AI voice-cloning and deepfake scams: how UK businesses protect themselves

By /
Illustration: a phone call with a broken-up voice, beside a shield and a locked bank gate

Independent: no vendor pays for coverage · UK police, bank and regulator sources linked · Practical, not alarmist · AI-assisted research, human-checked · How we test · Edited by Annie Vane

AI can now copy someone's voice from a short clip, so a phone call or voice note that sounds exactly like your boss, a director or a supplier is no longer proof that it's them. Small UK firms are targeted because one person can often approve a payment or a bank-detail change. The defence isn't a detection app; it's a simple rule: no payment or bank change on the strength of a call, voice note or video alone. Hang up, call back on a number you already hold, and confirm a code word. If it happens, report it to your bank straight away and to Report Fraud, which replaced Action Fraud in December 2025.

Last checked: 31 October 2026 · Written by Annie Vane, editor · Evidence: Documentation review + worked example
Prepared with AI assistance for research and drafting; every source was checked by me before publishing. How we test

Key facts

  • UK Finance (Annual Fraud Report 2026) warns that criminals are using deepfakes, cloned voices and synthetic identities to impersonate trusted people and get past identity checks.
  • CEO fraud cost £5.6 million across 197 reported cases in 2025, the lowest since 2020 (UK Finance), but that counts only cases reported through banks.
  • Ofcom (2024): 43 per cent of people had seen at least one deepfake online in the previous six months; only 9 per cent were confident they could spot one.
  • Report it: reportfraud.police.uk or 0300 123 2040 (England, Wales and Northern Ireland); Police Scotland on 101.
  • Call your bank: dial 159 to reach most UK banks' fraud teams safely.

What the scam looks like

Most voice-cloning attacks on businesses are a new skin on two old frauds:

  1. "CEO fraud". A call or WhatsApp voice note from "the managing director": she's in a meeting, there's an urgent confidential payment, don't tell anyone, she'll explain later.
  2. Supplier bank-detail change. "Your usual contact" at a supplier calls to confirm that their bank details have changed, backing up an email you received earlier.

AI makes them more convincing. A cloned voice can be built from a podcast, a webinar, a LinkedIn video or a voicemail greeting. Video deepfakes are rarer but real: in 2024 the engineering firm Arup confirmed that staff in its Hong Kong office had transferred about US$25 million after a video call with deepfaked colleagues.

The tell isn't the voice. It's the pattern: urgency, secrecy, a change to normal process, and a request to move money or data.

Why small UK firms are targets

  • One person can approve payments. There's no second signatory to slow things down.
  • Leaders are visible. Founders speak on podcasts, at events and in social videos, which gives scammers plenty of voice to copy.
  • Suppliers are known. Company websites and Companies House list who you work with and who your directors are.
  • Faster Payments are fast. Once money leaves, recovery is hard.

A call-back and code-word policy (template)

Four steps: an urgent call, pause, call back on a known number, confirm the code word

Copy this, change the names, and put it in your staff handbook and finance procedures.

Payment and bank-detail verification policy

  1. No payment, new payee or bank-detail change is approved on the strength of a phone call, voice note, video call, text or email alone, whoever it appears to come from, including directors.
  2. Pause. Urgency and secrecy are warning signs, not reasons to skip this policy. Nobody will be criticised for slowing a payment down to check it.
  3. Call back on a number we already hold: from our supplier file, contract or HR record, never a number given in the message or the call.
  4. Confirm the code word. Directors and finance staff agree a code word in person and change it every [3 months]. It's never written in email or chat.
  5. Two people approve any payment over £[amount] or any new payee.
  6. Supplier bank changes are confirmed by call-back and a test payment of £1 confirmed by the supplier before the first full payment.
  7. If in doubt, report it to [name], who will contact the bank on 159.

Owner: [name] · Reviewed: [date]

Ask your bank whether your business account has Confirmation of Payee checks and payment limits switched on; most UK banks offer both.

What to do if it happens

  1. Call your bank immediately on 159 or the number on your card. The faster the bank knows, the better the chance of stopping or recalling the payment.
  2. Report to Report Fraud online or on 0300 123 2040 (England, Wales and Northern Ireland). In Scotland, call Police Scotland on 101.
  3. Keep the evidence: call logs, voice notes, emails, and the payment details.
  4. If personal data was involved (for example a scammer obtained staff or customer details), decide whether it's a personal data breach. If it's likely to risk people's rights, report it to the ICO within 72 hours.
  5. Warn the person who was impersonated, and your suppliers if they were spoofed.
  6. Review what leaked. Was the voice taken from a public video? Was the supplier relationship visible online?

Tools that claim to detect fakes, and their limits

Several companies sell deepfake and voice-clone detectors. Treat them as an extra signal, not a defence. Detectors are trained on yesterday's fakes, quality varies on phone-line audio, and an "authentic" result can create false confidence. UK Finance makes the same point from the banking side: voice and video can no longer be trusted on their own as proof of identity, so checks need several independent layers. The call-back rule above costs nothing and doesn't depend on spotting the fake.

If you use AI agents yourself, for example an AI receptionist, make sure they can't change payment details or approve payments on a caller's say-so either. Our supplier checklist asks about approval steps.

Protecting your own voice and staff

  • Change voicemail greetings to a short generic message, not a recorded personal one.
  • Think twice before publishing long, clean audio of directors (podcasts, webinars) without a payment policy in place.
  • Tell staff, in a five-minute team chat, that voice cloning exists and that the policy protects them.
  • Agree a family code word at home too: the same scam targets parents and grandparents.

Frequently asked questions

Can AI really clone someone's voice?

Yes. Widely available tools can produce a convincing imitation from a short recording. Treat a familiar voice as a claim, not as proof.

Where do I report a deepfake or voice-cloning scam in the UK?

To your bank first (159), then Report Fraud at reportfraud.police.uk or 0300 123 2040. In Scotland, Police Scotland on 101.

Is Action Fraud still running?

No. Report Fraud replaced Action Fraud on 4 December 2025, and old Action Fraud links redirect to it.

Will my bank refund me?

For authorised push payment fraud, UK reimbursement rules mainly protect consumers, micro-enterprises and small charities, with limits and exceptions. Ask your bank immediately; don't assume a refund.

Sources

This page gives general safety information, checked against the sources above on 31 October 2026. It is not legal or financial advice. If you've lost money, contact your bank and Report Fraud straight away. Spotted something out of date? Tell me.

More guides

Scroll to Top