AI voice-clone CEO fraud: why recognising the voice is no longer enough, and how to lock down payments

What happened

On Thursday 5 November, the US Attorney's Office for the Southern District of New York unsealed charges against three people over a fraud of about $129 million, AP reports. What the court documents describe:

• For more than a year and a half they targeted thousands of companies worldwide, mostly their accounting departments.
• They used AI to imitate the voice and sometimes the image of the CEO in phone and video calls. According to Infobae, they impersonated at least seven different executives, often under the pretext of a company acquisition.
• They also posed as attorneys at major law firms, who were the ones giving the payment instructions.
• Victims include hospital systems, a bank, a UK fintech and a pet food maker. The money went to accounts in several countries, Spain among them, and was converted into cryptocurrency.

Two of the defendants were arrested in Spain, in June and August, and the US has requested their extradition. The technique isn't new in Spain either: INCIBE has documented a Spanish company whose staff paid after a call with their CEO's cloned voice.

How the scam works, step by step

The New York script, as the indictment and press describe it, repeats with few variations:

According to Infobae, one of the defendants had a handwritten script for those calls, designed to stop the employee from checking with colleagues. That's the key point: the scam works when a single person can move the money.

Why recognising the voice is no longer enough

For years, the defence against CEO fraud was to distrust the email and "call to confirm". With cloned voices and faces, the call confirms nothing: it may be part of the scam.

Relying on spotting the trick doesn't work either. Synthetic voices get better every month, and whoever takes the call is under pressure, with a supposed boss on the line asking for discretion. That's why INCIBE's recommendations focus not on recognising the voice but on procedure: payments are never authorised by phone, significant ones need more than one person, and when in doubt you verify through a trusted channel other than the one used by whoever is asking for money.

The rules that stop it

None of them needs technology. They need to be written down and followed every time, including when the caller sounds like the boss:

1. No payments by phone or video call. A call can announce a payment, but it doesn't authorise it. The order comes in through the usual channel, with its supporting document.
2. Two people for payments above a threshold. Whoever prepares the transfer isn't whoever approves it. Set the threshold to your size.
3. Bank account changes are verified outside email. If a supplier "changes its IBAN", call the number you already had on file, not the one in the message.
4. New beneficiary, mandatory wait. A payment to an account that has never been used doesn't go out the same day, however urgent.
5. Confidentiality doesn't exempt anyone from the procedure. No executive can ask for the double approval to be skipped. If one does, that's a reason to stop.
6. A verification word for the exceptional. For the few operations that really are urgent and confidential, a passphrase agreed in person that no AI can guess.
7. Training for whoever pays. Admin and accounts staff should know the script in the table above.

Where automation helps, and where it doesn't

Rules fail when they depend on someone remembering them under pressure. That's where automation helps: it turns the procedure into a path every payment goes through, with no exceptions.

• Every payment is checked against the supplier's record. If the IBAN doesn't match the one on file, or the beneficiary is new, the order stops and is flagged with the reason.
• The order waits for two approvals. The system prepares the transfer with its context (invoice, supplier, payment history) and doesn't release it until the two designated people approve. It's the same logic as approving what can't be undone.
• Invoices are validated before they reach payment: known issuer, amounts that add up, no duplicates. These are the checks that separate a reliable system from one that creates work.
• Everything is logged: who requested the payment, who approved it and with what data.

What no automation, and no AI agent, should do is execute payments on its own because an email or a message asks it to. A system that pays whatever it's told just moves the fraud from the employee to the machine.

Accounting and law firms: a double risk

The New York case hits close to two professional sectors:

• Accounting firms that prepare or process payments for their client portfolio. They're the ones who get the call "from the client" asking for an urgent payment to a new account, and the ones who can warn their clients about this script before it happens to them.
• Law firms, because the scam uses law firms' names to make payment instructions credible. It's worth telling clients in writing, in the engagement letter or the first communication, that the firm never changes a bank account by email or phone, and which channel to use to check.

If it has already happened

The steps INCIBE recommends for a company that has paid after a fake call:

• Contact the bank immediately to try to cancel the transfer and, if it refuses, file a claim with the Bank of Spain.
• Keep all the evidence: emails, the number that called, meeting logs and recordings.
• Report it to the Policía Nacional or the Guardia Civil with that evidence.
• Block the number and warn all staff that there may be more attempts.
• Call 017, INCIBE's cybersecurity helpline, which advises businesses.

How we do it at Amud

When we automate processes that end in a payment (supplier invoices, refunds, settlements), control is part of the design: every payment is checked against the data already in your software, account changes and new beneficiaries are stopped with the reason written down, the order waits for approval from the people you choose and everything is logged. It runs on top of your bank and your ERP, without switching software, and nothing leaves the account because someone asked for it over the phone.