For decades, recognising a voice was the cheapest way to know who was calling. It isn’t anymore, and the way many businesses authorise payments still relies on it.
The phone rings. It’s your boss, or your business partner, or the owner of the warehouse you pay every month. It’s their voice, with their usual turns of phrase and their usual hurry. They ask for something simple: a bank transfer today, or a change to the account an invoice gets paid into.
How do you know it’s really them? If your answer is “because it’s their voice”, you have a problem. And you’re not alone.
Until recently that answer was reasonable, because a voice was hard to fake. Today a voice can be synthesised, and the check almost all of us use without noticing, recognising who’s calling, has stopped being a check.
Three real cases, one failure
The first one reached INCIBE’s 017 helpline, Spain’s national cybersecurity institute. An employee got a call with a voice identical to that of one of the company’s senior executives. The caller set up a phone meeting with several employees, talked about an imminent audit and, before hanging up, ordered a bank transfer. They made it straight away. The scam only came to light days later, when they spoke to the real executive.
The second dates from February 2026 and was also reported by INCIBE. Several trusted customers of a retail company received calls using the voice of its manager, from a number that wasn’t his usual one, asking them to change the bank account for their payments. That time it worked out for a very low-tech reason: the customers called him to check.
The third is on a different scale. According to reports based on Reuters, Fideuram, the private banking arm of Intesa Sanpaolo, lost around €95 million after a WhatsApp message posing as the group’s chief executive and a follow-up call with an AI-generated voice imitating a lawyer at an associated firm. Transfers were ordered to accounts abroad, and around €53 million was recovered. Milan prosecutors are investigating.
A bank has whole departments devoted to security, and it still fell for it. A small business usually has one person who pays the bills, one mobile phone and a lot of trust.
The question nobody asks
When someone asks you for money over the phone, the usual question is “can I trust this person?”. The one nobody asks is different: what does my way of paying actually verify?
If the answer is “that I recognise the voice”, the control isn’t the procedure. It’s your ear.
Let me translate: cybersecurity experts warn that imitating someone only takes voice samples taken from a video, an interview, an audio message, or even from a call someone provokes just to record the victim. Anyone who speaks in public, or picks up a phone, leaves material behind.
When someone really looks, they don’t find a technology failing. They find a process with a single lock, and that lock was the voice.
Four locks that cost almost nothing
No payment order by phone alone. INCIBE recommends authorising payments by email or in person.
Two people for large amounts and for any change of bank account. A second pair of eyes is what would have stopped the first case.
Call back, but on the number you already had. Never the one that just called you, and never one the caller dictates.
An agreed word. Some experts recommend agreeing a security word with the people who can ask you for money. It sounds like a spy film, and it works for exactly that reason: it’s impossible to guess.
None of the four is technology. It’s a five-minute conversation with whoever pays the bills.
One question for this week
Who in your business can move money with a single phone call, and what would have to happen for them to hesitate?
If the answer is “nothing”, you know where to start.
If you’d like to review how calls reach your business and who can authorise what by phone, at Netteleco we’ve spent years watching how company phone lines get used, and abused. Get in touch.
