Warning signs of a fake voice call

Doubt the request, not the voice. A call that sounds exactly like your boss can still be fake, so the useful warning signs are mostly about what's being asked and how.

Why the voice isn't the test

The FBI suggests listening closely to tone and word choice to tell a genuine call from an AI-generated cloned voice.¹ That's worth doing. But the same notice admits that spotting AI-made content can be hard.¹

So treat a voice that "sounds right" as one clue, never as proof.

Signs in the call itself

Scammers can pretend to be a trusted person or organisation, according to Australia's cyber agency.² They don't always do it well, but sometimes they do. Watch for these.

• The number looks right. Caller ID spoofing lets a caller change the name or number you see. Wikipedia says phishers often change their numbers so they look familiar or trustworthy.³ A matching name on your screen doesn't confirm anything.
• Pressure to act now. Wikipedia says scammers usually use social engineering to persuade victims of a role they're playing and to create a sense of urgency.³ Social engineering means manipulating people rather than hacking machines.
• A request that breaks your normal process. Your boss doesn't normally ask for gift cards, crypto or a payment to a new account by phone. The FBI advises against sending money, gift cards, cryptocurrency or other assets to people you don't know or have only met online or over the phone.¹
• Secrecy. "Don't tell anyone yet" is a way of stopping you from checking. The next page, urgent payment requests from the boss, explains why.
• A refusal to let you call back. If the caller won't let you end the call and ring back, treat that as a reason to pause.

What going wrong looks like

Take an example. A bookkeeper gets a call from "the owner", who's apparently stuck at an airport and needs an urgent transfer. The voice is right and the number looks right. The bookkeeper doesn't want to be unhelpful.

That's the pattern: a believable person, a story that explains why normal checks are skipped, and a clock.

What to do instead

Australia's cyber agency says to always check who you're communicating with before giving them information.² In practice:

• Say you'll call straight back.
• End the call.
• Use a number you already hold, not the one on the screen.
• Ask someone else in the business to confirm if the person can't be reached.

Each step exists for a reason. Ending the call takes the scammer's control away. Using your own number reaches the real person. Asking a colleague puts a second pair of eyes on the request. The call-back guide has the detail.

One more point. If the call turns out to be real, nothing is lost but a few minutes. If it's fake, you've stopped it. Staff should know they won't be in trouble for checking.