Voice Cloning and the Urgent Call From the Owner

Why this matters

For years the office could trust one thing: if it sounded like the owner, it was the owner. That is no longer true. A short clip of someone talking is now enough to produce a convincing imitation of their voice saying anything, and caller ID can be faked to show their real number. So the call that says "it's me, I need you to send this payment before five" can arrive sounding exactly right, from the right number, and still be a stranger. The shops that do not lose money to it are not the ones with a sharp ear. They are the ones that decided in advance what a money request has to pass, regardless of how it sounds.

What is possible now, and where to re-check it

As of 2026, a general-purpose voice cloning tool can build a usable imitation from somewhere between a few seconds and a minute of clean speech. A shop owner's voice is usually easy to find: the voicemail greeting on the office line, a video on the shop's website or social accounts, a radio ad, an interview with a local news site, a talk at a trade association. Some tools speak a typed script; others convert a scammer's live speech into the target's voice during a real-time call, which means the clone can answer questions.

The quality moves quickly and in one direction. Advice from even a couple of years ago, such as listening for robotic pacing, odd breathing or a flat tone, is already unreliable and will get worse. Re-check the current picture once a year in the FTC's and FBI's published consumer and business advisories on impersonation scams, as part of the annual review; see related: The Annual Security Review SOP.

Caller ID is not evidence. Spoofing the displayed number is old technology and needs no cloning at all. A call that shows the owner's cell number tells you what the caller typed into a field, not where the call came from.

The tell is the request, not the voice

Because you cannot rely on the sound, you rely on the shape of what is being asked. Almost every fraudulent call that targets a shop's money has the same four parts:

• A money or access action. Send a payment, change where a payment goes, read out a code that just arrived by text, give a password, approve a login prompt.
• A deadline that is minutes or hours away. "Before five." "Before the bank closes." "Or we lose the job."
• A reason you cannot check. In a meeting, at the airport, the phone is about to die, the line is bad, "don't call the supplier, I already did."
• Pressure on the relationship. Irritation, disappointment, "I really need you on this one", or flattery about being the only one he can trust with it.

Urgency is the most reliable of the four because it does all the work. A real money movement almost never has to happen in the next 40 minutes, and a shop that has a rule for money changes is never really in that position. Time pressure exists to stop you doing the one thing that defeats the scam, which is taking a minute to check. So treat the deadline as the alarm, not as a reason to hurry.

The callback rule, in one line

Hang up and call the person back on the number already saved in your phone or written in the shop's contact list, never a number the caller gives you, and never by redialing the incoming call. The general habit, and why it beats every other check, is owned by see related: The Verify-on-a-Second-Channel Rule. What this card adds is the second check for the case where a callback is not possible, and a way to end the conversation without accusing anyone.

The code word protocol

A code word is a shared secret that a real caller knows and a clone does not. It is old-fashioned and that is the point: it does not depend on technology getting better or worse.

Choosing it. Two unrelated ordinary words, such as "ladder orchard", not a pet's name, a street, a team, a child's name, or anything findable on a social account. A scammer researching the owner will find the dog's name.

Who knows it. Only people who can move money or change account access: the owner, a partner, the office manager, the bookkeeper. Not the whole crew. Every extra person who knows it is another place it can leak from, and techs are not being asked to send payments.

Where it lives. Memorized, and stored in one place: the owner-only section of the shop's password manager or a sealed note in the safe. Never in a text, an email, a shared document or a chat thread, because those are exactly the places an account takeover reads.

How it is used. The person receiving the call asks for it: "Before I do anything with money, what's the word?" The caller does not volunteer it, so that a fake call cannot learn it by listening to someone else's genuine one. A real owner hearing that question says the word and moves on. A fake one deflects, gets angry, or says "I can't remember, just do it," and every one of those answers ends the call.

When it changes. Immediately after any suspicious call where it was asked for, after anyone who knows it leaves the shop or changes role, and at least once a year.

What it does not do. It does not replace the callback for money. For any payment or any change to payment details, the rule is both: the word on the call, then a callback before the money moves. The word exists for the moments a callback genuinely is not possible, and to let a staff member stop a call without having to decide whether their boss is a fraud.

Worked example: Friday at 4:40

A twelve-person HVAC shop. The bookkeeper is closing out the week when her desk phone shows the owner's cell number. The voice is his, down to the way he says her name.

4:40. He says the compressor supplier for a hospital retrofit is cancelling the order unless a deposit goes out by wire before 5:00, that the supplier's banking details changed this week, and that he is reading her the new account number. The deposit he names is about a third of what the shop spends on materials in a typical month.

Sort the call against the four parts. Money action: a wire to new details. Deadline: 20 minutes. Reason you cannot check: he says he has already talked to the supplier and is about to go into the hospital's mechanical room with no signal. Pressure: "I really need you on this one." All four are present. The supplier is real and so is the hospital job, which is why it is convincing: a scammer who has read the shop's social posts about the hospital project has everything needed for the story.

4:42. She asks for the word. He says, "Come on, I don't have time for that, they're going to drop us." That is a deflection, and it ends the call. She says, "Okay, I'll call you right back," and hangs up. Saying that, rather than "I think you're a scammer," lets her end it without any awkwardness if it really were him.

4:43. She calls the owner's saved number. He answers from his son's ballgame. He did not call. He has not talked to the supplier in a week.

4:50. She calls the supplier on the number from the shop's own vendor file, not from any recent email. The supplier has not changed banks and has no deposit request outstanding. She notes the time, the number displayed on the incoming call, and what was said.

Monday morning. The owner rotates the code word, even though the scammer never heard it, because it was asked for on a suspicious call. He also checks the shop's mailbox sign-in log and email rules, because a story built around "the supplier's banking details changed this week" sometimes means someone has been reading the shop's real supplier emails; see related: The First Hour After a Suspected Breach SOP.

What would have changed the answer. If the owner had been on a plane with his phone off, the callback would have failed and the code word would have been the only check, which is exactly the case it exists for. And even with the right word, the wire waits until he lands: the shop's rule is that new payment details are confirmed with the supplier on the number on file, whoever is asking. A supplier relationship survives a payment that arrives on Monday. A wire sent to the wrong account is usually gone, because wires are hard to reverse once they leave; see related: The Vendor Bank Detail Change SOP.

If the scammer had somehow known the word, the callback at 4:43 would still have caught it. That is why both checks exist. A code word leaks eventually; a callback to a number you already trusted cannot be faked from outside.

Shrinking the raw material, honestly

Some shops replace the owner's voice on the office voicemail greeting with a co-worker's or a generic recorded message. It is worth doing and it is not a solution: an owner who appears in any video or ad has given the clone everything it needs. Spend the effort on the protocol, not on scrubbing the owner's voice off the internet.

The same call aimed at someone else

The pattern is not limited to owner-to-office. Scammers clone a supplier's rep to an accounts-payable clerk, a bank's fraud department to the owner ("we need the code we just texted you to stop a fraudulent transfer"), or a family member to an employee at work. The four parts and the callback rule are the same in each. One addition for the bank version: a real bank fraud team will never ask you to read back a one-time code, because that code is what lets someone sign in as you.

References

• Federal Trade Commission, consumer and business alerts on voice cloning and impersonation scams
• FBI Internet Crime Complaint Center (IC3), public service announcements on AI-enabled fraud
• See related: The Verify-on-a-Second-Channel Rule, The Gift Card Request From the Boss, The Vendor Bank Detail Change SOP