The Voice on the Phone Sounded Exactly Like the Boss. It Was Not.
A finance director at the UK arm of a German energy company once picked up the phone to a call that sounded, in every detail, exactly like his CEO. The accent was familiar. The tone, the phrasing, even the slight impatience in the voice, all matched. The caller needed an urgent transfer of around $240,000 to a supplier in Hungary, and needed it within the hour.
The finance director made the transfer. The voice on the phone was not his CEO. It was an AI-generated clone of it, and by the time anyone realised, the money had already moved through several accounts and was gone.
A Real Case, Not a Hypothetical
This case became public because the company’s insurer, Euler Hermes, ended up covering the loss and later spoke about it publicly. It remains one of the clearest documented examples of what is often called voice-cloning fraud, or deepfake CEO fraud: using AI to recreate a real person’s voice convincingly enough to authorise a fraudulent instruction.
At the time, this kind of attack required a reasonable amount of technical effort and a decent sample of the target’s voice to work from. That barrier has been dropping steadily as voice-generation tools have become cheaper, more widely available and easier to use, often needing only a short public recording, an interview clip, a conference talk or a voicemail greeting, to produce a convincing result.
Why This Works When Ordinary Phishing Might Not
Most people have learned to be a little suspicious of emails. A voice on the phone still carries an enormous amount of unearned trust, especially when it sounds exactly like someone senior, urgent, and used to being obeyed quickly.
That combination, a familiar voice plus manufactured urgency plus organisational hierarchy, is specifically designed to make someone act before they stop to verify. The finance director in the case above was not careless. He was doing exactly what most people would do when their CEO calls sounding stressed and asks for something to be actioned fast.
Why This Is Not Just a Large-Company Problem
It is tempting to file this under "things that happen to huge multinational companies," but the mechanics scale down easily. Any business where one senior person can authorise a payment by phone, and where that senior person has any public-facing voice recordings at all, a company video, a conference talk, a podcast appearance, a voicemail greeting, has the raw material an attacker would need.
Smaller businesses are arguably softer targets in one specific way: fewer layers of approval, and a smaller team more likely to assume that if the boss called, it really was the boss.
The One Habit That Stops It
The defence here is not sophisticated technology. It is a simple habit: any request for a payment, a change of bank details, or anything financially significant that arrives by phone or voice message gets verified through a second, separate channel before anyone acts on it.
That might mean calling back on a number already saved in the system, not one given during the call. It might mean a quick message on an internal chat tool. It might simply mean waiting for a face-to-face or video confirmation before anything moves. The method matters less than the principle: a voice alone, however convincing, is no longer enough to authorise money moving anywhere.
This is worth actually agreeing as a stated process, out loud, with whoever in your business can approve payments, rather than assuming common sense will kick in during a moment manufactured specifically to prevent it.
The Question Worth Asking
If someone in your business received an urgent, convincing phone call today asking for a payment to be actioned quickly, is there an agreed second step before that happens, or would it simply depend on how convincing the call sounded?
For most small businesses, there is no agreed process yet, because this still feels like something that happens to other people. The case above did too, right up until it did not.
Find Out Where Your Practice Stands
Answer a few quick questions in our free Business IT Health Check and find out exactly where your business stands, along with practical tips on what to tackle first. It takes less than 5 minutes, it is written in plain English, and there is no hard sell at the end.
