Synthetic voice changes the executive-fraud playbook

The FBI documented AI voice impersonation in an active campaign

The FBI reported malicious actors using text and AI-generated voice messages while impersonating senior U.S. officials. The actors sought to build rapport and gain access to accounts. The alert advises recipients to verify new contact information through a previously confirmed platform or trusted source.

Human recognition is a weak authentication control

Urgency, authority, and a recognizable voice can pressure staff to bypass routine controls. As synthetic audio improves, training people to “spot the fake” should support—not replace—verification and dual-control procedures.

Verify the request, not the voice

1. Call back through a known channel

   Use a directory or previously verified number, not contact details supplied in the request.

2. Require dual approval

   Apply separation of duties to payments, credentials, sensitive data, and access changes.

3. Predefine escalation procedures

   Give staff permission to delay urgent executive requests until verification is complete.

4. Protect public voice material

   Assume public recordings can support impersonation and avoid using personal facts or voice recognition as recovery factors.

5. Preserve evidence

   Retain messages, numbers, accounts, timestamps, and payment details and report suspected fraud promptly.