It’s Friday afternoon. Your phone rings and it’s the managing director. Same voice, same way of saying your name. They’re about to board a flight, a supplier needs paying today or the deal falls over, and could you push it through before you leave? They’ll sort out the paperwork on Monday.

A few years ago that call would have been genuine. Today, it might be a voice cloning scam: software that copies someone’s voice from a short recording and lets a scammer say anything they like with it.

How a voice cloning scam works

The tools are cheap and easy to find. Consumer group CHOICE notes that a convincing voice clone can be made from just seconds of audio. For a business owner, that audio is usually easy to find: a podcast, a video on LinkedIn, a conference talk, or a voicemail greeting.

The scam itself is old. Scammers have long sent fake emails pretending to be the boss or a supplier and asking for an urgent payment or new bank details. Australia’s National Anti-Scam Centre reports that payment redirection scams cost Australians $166.8 million in 2025, the second-largest category of losses (Targeting Scams report). What’s new is the voice. A phone call from someone who sounds exactly like your boss gets past the doubts an odd email might raise.

It doesn’t stop at phone calls. In 2024 an employee at Arup’s Hong Kong office paid out about HK$200 million (more than US$25 million) after a video call with what looked and sounded like the company’s chief financial officer and other colleagues. Every one of them was a deepfake.

Why a voice cloning scam works

These calls are built to stop you thinking:

Authority. It’s the boss, or a client you can’t afford to upset.
Urgency. It has to happen today, often late on a Friday or just before a public holiday.
Secrecy. “Keep this between us for now”, so nobody else gets the chance to say “that’s odd”.
A plausible excuse for why the normal process can’t be followed: they’re travelling, in a meeting, or on a bad line.

Reported voice-cloning cases in Australia are still relatively rare, but the tools keep getting better and cheaper. The good news is that the defence costs nothing.

The code word rule

The simplest defence against a voice cloning scam is a code word. Agree on a code word, or a question only the real person would know the answer to, for any request involving money, bank details or passwords. If the caller can’t give it, the conversation ends there, no matter how real they sound.

A few tips:

Pick something that isn’t on social media: not a pet’s name, a team or a street.
Share it in person, never by email or text.
Change it if someone leaves the business or you think it’s been overheard.

The call-back rule

If a call, voicemail or message asks you to pay someone, change bank details or share a code, hang up and call the person back on a number you already have. Not the number that called you, and not one in the email signature. It takes two minutes, and it stops most versions of this scam.

The same goes for suppliers who “have changed banks”. Australian banks such as ANZ recommend confirming any change to bank details by phone using known contact details, especially before a first payment to a new account.

Back it up with a simple payment process

The code word works best when the rest of your process supports it:

Two people approve large or unusual payments.
No exceptions for urgency. A genuine boss will understand a two-minute check.
Bank detail changes are always verified by phone on a known number before any money moves.
Tell your team it’s OK to say no to the boss on the phone. A scam only works if staff feel they can’t push back.
Talk about it. Five minutes at a team meeting about this exact scenario does more than any policy document.

What to do if it’s already happened

If you think you’ve been caught by a voice cloning scam, call your bank straight away. The sooner they know, the better the chance of stopping or recovering the payment. Then report it at ReportCyber and let your IT provider know, in case the scammers also have access to your email.

Where to start

Pick your code word this week, and add the call-back rule to your payment process. If you’d like help with the rest, such as protecting the email accounts scammers use to set these calls up and training your team to spot them, our cybersecurity services and ITDR for Microsoft 365 are built for exactly this.

Get in touch or call us on (02) 8212 4722.