The voice on the phone is your boss, or your biggest client, or your accountant. It has the right accent, the right turns of phrase, the right note of impatience. It asks you to move a payment, share a code, or change a bank detail, and it sounds exactly right because it has been built from audio that was freely available - a podcast clip, a conference talk, a voicemail greeting, a few seconds of a video. That is genuinely all it now takes.

This is not science fiction reaching some distant future; it is arriving at ordinary small businesses now, because the tools are cheap and the payoff is a single successful transfer. The attack works by borrowing the trust you place in a familiar voice and using it to skip the checks you would apply to a stranger. The urgency is deliberate, and so is the choice of a moment when you cannot easily see the person.

You cannot reliably tell a good clone by ear, and it is unfair to expect anyone to. So do not try. Move the decision away from the voice entirely and onto a rule: no payment, no bank-detail change and no code is actioned on a phone call alone, no matter who it sounds like. Verify through a second channel you control - ring them back on a number you already had, or confirm in a chat or email thread you already use.

Agree this out loud with your team, and frame it so nobody feels rude enforcing it. ‘We call back on everything, it is our policy, it is not about you’ is a sentence that protects the junior who would otherwise feel unable to challenge a senior voice. Write the rule down. The point of writing it is that it holds even when the voice is upset and the clock is ticking.