The Voice Sounds Like Your Boss. Verify the Request Anyway.

Imagine an employee receiving a rushed voice message from someone who sounds like the owner: a payment needs to move today, the usual approver is unavailable and there is no time to follow the normal process. This is an illustrative scenario, not a report of a local incident.

The important question is not whether the voice seems familiar. It is whether the request has been verified through a trusted process. The FTC has warned that scammers can use AI to imitate voices, and its small-business guidance describes scams that exploit urgency and routine business activity.

Decide what always requires a second check

Identify the requests that should trigger verification: changes to payment instructions, unfamiliar recipients, unusual transfers or requests for sensitive account information. Make the rule apply even when the message appears to come from a senior person or a familiar supplier.

Staff should not have to argue with a convincing caller to follow the process. A simple internal statement helps: payment changes require independent confirmation and the normal approval record.

Use a contact route you already trust

Call the person or organization using a number from an established record, not a number or link supplied in the suspicious message. If the request claims to come from a coworker, use your normal internal contact method. The FTC’s advice for voice-cloning scams emphasizes checking through a known number.

If you cannot verify the request, pause the action and use the company’s escalation process. A deadline in a message should not silently replace the process for approving a payment.

Make it easy to ask for help

Tell employees whom to contact when something feels wrong. Include a backup for absences and after-hours situations. Avoid blaming someone for pausing a transaction to check it; the process only works if people can use it under pressure.

Train with a short fictional scenario. Ask the team to name the next action and the trusted contact source. You do not need to surprise employees with a live deception exercise to find out whether the procedure is understandable.

Protect the process as well as the account

Ask your IT or security provider to review account access, multifactor authentication and the way payment-related changes are approved. A technology tool does not replace clear responsibility for a business decision.

Keep an accurate record of the request and who verified it. Store sensitive details in the appropriate business system rather than forwarding them through a broad group chat.

If a suspicious request succeeds

Contact the relevant financial institution or service provider promptly through an official route and follow your incident-response process. Preserve the messages and report the incident through the appropriate official channels, including the FTC’s reporting resources where applicable.

The habit to establish now: a familiar voice can begin a conversation. An independently verified request and the proper approval are what authorize the action.