A Familiar Voice Is Not an Approval Control

A familiar voice used to count as confirmation. It no longer does.

In September, security researchers were still documenting how AI-generated voice and video can be used to impersonate people a business trusts. The FBI has warned that malicious callers can use generated audio and recommends verifying a request through a phone number you find independently. The lesson for an operator is not to become an expert in spotting fake audio. It is to stop using recognition as an approval step.

Where the process breaks

Imagine your accounts-payable team gets a call that sounds like an executive. A supplier's bank details need to change before today's payment run. The caller knows the supplier name, the invoice, and the person who normally approves it. The story sounds credible because much of it may be real.

The weak process asks, "Does this sound like the right person?" The stronger process asks, "Did the request go through the approved channel, and did a second person verify the change against a known record?" Those are different questions. Only one leaves an audit trail.

Put verification where authority changes hands

Not every phone call needs a security ritual. Focus on the actions that move money, change payment instructions, grant access, release sensitive information, or override a normal approval. These are the moments where a convincing impersonation becomes an operational loss.

• Keep a verified contact record for approvers and vendors. Do not use a number or link supplied in the new request.
• Require a callback through that trusted record for bank-detail and high-impact payment changes.
• Separate the person requesting a change from the person approving it when the stakes justify it.
• Record what changed, who verified it, how they verified it, and who released the action.
• Give staff a clear way to pause an urgent request without being penalized for slowing it down.

The FBI's business email compromise guidance already recommends independently confirming payment requests and changes in account numbers. AI-generated voices make that advice more important, not more complicated.

Do not build a control that disappears under pressure

An urgent request can be legitimate. It can still wait for verification. If the process can be bypassed because someone sounds senior, uses a familiar video background, or says the deadline is today, it is not a process. It is a suggestion.

Test this with your team. Take a real change type, such as a vendor bank update. Ask how the request enters, who verifies it, where the verified number comes from, who approves it, and what record survives afterward. If any answer is "we would recognize them," you have found the gap.

Trust the verified path, not the voice on the call.

You do not need to know whether every voice is synthetic. You need a workflow that protects the decision either way.