The Phone Call From Your Managing Director Is No Longer Proof It’s Your Managing Director
There was a time when hearing your boss's voice on the telephone was reasonably good evidence that your boss was, in fact, on the other end of the line. That era has now joined the ranks of other quaint historical certainties, such as photographs being reliable evidence of events and Nigerian princes having limited access to international banking facilities.
Voice cloning technology has reached the point where a fraudster with the right tools can sound remarkably like someone you know. The quality varies considerably—some attempts sound like a person speaking through a tin can from the bottom of a well, whilst others are disturbingly convincing. The problem for small and medium-sized organisations is that you don't need Hollywood-level production values to cause significant damage. You just need to sound plausible enough, for long enough, to convince someone to transfer money or send confidential information.
Why This Matters for Smaller Organisations
Large enterprises often have multiple layers of financial controls, dedicated security teams, and the kind of bureaucratic processes that make moving money about as swift as continental drift. Smaller organisations, by contrast, tend to operate on trust, personal relationships, and the ability to make decisions quickly. These are generally excellent qualities that allow you to actually get things done. Unfortunately, they're also precisely what makes you vulnerable.
When your managing director rings the finance manager directly and asks for an urgent payment to a new supplier, there's often a well-established pattern of trust. The finance manager recognises the voice, knows the MD travels frequently, and understands that business sometimes requires swift action. In a small company, questioning your managing director's instructions can feel awkward at best and career-limiting at worst.
This social dynamic is exactly what fraudsters exploit. They're not necessarily relying on perfect audio quality; they're relying on your reluctance to challenge authority and your desire to be helpful.
What a Convincing Fraudulent Call Actually Looks Like
Forget the notion that you'll instantly spot a fake because the voice sounds slightly robotic. The call will probably sound like your managing director having a slightly stressful day. Perhaps they're in a taxi, or at an airport, or in a hotel room with questionable acoustics. The audio quality might be imperfect, but that's entirely normal for someone calling from a mobile whilst travelling.
The request itself will have urgency built in. A supplier needs paying today or a deal falls through. A confidential document is required for a board meeting that's already started. Someone senior is waiting, and you're the only person who can help. The fraudster may well have done their homework—they know who reports to whom, they know your company has been working on a particular project, and they've chosen their moment carefully.
The displayed caller ID may even look correct, because spoofing phone numbers is trivially easy. Everything about the call is designed to trigger your instinct to be competent and responsive rather than suspicious and obstructive.
A Practical Verification Process That Won't Drive Everyone Mad
The solution is not to treat every phone call as a potential elaborate hoax, nor to require employees to become amateur audio forensics experts. What you need is a simple verification process for unusual requests, particularly those involving money, credentials, or confidential information.
First, recognise what counts as unusual. A routine call about a meeting time doesn't require verification. A call asking you to transfer money to a new bank account absolutely does, even if—especially if—it comes with an urgent deadline and a plausible explanation.
When you receive such a request, pause. This is not the same as refusing; it's simply creating a gap between the request and the action. Tell the caller you'll handle it immediately, then contact the person through a different channel you already know to be genuine. Use the mobile number you've rung before, send a message through your normal company system, or walk to their office if they're meant to be in the building.
Crucially, do not use contact details supplied during the suspicious call itself. If someone claiming to be your finance director gives you a new mobile number to call them back on, that number is worse than useless as verification—it's probably connected directly to the fraudster.
Making This Work Without Creating Bureaucratic Nightmare
The objection you'll hear is that this slows everything down and shows a lack of trust. In practice, verification through a known channel takes approximately three minutes. If a genuine urgent matter cannot accommodate a three-minute verification step, your organisation has rather larger problems than potential fraud.
It helps to establish this as standard practice before anyone needs it. Make it clear that the managing director expects to be verified for unusual requests, and that doing so is a sign of competence, not insubordination. When senior people in your organisation actively support the process, it stops feeling like an accusation and starts feeling like sensible practice.
For particularly sensitive actions—large payments, access to critical systems, or release of confidential information—consider requiring independent approval from two people through verified channels. This isn't about creating obstacles; it's about ensuring that one convincing phone call cannot compromise your entire operation.
Why Code Words and Passphrases Aren't the Answer
Some organisations have considered establishing secret code words or passphrases that prove someone's identity. Whilst this sounds appealingly spy-novel, it tends to fall apart in practice. People forget the codes, or write them down in insecure places, or mention them in emails that later get compromised. A code word also creates a false sense of security—if the fraudster has done enough research to clone a voice convincingly, they may well have found your "secret" passphrase.
Verification through a separately-known channel is more reliable because it doesn't depend on shared secrets or perfect memory. It simply requires you to contact the person using information that existed before the suspicious request arrived.
The Broader Picture
Voice cloning is just one element of a broader shift in which traditional markers of authenticity are becoming unreliable. Video can be manipulated, documents can be forged with frightening accuracy, and the email from your supplier might not actually be from your supplier.
The response is not panic, but rather a measured adjustment to how we verify unusual requests. A familiar voice should prompt you to listen, but verification through an independent channel should prompt you to act. It's a small change in practice that can prevent remarkably expensive mistakes.
Further Reading in Security and Privacy
If you've found this article useful, we've written quite a bit more on similar topics. Our Security and Privacy section covers various aspects of keeping your organisation reasonably safe without requiring a degree in computer science or a budget the size of a merchant bank's. Consider these pieces to get you started, covering everything from password management that people might actually follow to understanding what your website hosting company is really promising about backups.
Why Clicking "Remind Me Later" on Software Updates is a Bad Idea
What happens to your business data when you use free online tools
Incognito Mode: The Privacy Feature That's Mostly Just Hiding Things From Your Mum
Why We Write About This
We cover security and privacy topics because they're fundamental to how we build websites and software. It's not a bolt-on feature or an optional extra—it's built into the foundations of everything we create. From the authentication systems that protect your users' data to the hosting configurations that keep your website available when someone inevitably tries to knock it offline, security thinking shapes our technical decisions from the beginning. We've developed systems for organisations where data protection isn't just important but legally critical, and we rather enjoy the challenge of making secure systems that real people can actually use.
Working Together
If you're considering a new website or need software built properly, we'd be pleased to hear from you. We're particularly good at translating "we need something that does this complicated thing but doesn't confuse our staff or customers" into working systems that achieve exactly that. Our approach combines technical competence with an understanding that security measures only work if people can actually use them, and that the best system is one that does what you need rather than what looked impressive in a proposal. Get in touch and we'll have a proper conversation about what you're trying to achieve. You can find prices and a little more about us below:
Get In Touch
How We Build Custom Software Around Your Business
How can I tell if a voice on the phone is actually my boss or a fraudster using voice cloning?
You probably can't tell from the audio alone. Modern voice cloning can sound convincing, especially if the call quality is poor due to 'travel' or 'bad connection.' Instead of trying to detect fake voices, verify any unusual requests—particularly those involving money or confidential information—by contacting the person through a different channel you already know is genuine, like their existing mobile number or company messaging system.
Won't asking to verify my boss's requests make me look like I don't trust them?
Not if it's established as standard practice beforehand. Make it clear that senior people expect and support verification for unusual requests—it's a sign of competence, not insubordination. A genuine urgent matter can accommodate the three minutes it takes to verify through a known channel.
If someone calls with an urgent payment request, what's the safest way to confirm it's legitimate?
Tell the caller you'll handle it immediately, then hang up and contact the person through a channel you already know is genuine—their usual mobile number, company messaging system, or in person. Never use contact details provided during the suspicious call itself, as those likely connect directly to the fraudster.