That Voice on the Vendor Payment Call Might Not Be Your Vendor
A familiar voice calls your office and asks you to update a vendor’s bank details before sending payment. The caller knows the project, the invoice amount and the usual process. It sounds like someone you trust.
But a familiar-sounding voice is not proof of identity. AI tools can imitate a person’s voice, and caller ID can be spoofed. For a small business, the practical risk is an unauthorized payment, and the time and effort it takes to respond.
The safeguard is simple: hang up and call back using a number from your trusted directory. Don’t rely on the number, link or instructions in the request. That verify-then-act rule gives your team a reliable process, whether the request comes by phone, email or text.
How a voice-cloning payment scam can work
A fraudster may use audio of a vendor or employee to create a convincing imitation. They could then call with a request to change payment instructions, rush an invoice or send money to a different account. The call may be paired with an email that appears to support the request.
The FBI’s Internet Crime Complaint Center warns that criminals use AI-generated audio to impersonate people and solicit payments. The warning is not that every unusual call is a deepfake. It’s that a voice alone is no longer a dependable way to authenticate a payment request.
The financial impact can extend beyond the transfer itself. Your team may need to investigate what happened, contact the bank and vendor, document the incident and manage disruption to normal operations. A consistent verification process can help prevent a questionable request from becoming a costly mistake.
Don’t try to identify a deepfake by ear
A caller may sound natural and know details about your business. That doesn’t verify who they are. Pauses, background noise or an unusual speaking style might raise questions, but their absence doesn’t establish that a call is legitimate. Caller ID is not proof either.
Instead of deciding whether a voice “sounds real,” assess the request. Pause if it involves:
- New or changed bank-account or payment instructions
- An unexpected payment, unusual amount or new beneficiary
- Pressure to act immediately or keep the request confidential
- A change from the usual communication or approval process
Any one of these can be enough to stop and verify. That doesn’t mean the request is fraudulent; it means payment details should be confirmed before money moves.
The verify-then-act process
Put a written process in place so employees know what to do, even when a request sounds routine.
- Pause the payment. Don’t change bank details or release funds while the request is unverified. A legitimate vendor can wait for the agreed checks.
- Hang up. Don’t call back using a number given during the call or in a related email or text. Don’t reply to the original message to ask whether it is genuine.
- Find a trusted number yourself. Use your company’s vendor directory or payment records, an existing contract, or a previously verified main business number. For a new vendor, independently look up the organization’s published number.
- Call to confirm the exact request. Ask an authorized contact to verify the payment or account change. Confirm details such as the beneficiary name, account information, invoice, amount and effective date, not just whether they made a request.
- Use a second check and follow approvals. Where practical, verify through a separate, established channel, such as a vendor portal or a known relationship contact. Require a second employee to review and approve bank-detail changes or payments above your threshold.
Nacha’s Business Email Compromise Response Action Plan recommends confirming payment-instruction changes outside the channel that requested them, using layered review for certain transactions and calling back on a known number. These controls make the process less dependent on someone’s ability to spot a convincing impersonation.
Make the procedure work in a small business
A written rule only helps if employees can follow it quickly. Keep your vendor contact records current and make the verified phone number easy to find. When onboarding a vendor, record who is authorized to confirm payment details and how to reach them.
Set clear approval thresholds, too. For example, you might require a second approver for every bank-account change and for payments above a defined amount. The appropriate threshold depends on your business and payment volume. The important point is that the rule applies consistently, even when the caller claims to be a senior decision-maker or a long-standing vendor.
For businesses in Berks County, Reading, Wyomissing and Lancaster, a clear process can help an owner or small finance team maintain control without adding needless complexity. Give employees a simple phrase to use: “We verify all payment changes by calling the number in our vendor records.” That keeps the conversation professional and avoids turning a routine safeguard into an accusation.
The FTC’s guidance on voice cloning similarly advises independently contacting the person or organization using a number you already know. The core idea is the same: start a new contact through a trusted route rather than relying on the one provided by the person making the request.
If a payment has already been sent
Contact your bank or payment provider immediately and ask what steps are available to stop or recover the transfer. Notify the actual vendor using a trusted number, and alert the appropriate person in your business, such as the owner, finance lead or security provider.
Preserve the related emails, messages, invoice, phone number and payment details. If you suspect a fraud, you can report it to the FBI’s Internet Crime Complaint Center. Quick action may help your bank assess recovery options; don’t wait to complete an internal investigation before calling.
A few common questions
Should we trust caller ID if the displayed name is correct?
No. Caller ID can be spoofed. Treat it as a convenience, not authentication. For a payment request or change to payment instructions, hang up and call the number in your trusted records.
Is a voice password enough?
A prearranged phrase can be one part of a process, but it should not replace an independently initiated callback. The key is to reach the vendor through a number your business already trusts and confirm the exact transaction details.
What if the vendor says the change is urgent?
Urgency is a reason to follow the process, not skip it. Tell the caller the payment will be reviewed promptly after verification. If the request is legitimate, the vendor should be able to confirm it through an established contact route.
A familiar voice can make a request feel routine, but payment controls should not depend on how convincing a call sounds. Pause, hang up, call back using a trusted directory number, confirm the details and follow your approval process. For more practical cybersecurity guidance, visit the B&R Computers resource hub.
If your team would benefit from reviewing vendor-payment procedures and other cybersecurity risks, schedule a Business Review / Strategy Session. B&R Computers can help you identify practical next steps that fit the way your business works.