AI Voice Phishing and Deepfake Scams: What London Businesses Need to Know

Could You Tell If the Person Calling You Was Really Your Managing Director?

Imagine your finance manager receives a telephone call.

The voice belongs to the Managing Director. The accent sounds right. The tone is familiar. The caller knows the name of a supplier, understands a current project and mentions colleagues the employee works with every day.

There is just one problem.

It is not the Managing Director.

The voice could have been created or manipulated using artificial intelligence. Our Cyber Security Services London and Cyber Security Training for Employees help businesses prepare for this kind of attack.

AI voice cloning and voice deepfakes are changing an assumption that businesses have relied on for decades: recognising someone’s voice is no longer reliable proof of their identity.

For businesses in London, this adds a new dimension to familiar cyber threats including phishing, spear-phishing, business impersonation and vishing.

The UK’s National Cyber Security Centre has warned that generative AI can make aspects of cyber attacks, including social engineering, more effective, while synthetic media can make impersonation more convincing.

So the important question is no longer simply whether your employees can recognise a suspicious email.

It is:

What happens when the cyber criminal sounds exactly like someone they trust?

What Is a Voice Deepfake?

A voice deepfake is synthetic or manipulated audio designed to imitate the voice of a real person.

Using AI voice-cloning technology, characteristics that we normally associate with an individual’s identity, such as their accent, tone and speaking style, can potentially be reproduced.

For a business, the concern is straightforward.

A criminal could attempt to impersonate a:

• Managing Director or CEO
• Finance Director
• colleague
• IT administrator
• accountant
• supplier
• contractor
• solicitor
• client

The danger increases when voice cloning is combined with information gathered about the organisation and the employee being targeted.

Can AI Really Clone Someone’s Voice?

Yes. Voice cloning is already a real technology, not a theoretical future risk.

The important issue for a business is not whether a particular employee thinks they would recognise a fake.

Security procedures should assume that an impersonation could eventually be convincing enough to fool someone.

That changes the security principle completely.

Instead of asking:

“Does this sound like my boss?”

employees need to ask:

“How can I independently verify that this is actually my boss?”

That distinction is at the heart of protecting a business against voice deepfakes.

Where Do Criminals Get the Recordings Needed to Clone Someone’s Voice?

This is perhaps one of the most important questions businesses should be asking.

Criminals do not necessarily need to secretly record a private telephone conversation to attempt to clone someone’s voice.

For directors, senior managers and other public-facing employees, recordings of their voices may already be publicly available online.

Potential sources include:

• LinkedIn and other social media videos
• YouTube interviews
• webinars and online presentations
• podcasts
• conference presentations
• company promotional videos
• media interviews
• public video and audio posts

This creates an important consideration for businesses.

Information published online can reveal far more than someone’s name and job title.

Video and audio can provide samples of how a person speaks, while company websites, LinkedIn profiles and social media can reveal who they work with, their responsibilities and business relationships.

In a targeted spear-phishing or AI vishing campaign, criminals may attempt to bring those different pieces of information together.

They may know who you are, what you sound like, who works for you and who within the business is likely to trust your instructions.

This does not mean businesses should stop publishing videos, taking part in webinars or using social media.

It means businesses need to recognise that hearing a familiar voice should no longer be treated as sufficient proof of identity, particularly when someone is asking for money, credentials, confidential information or access to company systems.

What Is AI Voice Phishing?

AI voice phishing is a form of social engineering in which artificial intelligence can be used to make fraudulent voice communications more convincing.

You may also hear the term AI vishing.

Vishing simply means voice phishing.

Traditionally, it involves a criminal telephoning someone and pretending to be a trusted individual or organisation.

For example, a caller might claim to represent:

• a bank
• an IT provider
• a supplier
• HMRC
• a senior colleague
• the company’s accountant
• or another trusted organisation

AI potentially makes that deception more sophisticated because an attacker may attempt to sound like a particular person, rather than simply claiming to be them.

What Is the Difference Between Phishing, Spear-Phishing and Vishing?

These terms are closely related, but there are important differences.

Phishing usually involves fraudulent communications designed to persuade someone to reveal information, open malicious content or perform another action.

Spear-phishing is more targeted. A criminal researches a particular person or organisation and creates a message specifically designed to appear relevant and believable to that target.

Vishing is voice phishing. The criminal uses a telephone or another form of voice communication as part of the deception.

AI means these techniques can increasingly overlap.

For example, a criminal could send a carefully researched spear-phishing email and then reinforce it with a telephone call using a cloned voice.

The employee is no longer judging one suspicious communication.

They are being presented with multiple pieces of apparently corroborating evidence.

How Could an AI Vishing Attack Against a Business Work?

Consider a London company with a finance department and several directors.

An attacker researches the business using publicly available information.

They identify the Managing Director, Finance Director, finance manager, clients and perhaps some of the company’s suppliers.

The finance employee receives an email:

“Can you deal with the transfer we discussed? I’ll give you a quick call.”

A few minutes later, the telephone rings.

The caller appears to be the Managing Director.

The voice sounds familiar.

The caller knows enough about the company for the conversation to seem credible.

Then comes the pressure:

“I’m going into a meeting. We need this paid today. Can you get it done now and confirm afterwards?”

Notice what has happened.

The email makes the telephone call seem genuine, while the telephone call makes the email seem genuine.

The criminal may not need to hack the employee’s computer.

Instead, they are attacking the company’s trust and authorisation processes.

What Is a Deepfake CEO Scam?

A deepfake CEO scam is a form of executive impersonation in which criminals use synthetic or manipulated audio, video or communications to convince an employee that they are dealing with a senior executive.

The objective might be money, confidential information or access to company systems.

This is not simply a hypothetical scenario.

A widely reported case involving UK engineering consultancy Arup resulted in an employee transferring approximately £20 million after joining a video conference in which deepfake representations of senior colleagues were reportedly used.

That does not mean every London SME is going to experience a multimillion-pound deepfake attack.

The important lesson is that the underlying approach is viable:

people can be persuaded to act because they believe they can see or hear colleagues they trust.

The same principle could be applied to a considerably smaller transaction.

For a small business, a fraudulent £10,000 supplier payment could still cause significant financial damage.

Can Voice Deepfakes Be Used to Steal Money From a Business?

Yes, but fraudulent payments are only one potential objective.

Imagine receiving one of these requests from somebody who appears to be a trusted colleague:

• “Can you change the bank details for this supplier?”
• “I’ve got a new phone. Can you reset my MFA?”
• “What’s the verification code you’ve just received?”
• “Can you send me that client spreadsheet before the meeting?”
• “Can you reset my Microsoft 365 password?”
• “Give the new contractor access to the SharePoint folder.”
• “Can you send me the payroll information?”

None of these requests necessarily sounds dramatic.

But each could potentially help a criminal gain access to systems, divert money or obtain confidential information.

That is why AI voice phishing should not be treated purely as a banking or finance risk.

It is relevant to IT, HR, accounts, directors, helpdesks and anyone with access to valuable business information or systems.

Why Are Spear-Phishing and Voice Deepfakes Particularly Dangerous Together?

Because one communication can be used to validate another.

A traditional phishing email may cause suspicion.

But what happens when the employee receives a telephone call from their “director” and hears a familiar voice confirming the request?

Or the telephone call arrives first and is followed by an apparently related email?

This is where spear-phishing becomes particularly powerful.

A criminal can research the person being targeted and incorporate genuine information about their role, colleagues or organisation into the approach.

The Information Commissioner’s Office has highlighted AI-enhanced phishing and deepfake social engineering among the threats organisations need to consider, including the impersonation of colleagues or IT personnel.

The more relevant and familiar the communication appears, the easier it may be for someone to trust it.

Can You Tell If a Voice Is AI Generated?

Perhaps sometimes.

But businesses should not build security procedures around the assumption that employees will always recognise synthetic audio.

As the technology improves, the signs employees might traditionally associate with a fake could become increasingly difficult to recognise.

More importantly, asking employees to decide whether a voice “sounds fake” places the security decision in the wrong place.

The National Cyber Security Centre has also warned about the limitations and reliability of techniques intended to detect synthetic content.

A much stronger principle is:

Do not ask your employees to become deepfake detectors. Give them a verification process that works even when the deepfake is convincing.

Rather than asking:

“Do I think that really sounds like Sarah?”

the question should be:

“What is our approved procedure for verifying that this request genuinely came from Sarah?”

Will Multi-Factor Authentication Protect a Business From Voice Deepfakes?

MFA is extremely important, but it is not a complete solution to social engineering.

Consider a criminal who telephones an employee pretending to be an IT administrator.

Instead of trying to defeat the company’s authentication system technically, the attacker may attempt to persuade the employee to help them.

For example:

“We’ve detected a problem with your account. You should receive a verification request now. Can you approve it for me?”

The weakness being attacked is not necessarily the authentication technology.

It is the person interacting with it.

Strong authentication should therefore be combined with clear procedures covering unexpected authentication requests, password resets and verification codes.

Are Small Businesses at Risk From AI Voice Scams?

Yes. AI impersonation is not exclusively a threat to multinational corporations.

In fact, smaller companies may have particularly informal approval processes.

A Managing Director might regularly telephone the accounts manager and ask for a supplier to be paid.

Employees may know one another personally.

That familiarity is normally an advantage.

It becomes a vulnerability if:

“I recognised the voice.”

is treated as sufficient authorisation for a sensitive action.

For a small London business, a cyber criminal does not need to steal millions.

Invoice fraud, payroll diversion, supplier impersonation or the compromise of a Microsoft 365 account could all cause significant financial and operational disruption.

How Can Businesses Protect Themselves Against Voice Deepfakes?

Businesses do not need to stop trusting telephone calls or video meetings.

They need procedures that separate identity from appearance and voice.

1. Independently Verify Sensitive Requests

If someone asks for a significant payment, password reset, MFA change, confidential information or alteration to supplier details, independently verify the instruction.

Call the individual back using a telephone number already held in your company’s records.

Do not rely on a telephone number supplied as part of the unexpected request.

2. Use Dual Authorisation for Significant Payments

High-value or unusual payments should require approval from more than one authorised person.

However, the second approval needs to be meaningful.

If one employee simply clicks “approve” because another employee has supposedly checked the transaction, the control can still fail.

3. Independently Verify Changes to Supplier Bank Details

A message claiming:

“We’ve changed banks. Please use these account details for future invoices.”

should trigger a separate verification process.

Verify the change with a known contact using existing, independently held contact information.

4. Strengthen Microsoft 365 Authentication

Businesses using Microsoft 365 should ensure accounts are protected with appropriate authentication and access controls.

Particular attention should be given to privileged accounts and employees with access to financial, customer, HR or administrative information.

5. Modernise Cybersecurity Awareness Training

Cybersecurity awareness training needs to evolve alongside the threat.

Training should include realistic scenarios involving:

• AI voice phishing
• voice cloning
• spear-phishing
• CEO impersonation
• fake IT support calls
• suspicious payment requests
• supplier bank-detail changes
• password and MFA reset requests
• deepfake audio and video

The objective should not simply be teaching staff how to recognise a fake.

Employees need to know what to do when they cannot tell whether something is genuine.

6. Give Employees Permission to Challenge Senior Management

This is one of the simplest controls, but potentially one of the most important.

An accounts employee may feel uncomfortable questioning an urgent request supposedly coming from the Managing Director.

Senior management should therefore make verification culturally acceptable.

Directors can explicitly tell employees:

“If I ever ask you to bypass a security or payment procedure, verify my identity first. You will never be criticised for checking.”

Verification then becomes normal company procedure rather than something an employee is nervous about doing.

What Should an Employee Do If They Suspect an AI Voice Scam?

A straightforward response can be easier to remember:

Stop. Verify. Report. Preserve.

Stop

Do not make the payment, disclose information, approve an unexpected authentication request or follow further instructions.

Verify

Contact the individual through an independently trusted method.

Report

Inform your IT team, cybersecurity provider or designated security contact immediately.

Preserve

Keep relevant emails, telephone numbers, messages, voicemails and other evidence rather than deleting them.

If money has already been transferred, contact the organisation’s bank immediately rather than waiting for an internal investigation to finish.

Does a Business Need a Deepfake Incident Response Plan?

AI impersonation should increasingly form part of wider cybersecurity incident-response planning.

Businesses already plan for lost devices, compromised passwords, malware and data breaches.

They should also know what happens when an employee believes a director, colleague, client or supplier is being impersonated.

The procedure should establish:

1. who employees report the incident to;
2. how identities are independently verified;
3. who has authority to stop a payment;
4. who contacts the company’s bank;
5. how IT investigates possible account compromise;
6. what evidence needs to be preserved;
7. whether systems or accounts need to be restricted;
8. and how the incident is escalated internally.

The Information Commissioner’s Office recommends that organisations understand AI-enabled security threats and consider appropriate technical and organisational measures to address them.

Is Deepfake Detection Software the Answer?

Not on its own.

Businesses are likely to encounter more cybersecurity products offering synthetic media and AI-content detection.

These technologies may form an additional layer of defence, but they should not replace fundamental security controls.

No business should want its entire payment approval process to depend on a piece of software declaring a telephone conversation to be “probably genuine”.

Instead, protection should be layered:

Strong authentication + independent verification + financial controls + employee awareness + incident response.

That approach can continue to protect the organisation even when the deepfake itself is convincing.

Why Do London Businesses Need to Understand Voice Deepfakes Now?

Businesses across London increasingly operate through fast digital communications.

Microsoft Teams, mobile phones, email, remote working and cloud-based platforms allow people to make decisions rapidly.

That is extremely useful for business.

It also creates opportunities for social engineering.

Executives have public LinkedIn profiles. Companies publish information about employees, customers, projects and partnerships. Directors appear in webinars, interviews and videos.

Individually, those pieces of information may appear harmless.

Together, publicly available information can potentially reveal:

• who works for a business;
• who has decision-making authority;
• who controls payments;
• who communicates with whom;
• what the company is currently working on;
• and, in some cases, what senior people within the business sound like.

This is why voice deepfakes should not simply be viewed as another IT issue.

They represent a business, financial and cybersecurity risk.

Is Seeing or Hearing Someone Still Proof of Their Identity?

No. And this may be the most important lesson businesses need to understand about deepfakes.

An employee could receive:

• a convincing email;
• from someone using the right name;
• followed by a telephone call;
• using a familiar voice;
• mentioning a genuine customer;
• discussing a real project;
• and creating a believable reason for urgency.

All those things can make a communication appear trustworthy.

They do not prove the identity of the person behind it.

AI is changing the relationship between identity and communication.

Businesses therefore need to move away from:

“I recognised their voice, so I knew it was them.”

towards:

“The request was independently verified using our agreed security procedure.”

Is Your Business Ready for an AI Impersonation Attack?

There is a simple question every Managing Director could ask their finance, HR and IT teams:

“If somebody cloned my voice today and called you asking for money, information or access, what would you do to prove it was really me?”

If there is no clear answer, that is the place to start.

Voice deepfakes do not mean organisations need to distrust every telephone call.

They mean businesses need to understand that a familiar voice is no longer sufficient authentication for a sensitive business decision.

AI voice phishing, vishing, spear-phishing and deepfake impersonation should therefore become part of cybersecurity awareness, financial controls and incident-response planning for London businesses.

Because the most dangerous fraudulent call may not sound suspicious at all.

Talk to Speedster IT About Protecting Your Business

If you would like help reviewing your verification procedures, staff training or Microsoft 365 security, call us on 0204 511 9111, email hello@speedster-it.com or get in touch.

Louise

With over 15 years at Speedster IT, I’ve built a career around helping businesses navigate the evolving world of technology. I publish all the content for the IT Support London Blog and Cyber Security Blog, where I share practical insights on infrastructure upgrades, cybersecurity trends, and smart IT strategies for growing companies.