalf, which is exactly why the counter has to be a second channel you choose yourself.

What does a call-back procedure actually have to look like?

To make a call-back worth anything, you dial out to a number you already held before the request arrived. Every other arrangement fails, and the failures are specific enough to list.

Six rules define a call-back procedure that a cloned voice cannot pass.

• Dial out yourself, always. Never treat an inbound call as verification. A deepfake voice on an inbound line proves nothing at all, because the attacker picked the number and picked the moment.
• Take the number from your own vendor file or payroll record, never from the email, the invoice, the remittance slip or the signature block. The FBI's guidance is to independently identify a phone number for the person and call to verify their authenticity.
• Hang up first when a call arrives claiming to be your bank or your supplier. The FBI advises you to verify the identity of the person calling you by hanging up the phone and then call the organization back on a number you looked up yourself.
• Agree a passphrase out of band with everyone who can authorize a payment. The FBI's own tip is to create a secret word or phrase with your family to verify their identity, and the same mechanic works between an owner and a finance lead. A passphrase is a shared secret, which is precisely what a voice is not.
• Record the call-back in the payment file. Who called, which number, where that number came from, and when. An unrecorded verification is indistinguishable from one that never happened.
• Escalate instead of deciding, if the call-back fails or the number does not answer. Nobody in your business pays on a voice alone, and that sentence belongs in writing rather than in somebody's judgment.

The passphrase deserves a note, because it is the one step that genuinely beats synthesis rather than slowing it down. A cloned voice reproduces how a person sounds. It cannot produce a phrase the two of you agreed in a corridor last March and never typed anywhere. Keep it out of your mailbox, out of your CRM and out of any system an attacker might already be reading.

Out-of-band verification is the general name for all six rules, and people misapply it constantly. Out of band means a channel the attacker does not control. A reply to the email is not out of band. A number printed inside the message is not out of band. A chat thread the request has moved to is not out of band either, and the FBI specifically flags attackers suggesting a move to a separate messaging platform as a common tactic in these campaigns.

What to write down this week, and what to ask your provider

Write one sentence first, then put three rules underneath it. The sentence is that no payment and no bank-detail change is ever authorized by voice alone. Date it, sign it, and keep it where your bookkeeper can point at it when somebody applies pressure.

The three rules underneath are ordinary payment controls, and they are set out in full in business email compromise is not phishing rather than repeated here. Out-of-band verification on every bank-detail change. Dual approval above a threshold you set yourself, where one person enters a payment and a different person approves it. No payment detail changed from an email thread alone. Dual approval carries the heaviest load of the three and earns an article of its own.

Then ask five questions. Three belong to whoever pays your invoices, and two belong to your IT provider. A good answer contains a date, a file name or a procedure. A weak answer contains the word careful.

• Read me our written rule on authorizing a payment by phone, exactly as it stands today.
• Name the file a clerk opens to find a supplier's phone number, and show me it is not the invoice.
• State who holds a passphrase with the owner, and when it was last changed.
• Show me the last help desk password reset, and how the caller's identity was verified before it was granted.
• Confirm whether our executives' voicemail greetings and recorded talks are published online, and whether anybody decided that on purpose.

Question four is the one most providers answer badly, and it is the one that costs the most. A help desk that resets a password on a convincing phone call has handed over a mailbox, and the mailbox is where the next call gets its context. Ask for the verification step in writing, not for an assurance that the team is careful. Our business email security page covers what a filtering and authentication service should include around it, and Report rate, not click rate covers the training metrics that actually move.

Notice that four of the five questions are non-technical, and that none of them buys anything. That is the shape of this entire problem. The AFP finding that 40 percent of respondents were unsure whether a deepfake incident had happened to them is not a detection gap waiting for a product. It is what happens when nobody wrote down which calls are allowed to move money, so nobody can say afterwards what any given call was allowed to do.

Keep this proportionate

Keep the response proportionate to the measured risk. The NSA, FBI and CISA state that threats from synthetic media, such as deepfakes, have exponentially increased, and that is true of the technology. It is not yet true of the base rate inside a small business, where the AFP's confirmed-incident figure is 6 percent. Both facts are real, and a fear piece uses only the first one.

So treat a cloned voice as one more delivery route into a process you already have to protect. Social engineering has run on urgency, authority and a believable story for as long as there have been invoices to pay, and the taxonomy of those approaches is covered in Phishing vs Spear Phishing vs Whaling. Synthetic audio makes the story cheaper to tell. It does not change which door the money leaves by.

Train your finance team on the process rather than on the tell. Teach the rule, not the symptom. A clerk who knows nobody will blame them for taking ten minutes to call a number out of the vendor file is better defended than a clerk who has watched an hour of video on spotting a fake, and the rule is far cheaper to arrange than the video.

We are an independent directory and we have nothing to sell you here. Write the one-sentence rule, name the vendor file, agree the passphrase, and take the five questions to three merit-ranked providers in your city. Nobody can promise any of this is complete. The provider who answers question four with a procedure rather than a reassurance is the one doing the work.

FAQ

Can you tell if a voice on a phone call is AI-generated?

No, not reliably. A study of 529 listeners found they only correctly spotted the deepfakes 73 percent of the time, and providing examples of speech deepfakes only improves results slightly. The FTC notes cloned voices replicate a person in a way that is hard to detect by ear.

How much audio does someone need to clone a voice?

About three seconds. A published research model synthesizes high-quality personalized speech with only a 3-second enrolled recording of an unseen speaker. The FTC adds that many of these systems are commercially available or even open sourced, so a voicemail greeting or a recorded webinar is sample enough.

What is out-of-band verification for a phone call?

Out-of-band verification means confirming a request through a channel the attacker does not control. You dial out to a number from your own vendor file. The FBI advises you to independently identify a phone number for the person and call to verify their authenticity, never a number offered during the call.

Does a passphrase actually stop a deepfake voice call?

Yes, because a passphrase is a shared secret and a voice is not. The FBI advises people to create a secret word or phrase to verify identity. NIST states that biometric characteristics do not constitute secrets, so cloning how somebody sounds reveals nothing about a phrase agreed out of band.

How common are deepfake voice attacks on small businesses?

Still uncommon, and rising. The 2026 AFP survey found only 6 percent of respondents reported a confirmed deepfake-related incident while 40 percent were unsure. CrowdStrike recorded vishing intrusions in the first half of 2026 at twice the second half of 2025, so write the payment rule now.

← All Blogs