Your director's voice on the phone, slightly rushed, asking you to push a payment through today. It sounds exactly like them. It is not them.
In short
A voice can now be copied from a few seconds of audio. A writing style from a few emails.
Sounding like someone is not the same as being them.
One habit stops it: hang up and call back on a number you already hold.
Why this works so well
These scams used to give themselves away with clumsy wording and odd phrasing. AI has fixed that for the criminals. The email reads like your finance director. The voicemail sounds like your managing partner. A message arrives from "a temporary number" because their phone was "lost".
The technology is new. The play is old: urgency, secrecy, and a payment outside the normal process.
The three tells that have not changed
It is urgent. Today, before the meeting, before the bank closes.
It is secret. "Keep this between us for now."
It skips the process. A new payee, changed bank details, gift cards, or approval by message instead of the usual route.
The 30-second check
Hang up, or stop replying.
Call the person back on a number from your own records. Not the number that just called, and not one in the message.
Ask directly: "Did you ask for this payment?"
If it is genuine, they will confirm and nobody minds. If it is not, you have just stopped a fraud.
Make it a rule, not a judgement call
People get caught when they have to decide in the moment whether to question the boss. Take the decision away. Write it down: payments, new payees and bank changes are always confirmed by a call to a known number, whoever is asking. Then the person who checks is following the rule, not doubting a director.
And ask people to report anything that felt off, even if they did not act on it. The next call goes to a colleague.
Want your team ready for this?
We run short, practical security training for creative businesses, built around the scams that actually land in your inbox. Talk to us, or see cyber security and audit readiness.