The voice on the phone is your boss. Probably.

For most of human history, recognising someone's voice was a reasonable way to know who you were talking to. That assumption is now quietly obsolete, and a lot of business processes still depend on it.

What changed

Voice synthesis used to require a studio and a long recording. Now a short sample — a conference talk, a podcast appearance, a voicemail greeting, a social video — is enough for commercial tools to produce convincing speech in someone's voice. The technology is not secret or illegal; it is sold openly for dubbing, accessibility and content production. Like most tools, it does not care about intent.

The result is that the oldest fraud in business email, the urgent request from an executive, now has a voice channel. And a voice defeats the suspicion that written English sometimes triggers.

What the attack looks like

• A call or voice note from a senior person, often using an unfamiliar number explained away as "I'm travelling" or "my phone died".
• Genuine urgency and plausible confidentiality: a deal closing, an acquisition, a regulator, a supplier about to walk.
• A request that bypasses a normal process — a payment outside the usual approval chain, a change of bank details, a gift-card purchase, an urgent credential reset.
• Pressure not to discuss it with colleagues "until it's announced", which conveniently prevents the one check that would expose it.
• Sometimes a short call, sometimes a voice note. Shorter audio is easier to make convincing.

The same pattern appears in personal fraud: a distressed relative calling from an unknown number, needing money immediately, asking you not to tell the rest of the family.

Why it matters to you

Because the defences most organisations have built are about recognising suspicious messages, and this is not a message. It is a trusted voice asking a reasonable-sounding person to do their job quickly. Junior finance staff are targeted precisely because the social cost of questioning a senior person is high and the pressure to be helpful is real.

Red: the attacker's advantage

They are not attacking your technology. They are attacking your organisational hierarchy, your politeness, and your deadline. Every control you have is irrelevant if the payment is approved through the normal system by a genuine employee who believed the request.

Blue: what actually stops it

1. Call back on a known number. Not the number that called you, and not a number given to you during the call. Use the company directory or your own saved contact. This single step ends the attack, and it works regardless of how good the audio was.
2. Agree a family and team safe word. A word that is never written down and never shared digitally. If the caller cannot produce it, the call is over. This is unglamorous and extremely effective.
3. Make dual approval mandatory for payment changes. Any change to bank details, and any payment above a threshold, requires a second person through a separate channel. No exceptions for seniority — especially not for seniority.
4. Give people explicit permission to verify. Say it out loud, from the top: "Nobody will ever be criticised for calling me back to check." Most of these frauds succeed because someone was afraid of looking distrustful.
5. Treat urgency plus secrecy as the signal. Those two together are the fingerprint of this fraud, far more reliably than anything you can hear in the audio.

What not to rely on

Do not train people to listen for robotic artefacts, odd breathing or flat intonation. Those tells exist today and will not exist next year, and teaching them creates false confidence — "it sounded fine, so it was fine". Process beats perception. Verification works whether or not you can hear the difference.