The voice on the phone sounds exactly like the boss — because a few seconds of audio is now all a scammer needs to clone it.
Your finance manager gets a call from you, in your voice, asking them to release a payment urgently — except it isn't you, and it never was. The number looked right, the tone was right, even the slightly impatient way you ask for things was right. By the time anyone thinks to double-check, the money has left the account. This isn't science fiction or a problem for next year. It's the natural evolution of the CEO scam, and it's already costing businesses real money.
What is a voice cloning CEO scam?
A voice cloning CEO scam is deepfake CEO fraud: a criminal uses AI to copy the voice of your owner or a director, then phones someone in finance to approve an urgent payment or change a supplier's bank details. Key IT helps Melbourne businesses stop it with one simple habit — calling back on a known number — backed by MFA, email security and 24/7 SOC monitoring.
The trick itself isn't new. "CEO fraud", a form of business email compromise, has been around for years — an attacker impersonates a senior person and leans on finance to pay up. Until recently it lived almost entirely in email, which gave you a fighting chance: a wrong address, an odd turn of phrase, a request that didn't quite sound like the person.
AI has removed those tells, just as it has made the old spot-the-typo phishing advice obsolete. Vendors now report that usable voice clones can be built from only a few seconds of audio — a snippet from a webinar, a voicemail greeting, a podcast appearance or a social video. The result is a phone call that sounds genuinely like you. In one widely reported case, a finance worker at a multinational paid out around US$25 million after joining a video call where multiple colleagues — including the CFO — turned out to be deepfakes. Treat that figure as a reported case rather than a typical loss, but the lesson stands: the impersonation is now good enough to fool a careful person on a live call.
How does a deepfake CEO fraud attack unfold?
In stages — it's rarely a single phone call out of nowhere. The convincing campaigns are multimodal — they layer research, email, a cloned voice and sometimes video to build trust before the ask.
Reconnaissance first
The attacker learns who approves payments, who reports to whom, and when a director is travelling or hard to reach.
An email to set the scene
A message that looks like it's from the owner flags an upcoming "confidential" payment, so the later call feels expected.
The cloned voice call
The urgent follow-up "from the boss" applies time pressure — a deal closing, a supplier threatening to walk — so there's no time to verify.
Sometimes a video call
In the most advanced cases, the scammer adds a deepfake video meeting so the request feels witnessed and real.
Why your spam filter can't save you here
A good email filter is essential and it blocks an enormous amount of rubbish. But this attack is designed to defeat the filter, not trip it. The phone call never passes through your mail server. The email, if there is one, may come from a genuinely compromised account of someone you actually know. There's no malicious attachment to quarantine and no dodgy link to flag — just a believable human being asking a believable question. Technology alone won't catch it, because nothing about the message is technically "wrong". The weakness it exploits is a process one: a payment that can be authorised on the strength of a voice and a sense of urgency.
How do you stop a deepfake CEO scam?
Call back on a known number. Any request to move money, change bank details or authorise an unusual payment gets verified out of band — through a separate, already-known channel — before anything happens. It's the single most effective defence, it costs nothing and it takes thirty seconds.
Call back on a number you already have
Use the contact you have on file for that person, never the number that called you or the details in the email.
Agree a verification step in advance
A simple internal pass-phrase or a "we always confirm payments over $X in person or by call-back" rule removes the judgement call under pressure.
Make urgency a red flag, not a reason to hurry
"Do this now and don't tell anyone" is the scammer's signature, not a real executive's.
Give staff explicit permission to pause
Nobody should fear getting in trouble for verifying a payment — that fear is exactly what the scam relies on.
Which technical controls help stop deepfake payment fraud?
Five layers back up the call-back rule: strong identity controls, email security that spots account takeover, an Essential 8 baseline, 24/7 SOC monitoring and a rehearsed incident response. Process is the front line, but these controls make the whole con far harder to pull off — and far easier to detect if someone tries. This is where a security-first IT partner earns its keep.
Multi-factor authentication and identity controls
Strong MFA and conditional access on Microsoft 365 make it much harder for an attacker to take over the mailbox they use to set the scene.
Email security that spots account takeover
Monitoring for impossible-travel logins, new mail-forwarding rules and unusual sending behaviour catches the quiet compromise that often precedes the call.
The Essential 8 as a baseline
Patching, application control and restricted admin rights shrink the attack surface the scammers probe first. Our Essential 8 uplift gives you a clear, measured starting point.
A 24/7 SOC watching in real time
A Security Operations Centre monitors for the signals of business email compromise around the clock, so a takeover is caught early, not discovered weeks later in the accounts.
A rehearsed response if money does move
If a payment slips through, fast incident response and a bank contacted within the hour give you the best chance of recovering funds and containing the damage.
What to do in the next week
You don't need a big project to close most of this gap. Write down a payment-verification rule, share it with everyone who can move money, and make call-back on a known number non-negotiable. Then check the technical basics — MFA everywhere, login monitoring switched on, admin rights tidied up — and run a free dark web scan to see whether any staff email addresses have turned up in known breaches. Those few steps defeat the overwhelming majority of CEO-scam attempts, deepfake voice or not.
Frequently asked questions
Can a scammer really clone my voice from a short clip?
At the time of writing, vendors report that convincing voice clones can be produced from only a few seconds of audio — the kind of sample available in a webinar, podcast, voicemail greeting or social video. You don't need to be famous; you just need a little public audio. That's why the defence is verifying the request, not trying to judge whether a voice sounds real.
How is this different from the old CEO email scam?
It's the same goal — pressuring someone into an urgent payment or a bank-detail change by impersonating a senior person — but with AI-generated voice and sometimes video added. That removes the wording and accent tells people used to rely on, so the only dependable defence is an out-of-band verification process rather than spotting a fake.
Will antivirus or a spam filter stop a deepfake payment scam?
Not on its own. A phone call never touches your spam filter, and the email, if there is one, may come from a real, compromised account. You need the layered approach: MFA and email-security controls to make account takeover hard, monitoring to detect it, and a payment-verification process so no single voice or message can release funds.
What is out-of-band verification for payments?
Out-of-band verification means confirming a payment or bank-detail change through a separate channel you already have on record, not the one the request arrived on. If it came by phone or email, don't reply there — call the person back on the number in your own contacts, or confirm face to face. Never use contact details supplied in the request.
Are small Melbourne businesses targeted by CEO fraud?
Yes. The scam works best where one or two people can release money and a director's voice or email style is easy to find online, which describes plenty of small Melbourne firms. Being small isn't protection; a written payment-verification rule is. Our article on why small businesses are still cyber targets explains more.
How can we train staff to resist an AI voice cloning scam?
Teach staff to judge the request, not the voice or the wording, and give them explicit permission to pause any payment until it's verified. Short, regular practice with real-world examples builds that habit. Key IT's free phishing simulation demo shows you, anonymously, how your team handles a realistic phishing email, which tells you where to focus training.
What should we do if we've already paid a fraudulent request?
Move fast. Contact your bank immediately to attempt a recall, change passwords and review mailbox rules for any unauthorised forwarding, and get your IT or security team to investigate the account that was abused. Report it to the ACSC via ReportCyber and check whether notification obligations apply. Speed is the single biggest factor in recovering money and limiting the fallout.
Would your team spot the next one? A free phishing simulation demo shows, safely, how many of your team would click.
Request the Free Demo