Earlier this month, Chase streamed a fraud-awareness event to roughly 700 branches nationwide, pulling in the FBI’s cyber division and a Washington Post personal-finance columnist to deliver one message: scams fueled by artificial intelligence are no longer rare, and small businesses are squarely in the blast radius. The event cited a staggering number — Americans reported at least $68 billion in scam losses last year, affecting more than 15 million people. A growing share of that money is leaving through the back door of small businesses, one convincing phone call at a time.
This isn’t the phishing email with bad grammar that your team learned to spot years ago. It’s a call from someone who sounds exactly like your boss, your bookkeeper, or your biggest supplier — because in a very real sense, it is their voice. AI tools can now clone a person’s speech from just a few seconds of audio pulled off a voicemail greeting, a podcast interview, or a video posted to social media. For a small business with one or two people controlling the books, that’s a dangerous amount of leverage in a stranger’s hands.
How the scam actually plays out
The FBI’s 2025 Internet Crime Report included, for the first time in its 25-year history, a dedicated section on AI-enabled fraud: 22,364 complaints and $893 million in confirmed losses — numbers the bureau explicitly flags as undercounts, since many victims never realize AI was involved. Business email compromise, where a scammer impersonates an executive or vendor to redirect a payment, remains one of the costliest categories the FBI’s Internet Crime Complaint Center tracks, and AI is now supercharging it. Reported BEC losses specifically tied to AI tools topped $30 million last year, and that’s with most incidents still undetected.
Here’s the typical sequence for a small business:
- Reconnaissance. A scammer scrapes a short audio clip of the owner, manager, or a known vendor contact — often from a public video, a webinar recording, or even a prior scam call that was recorded “for quality purposes.”
- The setup. An email arrives that reads exactly like the real person would write it (AI drafts this too), asking a staff member or bookkeeper to expect a call about an urgent wire transfer, updated vendor bank details, or a gift card purchase.
- The voice confirmation. A phone call follows, and the voice matches. It carries the right tone, the right phrasing, maybe even a reference to a real project. The employee, now reassured, complies.
- The money moves. Once a wire clears or a vendor’s “updated” bank account is paid, it’s gone. Unlike a credit card dispute, wire fraud and ACH fraud are extremely difficult to reverse once funds have left the country or moved through several accounts.
The FBI has separately warned that criminals are impersonating senior officials and executives using AI-generated voice messages specifically to manipulate contacts into transferring money or disclosing sensitive information — the same playbook now scaled down to target restaurant owners, contractors, and retailers instead of just Fortune 500 finance departments.
Why “trust your gut” doesn’t work anymore
The old advice — listen for hesitation, odd phrasing, or a voice that “doesn’t quite sound right” — assumed a human being with limited tools was doing the impersonating. That assumption is gone. Voice-cloning accuracy has improved to the point that a clip as short as three seconds of public audio can produce a convincing clone, and AI-generated video and audio now feature in a meaningful share of business email compromise attempts, a dramatic jump from a few years ago when it was a rare occurrence.
That means the fix can’t be “train employees to detect a fake voice.” It has to be a process that doesn’t depend on recognizing a voice at all.
A verification process that actually holds up
The single most effective defense, echoed by security teams at major banks, is simple in concept and requires zero new software: any request to move money or change payment details gets confirmed through a second, pre-established channel — every single time, no exceptions.
In practice, that means:
- Call back on a known number, not the one that just called you. If “the owner” calls asking for an urgent wire, hang up and call the owner’s actual saved cell number. If a vendor emails new bank details, call the vendor using the number from last year’s signed contract, not a number in the email.
- Require a second approver for any new vendor or any changed banking detail. One person should never be able to both receive the request and execute the payment, regardless of how urgent or how senior the request sounds.
- Establish a verbal “safe word” or shared detail with key vendors and your bank. Some businesses now agree on a private verification phrase with their bank or largest suppliers specifically because voice and email can both be faked convincingly.
- Slow down urgency. Scammers manufacture time pressure — “the wire has to go out in the next hour” — because panic short-circuits verification habits. A legitimate request can survive a 20-minute delay for a callback.
- Limit what’s public. Earnings calls, podcast appearances, and promotional videos featuring the owner’s voice are useful marketing, but they’re also raw material for a clone. You can’t eliminate this exposure, but you don’t need to hand scammers more of it than necessary in training videos or voicemail greetings.
What to do if it already happened
If a payment was made under false pretenses, time matters. Contact your bank immediately to attempt a recall on a wire or ACH transfer — success isn’t guaranteed, but speed improves the odds. File a report with the FBI’s Internet Crime Complaint Center at ic3.gov, which is the clearinghouse that tracks these patterns and occasionally assists in fund recovery for fast-reported cases. Loop in your bank’s fraud department and, for significant losses, local law enforcement.
The takeaway
You don’t need an IT department or new security software to close this gap — you need one written rule: no payment or vendor-detail change goes through on a phone call or email alone. Put that rule in writing, tell every person who touches your bank accounts about it this week, and make sure it applies even when the “boss” on the phone sounds exactly right. The voice is no longer proof of anything.
