Deepfake voice scams clone a real person's voice — usually a boss, a supplier or a family member — from a few seconds of audio, then use it on the phone or in a voice note to demand money, credentials or urgent action. Training staff to spot them comes down to three habits taught monthly: treat every unexpected voice request for money or access as unverified, always confirm through a second channel you already trust, and never rely on the voice alone as proof of identity. In 2026 the technology is cheap enough that small businesses are squarely in range.
Key takeaways
- Voice cloning needs only seconds of publicly available audio — a podcast, a LinkedIn video, a voicemail greeting — and consumer tools do the rest.
- The typical plays: the fake "CEO" phoning finance about an urgent transfer, the "IT support" caller collecting MFA codes, and AI voice notes on WhatsApp and Teams asking for payments.
- A voice is not identity. Verification through a second, pre-agreed channel is the only reliable control.
- The multi-billion-dollar Arup deepfake fraud in Hong Kong (2024) showed a video-call version of the scam defeating a finance team; the voice-only version is far easier to run.
- Monthly training plus simulations that include voice-claim lures build the verify-by-second-channel reflex before the real call comes.
Why the voice no longer proves anything
Attackers no longer need to sound similar — they can sound exactly like the person. Public audio of executives is everywhere: webinars, interviews, conference recordings, even voicemail greetings. Cloning tools turn a short sample into a convincing synthetic voice that can say anything, live on a call. Combined with caller-ID spoofing and context lifted from LinkedIn, the caller knows your company, your boss's name, the current deal — and speaks in your boss's voice.
The impact is not theoretical. In the widely reported Arup case in Hong Kong, a finance employee joined a video call populated entirely by deepfaked colleagues and transferred about HK$200 million (roughly AUD 40 million). Fraud losses in Australia run at billions of dollars a year, and voice-based impersonation is one of the fastest-growing methods within them.
The scams to train for
- The urgent executive call. "The CEO" phones finance directly, mid-deal or mid-flight, asking for a confidential same-day transfer — and asks the employee to keep it quiet.
- The IT support caller. A convincing help-desk voice needs "a quick code" to fix an account — the code is your staff member's MFA prompt.
- The supplier payment change. A familiar supplier voice confirms "new banking details" by phone, then backs it with an emailed invoice.
- The voice note. WhatsApp, Teams or voicemail messages from a "director" asking for gift cards, payments or credentials — increasingly generated, not recorded.
- The family or personal angle. Scams aimed at staff personally, which spill into work devices and working hours.
The training that actually changes behaviour
- Teach one rule first: the voice is not proof. Name, face and voice can all be synthesised; identity is established by the channel, not the sound.
- Drill the second channel. Any unexpected request for money, credentials or access is confirmed on a number you already hold, or in person. Never the number or callback the caller offers.
- Normalise the pause. Staff must know that delaying an urgent request is always acceptable — real executives respect verification; fraudsters rage at it.
- Rehearse with simulations. Monthly phishing and social-engineering simulations should include voice-claim lures ("the CEO rang and approved this") so the reflex exists under pressure.
- Cover the personal scams too. Staff who recognise deepfake scams targeting them at home protect the business for free.
- Record the habit. Completion and simulation results per person turn the training into evidence for insurers and clients.
Where the training lives
Cyber Aware's security awareness training delivers the monthly modules covering deepfake and voice scams, phishing simulations rehearse the lures monthly, and human risk reporting shows management exactly which habits are holding. For the written half of the defence, a payment-verification rule in your cyber security policy gives staff the authority to hang up and verify — the single behaviour that defeats every version of this scam.
FAQ
What is a deepfake voice scam? A scam where an attacker uses AI to clone a real person's voice from public audio, then poses as them by phone or voice message to extract money, credentials or sensitive actions.
How much audio do scammers need to clone a voice? Seconds. Public sources — webinars, interviews, social videos, voicemail greetings — provide enough for modern consumer tools to produce a convincing clone.
Can you tell a deepfake voice by listening? Increasingly, no. The reliable defence is not listening for artefacts but verifying through a second channel you already trust — a known phone number, in person, or the usual approval process.
What is the most famous deepfake fraud case? The 2024 Arup case in Hong Kong: an employee joined a video call of entirely deepfaked colleagues and transferred about HK$200 million. It showed that even seeing and hearing "colleagues" proves nothing without process.
What should staff do if the boss calls asking for an urgent payment? Hang up politely, then call the boss back on the number already saved in the phone. Never use contact details supplied by the caller, and never let urgency override verification.
How often should deepfake training run? Monthly, in short modules paired with simulations. The tools improve every few months; annual training leaves a year of new techniques untrained.
One last thing
Every deepfake scam depends on one moment: a person deciding the voice sounds right. Training that installs the verify-by-second-channel habit turns that moment from the attack's payoff into its failure point — and it costs one phone call.