Imagine getting a call from your manager asking you to urgently pay a supplier. The voice sounds familiar. The request makes sense. But the caller isn’t who you think.
AI tools can now imitate a person’s voice from audio clips, making impersonation scams harder to spot by ear alone. A convincing voice, or video, isn’t proof that a request is genuine. The safest response is to pause and verify through a separate, trusted channel.
1. Confidence isn’t the same as accuracy
Most of us feel confident judging what we see and hear. That confidence can be misplaced.
In research published in January 2026, CommBank found that Australians correctly distinguished real images from AI-generated ones just 42% of the time, despite 89% saying they were confident they could spot an AI-generated scam. The research also found 27% said they had witnessed a deepfake scam in the previous year.
These figures don’t mean every suspicious image is a deepfake, or that every reported incident was independently confirmed. They do show why it’s risky to rely on instinct alone. Read CommBank’s research.
2. A familiar voice can be faked
Voice cloning can make a scammer sound like a business owner, employee, supplier or family member. Add details gathered from public profiles or previous email conversations, and a request may feel credible.
Scammers don’t need a perfect imitation. They need a believable story that gets someone to act before checking. Treat a voice as a reason to listen, not as proof of identity.
The Australian Signals Directorate’s 2025–26 Annual Cyber Threat Report warns that AI can help criminals create more convincing phishing and impersonation attempts, including through cloned voices and deepfakes.
3. Email can be part of the same scam
A voice-cloning scam doesn’t have to start with a phone call. An email might set the scene, then a call or voice message adds pressure and makes the request feel more personal.
CommBank’s research found that 41% of small business owners were familiar with deepfake scams, and half of reported attempts on small businesses arrived by email. A message that appears to come from a known account can still be fraudulent, especially if it asks you to change payment details, share sensitive information or act unusually quickly.
Strong email security helps, but it can’t replace a clear process for checking sensitive requests. For support with your business email and collaboration settings, explore Google Workspace setup and management.
4. Urgency is a warning sign
“Do it now.” “Don’t tell anyone.” “I’m in a meeting.” These are familiar pressure tactics because they make people skip normal checks.
A rushed payment, secrecy, or a request to bypass approval should prompt you to slow down, not speed up. Even when a request seems to come from someone senior, follow the same process you’d use for anyone else.
Make it clear to staff that taking time to verify a request is good judgement, not poor service. A genuine colleague or supplier should understand.
5. Verify bank detail changes using a trusted number
If a supplier asks you to change their bank details, don’t use the phone number or link in the message. Call a number you already have on file and confirm the change directly.
That applies even if the email looks familiar or the caller sounds like a known contact. A compromised mailbox or cloned voice could be used to reinforce a fake request.
CommBank found that only 55% of small businesses had cross-checked supplier payment details in the previous six months. Make independent verification routine, not something you do only when a request looks suspicious.
6. Agree on an offline passphrase and require two approvals
For high-stakes requests, agree on a secret passphrase or safe word in advance. Keep it offline and share it only with the people who need it. Don’t send it by email or chat, where it could be exposed.
A passphrase is one layer, not a complete identity check. Pair it with a call to a trusted number and a second approver for payments above a set threshold. The second person should review the request independently, not simply confirm that the first person received it.
Set the threshold to suit your business. Write the steps down, make them easy to follow and practise them with staff so nobody has to invent a process under pressure.
7. Plan for the impact, not just the scam attempt
The cost of a cyber incident can reach well beyond the money sent to a scammer. It can mean disrupted work, time spent investigating, lost access to systems and extra support costs.
ASD’s latest report puts the average self-reported cybercrime cost at $55,400 for small businesses and $141,300 for medium businesses. The medium-business figure rose 45% from the previous reporting period. These are reported averages, not a prediction of what any one business will lose.
A practical plan should cover who staff contact, how suspicious payments are stopped, how access is secured and how the business can recover important information. Backups can be part of a managed plan, sized to your business’s risk and recovery requirements. They shouldn’t be assumed to come as standard. Our managed IT support and cybersecurity and ransomware protection services can help you review the controls and response steps that suit your organisation.
If a request feels unusual, stop and check
You don’t need to become an expert at spotting AI-generated voices or images. Build a simple rule instead: don’t approve a sensitive request based only on how familiar it sounds or looks.
Pause. Contact the person using a trusted number you already have. Confirm payment changes independently. Use two approvals for significant payments. And make sure staff know they’re expected to check, even when a request sounds urgent.
If you’d like help reviewing your business’s IT security and response processes, book a free 15-minute consult or call 1800 312 972. You can also explore our cloud consultancy services.
About Mathew Hoffman
Mathew Hoffman started his IT career in 1981 and has held senior roles at State Bank of NSW, Minet Australia, Wilhelmsen Lines and Rothmans of Pall Mall. His experience includes work connected with the Sydney 2000 Olympics. Since 2001, he has provided IT consultancy to small and medium businesses. Mathew became an original Google Partner in 2008 and rebranded the business as Cloud Computer Company in 2017.
Based in Noosa, Mathew enjoys family life, the beach, golf, and cricket, which he has played and coached in Sydney and on the Sunshine Coast.
