A familiar voice used to feel like a strong clue that a request was genuine. AI-generated audio makes that clue less dependable.
Scamwatch warns that scammers use cloned voices, manipulated videos and personalised messages. The practical response is to verify the request through a route the caller does not control.
Separate recognition from authorisation
Imagine a staff member receives a call that sounds like the owner, asking for an urgent supplier payment.
Knowing the voice does not establish the recipient, account details or reason for payment. Urgency should not remove the normal checks.
Use a known contact number from an existing record to confirm unusual instructions. Do not use a new number supplied in the same message.
Protect changes to payment details
A convincing email can ask a business to replace a supplier’s bank account. The wording may be polished and include accurate information about a real relationship.
Business Victoria highlights payment redirection and false billing among the risks facing small businesses.
Agree a separate verification procedure for bank-detail changes. Keep a record of who confirmed the change and through which channel. Where feasible, have another person check consequential payments.
A genuine supplier should understand why the process exists.
Do not make an AI detector the gatekeeper
An automated tool might flag suspicious content. A clean result does not prove that a caller or invoice is genuine.
Detection and prevention are different jobs. A payment process that requires independent confirmation can still work when a fake is convincing.
Train people using fictional scenarios and make it acceptable to pause. Staff should not need to prove that something is a scam before asking for verification.
If you have already acted
Contact your bank promptly through its official channel if money or banking access may be involved. Follow official guidance for compromised accounts or identity information, and report the incident to Scamwatch.
Keep relevant messages and transaction details for the organisations helping you respond.
The useful habit is simple enough to practise: recognise the request, pause the action and verify independently. It works against familiar fraud tactics as well as the new tools making them harder to recognise.