The phone rings at the end of the day. A familiar voice demands an urgent transfer, mentions a confidential acquisition and asks to bypass the usual process. This CEO fraud scenario is nothing new. But artificial intelligence can give it added force: the voice on the line now sounds like the boss. For companies, the challenge is no longer simply to recognize an impostor, but to make the impersonation useless. Looking ahead to September 2026, this analysis draws on previously documented facts; anticipated developments are presented as projections.
An old scam with an extra tool of persuasion
CEO fraud exploits three classic levers: authority, urgency and secrecy. A scammer impersonates an executive to obtain a payment or sensitive information. Spoofed emails, compromised email accounts and fake bank advisers already make an effective arsenal. Voice cloning reinforces this mechanism without replacing the other tools.
Speech synthesis services can generate a similar-sounding voice from recordings, with quality varying according to the tool, language and audio conditions. Interviews, conferences and corporate videos can provide source material. A convincing demonstration does not, however, guarantee a flawless improvised conversation: intonation, interruptions or proper names can still expose the fabrication.
Yet protection cannot rely on these imperfections. A poor connection, a caller in a hurry or a brief voice message reduces the chances of noticing them. Above all, the attacker does not need to fool the entire company: convincing the person who can initiate or prepare the transaction is enough.
Known cases primarily reveal an organizational weakness
In 2024, Hong Kong police described a fraud in which an employee had joined a video conference with fake colleagues, including a fake chief financial officer, before making transfers totaling around HK$200 million. Engineering group Arup subsequently confirmed that it was the company involved. The case combined audio and video impersonation: it therefore cannot be reduced to a voice call.
It nevertheless illustrates a shift: seeing and hearing seemingly familiar people is no longer sufficient proof on its own. As early as 2023, the US Federal Trade Commission was also warning about the use of voice cloning in family emergency scams. The context differs, but the psychological mechanism carries over to the workplace: a recognized voice can disarm suspicion.
These examples do not allow the frequency of corporate voice fraud to be measured precisely. Published incidents offer a partial picture, and establishing whether a synthetic voice was actually used can be difficult. The risk warrants controls, not improvised statistics or claims of a wave that cannot be quantified.
Calling back helps, provided it genuinely uses a different channel
The central rule can be summed up in one sentence: a call can convey a request, but must not be enough to authorize the movement of money. The displayed number does not prove the caller’s identity, since it can be spoofed. And calling back a number supplied during the exchange sometimes amounts to asking fraudsters to vouch for themselves.
An effective callback starts with a controlled internal directory or contact details that have already been recorded and verified. To confirm a change to a supplier’s bank details, a known contact must be reached without using a number that appears only in the message requesting the change. The aim is to break the chain of trust constructed by the attacker.
However, that callback must not become a substitute form of verbal authorization. For sensitive payments, it complements a formal process: a documented request, supporting documents, approval through an authenticated system and separation of responsibilities. If the attacker also controls an email or internal account, multiplying exchanges within that same environment offers only the appearance of independence.
Rebuilding approval around the payment itself
A robust procedure examines the transaction rather than the impersonation skills of the person behind it. Is the beneficiary new? Have the bank details just changed? Are the amount, destination country or timing unusual? A purported instruction from the company president must not override these questions.
- Separate preparation from approval: the person who creates a beneficiary or prepares a transfer should not be able to approve everything alone.
- Strengthen checks on unusual transactions: require a second independent approval, supporting documents and, depending on the risk, a security delay.
- Protect access: prioritize phishing-resistant authentication where the tools support it, particularly for email and financial applications.
- Document exceptions: every departure from procedure must have an identified person responsible, a justification and verification separate from the initial call.
Dual approval is no magic solution if two people obey the same alarming call. Each must examine the transaction details and have a route for escalation. A small or medium-sized business can apply this principle without extensive infrastructure: preregistered beneficiaries, appropriate limits, a second signatory and backup contacts already provide a practical foundation.
The right to say no matters as much as technology
The weak point is sometimes cultural. When executives regularly demand exceptions, they train their teams to disable their own safeguards. The scammer then only has to replicate that behavior. A credible policy therefore starts at the top: no emergency invoked over the phone exempts a payment from checks, even when the request genuinely comes from the chief executive.
Awareness exercises must train employees to halt a transaction, not merely to spot an odd-sounding voice. A scenario combining a plausible email, an insistent call and a change of bank account can test the procedure. Assessment should focus on responses and organizational obstacles, without humiliating the employee who was fooled.
Synthetic voice detectors can provide an additional signal, but their performance depends on models, compression and noise. They may miss an imitation or flag an authentic recording as suspicious. A static secret phrase has a similar limitation: once disclosed or recorded, it can be reused. None of these measures replaces independent approval.
Prepare for the first minutes after fraud, too
If a suspicious payment has been sent, the bank must be contacted immediately to try to block or recall it, with no guarantee of recovery. The company must preserve messages, transaction references and relevant logs, notify its security and finance managers, then report the incident to the appropriate authorities. Having a plan ready avoids wasting time finding out who can act.
What next? The most plausible prospect is an increasing combination of voice, video and personalized messages, rather than the replacement of all scams with flawless avatars. Their exact trajectory remains uncertain. The response, however, can begin immediately: strip a familiar voice of its power to authorize payments and build controls that remain effective even when the imitation becomes convincing.