Deepfake Voice Fraud: How to Protect Your Business

Tuesday, 4:40 p.m. The controller at a food distributor in Mississauga gets a call from the company president, who's on the road in Montréal. It's his voice, his pace, the way he says "listen, this is important." He needs a $48,000 wire transfer to close a confidential acquisition before 5 p.m., and she's not to mention it to anyone.

The president was in a meeting two blocks away. His voice had been generated from interviews and videos he'd posted online.

That's an audio deepfake, or cloned voice. The story is fictional, but the technique is real, and you can't beat it by listening harder. You beat it with process.

What is deepfake voice fraud?

Deepfake voice fraud is a scam in which the caller uses an AI-generated voice to pass as someone you know: an executive, a supplier, a colleague.

The Competition Bureau of Canada defines deepfakes as realistic-looking fake images, videos or audio impersonating real people. The raw material is often public: interviews, podcasts, webinars, social media videos.

The call is all the more convincing because the number displayed can be faked. As the Canadian Anti-Fraud Centre points out, scammers use spoofing to make a call appear to come from a trusted number. This is the old CEO fraud, moving from email to the phone.

What Canadian authorities say

Canadian authorities treat deepfakes as an active threat, not a curiosity.

• Canadian Centre for Cyber Security. Its National Cyber Threat Assessment 2025-2026 notes that threat actors use generative AI to "create realistic audio and visual content impersonating trusted individuals," which helps them establish legitimacy and persuade targets.
• Joint advisory, June 23, 2025. The Cyber Centre and the Canadian Anti-Fraud Centre describe a campaign of text messages and AI-generated voice messages impersonating senior officials. Targets include business executives. Warning signs: urgency, requests to move to another messaging app, suspicious links, and a tone that seems out of character.
• Competition Bureau, March 9, 2026. It warns that scammers use voice cloning and AI-generated messages to impersonate government officials.

The best-known case happened abroad. According to CNN (May 2024), a finance employee at engineering firm Arup in Hong Kong sent about HK$200 million (roughly US$25 million) in 15 transactions after a video call in which the chief financial officer and other colleagues were deepfakes. Arup confirmed that fake voices and images were used.

The scenarios that target small businesses

In a small business, a cloned voice is mostly used to get money, access or an exception to procedure, by leaning on urgency and authority.

The fake supplier scenario is covered in detail in our article on vendor banking change fraud.

The defence: a process that doesn't depend on the voice

The only reliable defence is to make the voice insufficient: no sensitive request should be carried out on the strength of a phone call alone, however familiar the voice.

The June 2025 joint advisory puts it this way: verify independently by contacting the person or organization "through alternate, previously confirmed channels." As internal rules:

• Mandatory call-back to a number you already have (staff directory, vendor file), never the one the caller gives or the one displayed.
• Dual approval for any transfer above a set threshold, and for any change of banking details.
• Waiting period for a new payee, for example until the next business day.
• Code word between finance and leadership, never written in an email, changed regularly.
• Written commitment from leadership: "I will never ask you to bypass the process, even in an emergency."
• Help desk: no password or MFA reset based on a phone call alone.
• MFA codes: never shared over the phone.

The code word isn't a movie trope: in December 2024, the FBI advised families to create a secret word or phrase to verify a caller's identity. At work, it complements the call-back; it doesn't replace it.

Leadership's commitment matters most. Scammers count on fear of displeasing the boss. A controller who knows she'll be thanked for hanging up on the "president" won't give in.

Train your team to hang up

Learning to hang up without embarrassment matters more than learning to spot a fake voice, because the best clones leave no audible clues.

The joint advisory lists a few things to listen for: a flat tone, unexpected background noise, choppy sentences. Useful, but not enough. Build reflexes instead:

• any urgent, confidential or unusual request triggers the process, no matter who's calling;
• "I'll call you right back" is always an acceptable answer;
• nobody gets blamed for checking.

Add a fraudulent call scenario to your phishing simulations, especially for finance, payroll, reception and the help desk.

The FBI also suggests limiting public content featuring your voice. A small business can't erase the president's interviews, which is exactly why the process has to hold even when the voice is perfect.

Finally, a fake call can be followed by a "confirmation" email that appears to come from your own domain. Check that your domain is protected against spoofing with our DMARC, SPF and DKIM checker.

If you think you've been targeted

Hang up, call the real person back on a known number and, if money has left, call your financial institution immediately: every hour counts when trying to stop a transfer.

Then:

1. Report the incident to your local police, the Canadian Anti-Fraud Centre and the Canadian Centre for Cyber Security, as the joint advisory recommends.
2. Write down the number displayed, the time, the length and content of the call, and keep any voicemails and texts.
3. Warn your staff: the scammers may try other people in the organization.
4. If personal information was disclosed, assess whether it's a privacy breach you must record or report (in Quebec, a confidentiality incident under Law 25), and confirm with legal counsel.
5. Review the step that failed, without looking for someone to blame.

Want to know whether your payment and help desk procedures would hold up against a well-imitated call? Our cybersecurity audit reviews them with your team. To talk it through first, book a free consultation.