Your phone rings.
It’s your CEO.
You recognize the voice immediately.
He’s in a hurry. He’s heading into a meeting and needs you to take care of something quickly.
Nothing about the conversation feels particularly strange.
There’s just one problem.
Your CEO never called you.
The voice you recognized may have been generated by artificial intelligence.
This changes something businesses have relied on for a very long time:
“I know that person” is no longer the same thing as “I verified that person.”
What Is AI Voice Cloning and How Is It Used in Cyberattacks?
AI voice cloning uses artificial intelligence to generate speech that mimics a real person’s voice.
In a social engineering attack, criminals can use synthetic audio to impersonate an executive, coworker, vendor, family member or another trusted person. The goal is the same as traditional phishing: convince someone that the request is legitimate so the attacker can gain access to information, accounts or money.
The FBI has warned about malicious actors using AI-generated voice messages to impersonate senior U.S. officials. In one documented campaign, attackers used text and AI-generated voice messages to establish trust before attempting to gain access to accounts and information. The FBI has also warned that AI-generated voices have become convincing enough that they can sound nearly identical to a known contact.
That creates a very different cybersecurity problem.
How Common Are AI Impersonation and Social Engineering Scams?
There isn’t currently a reliable national statistic showing exactly how many impersonation scams involve an AI-generated voice.
However, federal fraud data shows that both impersonation scams and AI-enabled fraud are already causing significant losses.
According to the Federal Trade Commission, Americans reported losing $3.5 billion to imposter scams in 2025, nearly three times the reported losses in 2020.
More than 1 million imposter scams were reported to the FTC in 2025, making imposter scams the agency’s most frequently reported fraud category for the ninth consecutive year.
Nearly one in three fraud reports involved an imposter scam. And nearly $1 billion was reportedly lost to business impersonators alone.
AI is becoming part of that larger fraud problem.
The FBI’s 2025 Internet Crime Report identified 22,364 complaints involving artificial intelligence, with reported losses totaling nearly $893 million. The FBI says scammers are using AI tools that include fake social profiles, voice clones, identification documents and believable fake videos.
Those numbers do not mean every impersonation scam involved AI or that every AI-related complaint involved voice cloning.
But they show something businesses shouldn’t ignore:
Impersonation already works. AI is making impersonation more convincing.
Traditional Phishing Warning Signs May Not Be There
An AI voice impersonation attack can remove many of the clue’s employees have been trained to look for.
There isn’t necessarily a suspicious link to hover over. There may not be a poorly written email. There might not even be an attachment.Instead, the attacker may only need to convince the employee of one thing:
I’m talking to my boss.
And once that trust has been established, the request that follows can feel much more legitimate.
Where Can Criminals Get Audio to Clone Someone’s Voice?
Think about the content businesses publish every day:
Company videos. Podcasts. Webinars. Speaking engagements. Social media videos. Interviews. Reels. Training videos.
For many Oklahoma business owners and executives, finding examples of their voice doesn’t require getting anywhere near the company network.
Their voice may already be online.
The FTC has warned that scammers can obtain audio clips from content posted online and use voice-cloning technology to make fraudulent calls sound more convincing.
That doesn’t mean CEOs should stop making videos or businesses should disappear from social media.
It means something much simpler:
A familiar voice should no longer be treated as authentication.
What Could an AI Voice Cloning Attack Against a Business Sound Like?
The attack doesn’t have to sound like a scam. When we picture someone impersonating the CEO, we tend to imagine something dramatic:
“WIRE $75,000 TO THIS ACCOUNT RIGHT NOW!”
Hopefully, that would raise some eyebrows.
A real social engineering attempt could be much less obvious.
“Hey, I’m walking into a meeting. Can you take care of something for me?”
“Did you get that invoice I sent?”
“I’m having trouble getting into my account. Can you help me?”
“I’m with a client. Can you send me that file?”
None of those requests sound particularly terrifying.
That’s the problem.
The first goal may not be stealing money or gaining access to an account. The first goal may simply be establishing trust.
Once an employee believes the person on the other end really is the CEO, CFO, coworker, vendor or client, the attacker has a much better chance of getting the employee to act on the next request.
Can Caller ID Be Spoofed Along With an AI-Generated Voice?
Yes.
Caller ID information can be spoofed, meaning the name or phone number displayed on an employee’s phone may not identify the person actually making the call.
The FTC specifically warns consumers not to rely on caller ID as verification because scammers can manipulate the information displayed on the receiving phone.
Now imagine those technologies working together.
The right name appears on the phone.
The number looks familiar.
The voice sounds like your CEO.
The request seems reasonable.
Would your employee question it?
That’s the cybersecurity conversation businesses need to be having now.
How Can Oklahoma Businesses Protect Against AI Voice Cloning Scams?
Businesses shouldn’t build a cybersecurity strategy around hoping an employee can hear the difference between a real person and a convincing AI-generated voice.
Technology will continue to improve.
Verification procedures need to improve with it.
Verify Sensitive Requests Through a Second Channel
If someone requests money, sensitive information, credentials or an unusual account change, verify the request separately.
Call the person using a phone number you already know is legitimate rather than relying on contact information provided during the suspicious interaction.
Require Additional Approval for Financial Changes
Wire transfers, banking changes, payroll changes and unusual financial transactions should have clearly defined approval procedures.
For higher-risk transactions, requiring another person to verify the request can create an additional layer between an attacker and your company’s money.
Never Share Passwords or MFA Codes Over the Phone
A familiar voice does not make a request for a password or multifactor authentication code legitimate.
Employees should understand what information your IT team, vendors and company leadership will and will not request.
Give Employees Permission to Question Leadership
This may be one of the most important controls a business can put in place, and it doesn’t cost anything.
Employees need permission to question the boss.
If something feels unusual, stopping to verify shouldn’t be considered annoying, disrespectful or unnecessary. It should be considered good cybersecurity.
That employee may have just protected the company.
How Should Employee Cybersecurity Training Change Because of AI?
Cybersecurity awareness training in 2026 needs to go beyond suspicious emails.
Employees need to understand that technology can now imitate many of the signals people traditionally use to decide whether something is legitimate.
AI didn’t invent social engineering. Social engineering has always relied on trust, authority, urgency, fear, curiosity and familiarity.
AI simply gives attackers better tools for manufacturing those things.
The question employees need to start asking isn’t:
“Does this look or sound like the person?”
It’s:
“Have I verified this request?”
A voice can be copied. Your verification process can’t.