A voice is no longer proof of identity
For most of history, hearing someone's voice on the phone was a reasonable way to confirm you were talking to them. That's no longer true. Commercially available AI tools can now clone a voice from as little as three to five seconds of audio, and that source audio doesn't have to come from anywhere private. A voicemail greeting, a webinar recording, a video posted to a company website, all of it is enough.
Why this changes the wire fraud playbook
Business email compromise has always relied on a written message looking legitimate. Deepfake voice fraud adds a second channel: a phone call that sounds exactly like the person it's impersonating, used to confirm instructions that arrived by email moments earlier. A cautious buyer or closing coordinator who knows to double-check "updated" wiring instructions by phone can still be defeated if the phone call itself is the fake.
What a real attack looks like
The pattern shows up across reported cases: instructions arrive by email referencing real transaction details, a follow-up call comes from what sounds like the right person confirming the change, and the request is completed under time pressure. In one widely reported case, a finance employee authorized more than a dozen wire transfers after a video call where every other participant, including an apparent senior executive, was AI-generated. The fraud wasn't caught until a separate verification happened afterward, when the money was already gone.
Why "does this sound right" isn't a safe test anymore
Older wire fraud training focused on spotting mismatched details, an odd tone, unusual phrasing. Those signals are disappearing. A cloned voice can carry the right cadence, the right familiarity, even emotional urgency, because it's built from a real recording of the real person. Testing whether a call sounds authentic is no longer a meaningful check.
The verification has to happen outside the compromised channel
The only defense that holds up against voice cloning is verifying identity and account details through a channel the attacker has no access to, independent of the email thread and independent of any phone number provided in the suspicious message itself. That's the premise behind WireVault's identity layer: confirming who someone actually is, biometrically, rather than trusting how they sound or how they write.
- How much audio does it take to clone a voice convincingly?
- Current AI tools can produce a usable clone from as little as three to five seconds of source audio, often pulled from material that's already public.
- Can a phone call really not be trusted for verification anymore?
- A phone call to a number provided in a suspicious message can't be trusted. A call to a number you already had on file, combined with independent identity verification, still works.