A finance employee at a multinational firm once joined a video call with the company's CFO and several other colleagues. Everyone on the call looked and sounded exactly right. Over the course of the meeting, the employee was instructed to process 15 separate wire transfers totaling $25.6 million. Every single person on that call, except the employee, was an AI-generated deepfake.
That case made headlines because of the size of the loss, but the underlying attack is now hitting businesses of every size, every day. You don't need a nation-state budget to clone a voice anymore. Three seconds of audio — pulled from a voicemail greeting, a podcast interview, or a public earnings call — is enough to build a convincing synthetic version of someone's voice for less than the cost of a lunch. For a small business owner who does a weekly video update or has been quoted in a local news segment, that's all the raw material an attacker needs.
How the Scam Actually Works
The mechanics are simple, which is exactly why they're effective. An attacker researches a company's leadership on LinkedIn, its website, or public interviews, then clones the voice (or, increasingly, the video likeness) of a CEO, owner, or CFO. They call — or join a video conference — impersonating that executive, and create a scenario with two ingredients that override normal judgment: urgency and authority.
"I'm about to board a flight, but wire $18,000 to this new vendor before end of day." "Don't loop in the rest of the team — this acquisition is confidential." "I need this handled right now, I don't have time to explain." The request bypasses your normal approval chain by design, because the whole scam depends on the target reacting emotionally instead of following the process.
The Numbers Behind the Threat
This isn't a hypothetical risk anymore — it's one of the fastest-growing fraud categories in the country:
- The FBI received over 22,000 reports involving AI-generated voice or video in a single recent year, with reported losses approaching $893 million.
- AI-powered business email compromise (BEC) — which increasingly includes voice and video deepfakes — generated an estimated $2.77 billion in losses across more than 21,000 incidents.
- Voice cloning fraud attempts have risen sharply year over year, and the average loss per successful deepfake fraud incident now exceeds $500,000.
- Of the targets attackers actually manage to reach by phone, the majority end up losing money — this isn't a scam that fails quietly most of the time. It works often enough to be worth the attacker's effort.
- A voice can now be cloned with high accuracy from as little as three seconds of audio, using tools that cost less than a monthly streaming subscription.
Small businesses are attractive targets precisely because they often lack the layered approval processes a large enterprise has. A five-person accounting team doesn't have a treasury department — often it's one bookkeeper who can move money the moment a "client" or "the boss" asks.
Why Small Businesses Are Especially Exposed
Larger companies have accidentally built in some protection against this attack simply through bureaucracy — multiple sign-offs, procurement departments, and finance teams who've never met the CEO in person and wouldn't recognize their voice anyway. Small businesses tend to run lean, which is usually an advantage, but it removes the friction that would otherwise slow a scammer down.
The owner of a 12-person landscaping company, for example, might personally text or call the bookkeeper directly to handle payments — so a call that "sounds like" the owner asking for an urgent wire doesn't seem unusual at all. That familiarity is exactly what attackers exploit.
It's Not Just Voices Anymore
Voice cloning gets most of the headlines, but the same underlying technology now extends to live video. The $25.6 million case above wasn't a phone call — it was a full video conference where every "colleague" on screen was synthetic, generated in real time to match the movements and speech of the person the attacker was impersonating. That's a meaningfully higher bar for an attacker to clear, but the tools to do it are becoming cheaper and more accessible every quarter, which means it's only a matter of time before video deepfakes trickle down to attacks on smaller companies the same way voice cloning already has.
The practical takeaway is that "I saw them on camera" is no longer a reliable form of identity verification on its own. The controls in this article — a callback on a separate channel, a shared code word, a second approver — work regardless of whether the impersonation arrives by phone, video, or even a cloned voice left on voicemail, because they don't depend on your ability to detect the fake. They depend on breaking the attacker's control over the channel.
Building Wire-Transfer Controls That Actually Stop This
The good news: the defenses that work against deepfake fraud are inexpensive, don't require new software, and can be put in place in an afternoon.
1. Require callback verification on a separate channel
This is the single most effective control, and it costs nothing. If a request to move money arrives by phone or video call, it must be verified through a different channel before anyone acts on it — call the person back on their known number (not the number that called you), or confirm by text or in person. Never verify a request using the same channel it arrived on, because that channel is the one the attacker controls.
2. Set a verbal code word for financial requests
Agree on a simple, rotating code word or phrase with anyone authorized to request a transfer — shared verbally, never in writing where it could leak. If an "urgent" call comes in requesting a wire and the caller can't produce the code word, that's the end of the conversation. This single habit defeats real-time voice cloning almost completely, because the scammer has no way to know the phrase.
3. Put a dollar threshold on single-approver transfers
Set a rule that any transfer above a defined amount — even $1,000 for a small operation — requires a second person's sign-off before it goes out. This "four-eyes" principle means an attacker has to compromise two people's judgment simultaneously instead of one, which is dramatically harder.
4. Slow down anything marked "urgent" or "confidential"
Train your team to treat urgency and secrecy as red flags, not reasons to skip steps. Legitimate financial requests can almost always tolerate a 10-minute delay for verification. If a request specifically discourages you from checking with anyone else, that instruction is itself the warning sign.
5. Run a practice drill
Once a quarter, simulate a suspicious call or message with your team — even a low-effort version, like a text from an unfamiliar number claiming to be "the boss," helps people build the muscle memory of pausing and verifying instead of reacting.
If It Happens to You Anyway
Even with good controls, mistakes happen — someone's on vacation, a new hire hasn't been trained yet, or the attacker gets lucky with timing. If you discover a fraudulent wire has gone out, speed is everything.
Call your bank's fraud department immediately and request a wire recall — banks can sometimes intercept or reverse a transfer within the first 24 hours, but the window closes fast. File a report with the FBI's Internet Crime Complaint Center (IC3.gov) the same day; law enforcement has had success clawing back funds when notified quickly, particularly through the FBI's Recovery Asset Team. Document everything — the call or message that triggered the transfer, timestamps, and who was involved — both for the investigation and for your own insurance claim if you carry cyber or crime coverage. Finally, treat it as a training moment: walk the team through exactly what went wrong and tighten the specific control that failed, rather than just reminding everyone to "be careful."
Where Bookkeeping Fits In
Wire-fraud prevention isn't just a security exercise — it's also a bookkeeping discipline. A business with clear, consistent, well-documented financial records makes it far easier to spot an anomaly before money leaves the building. If every vendor, transfer, and approval is logged in a system you can review line by line, an unfamiliar payee or an out-of-pattern transfer amount stands out immediately — instead of getting lost in a shared inbox or a spreadsheet nobody reconciles regularly.
Keep Your Finances Organized and Auditable
Fraud prevention starts with visibility into where your money is actually going. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — every transaction is recorded in a version-controlled, auditable format with no black boxes and no vendor lock-in, so unusual activity is easy to spot rather than easy to hide. Get started for free and see why developers and finance professionals are switching to plain-text accounting.