Security Awareness Briefing  //  Eriu Technology  //  Defensive Use Only

THE VOICE
ON THE PHONE

It sounded exactly like the boss. It wasn't.

AI voice-clones and deepfakes have given CEO fraud a human voice — here's how not to be fooled.

01 / What it is

Voice-cloning tools can copy a person's voice from a short sample, and video deepfakes can do the same for a face on a call. Layered onto classic CEO fraud, they turn 'an email from the boss' into 'a call from the boss' — far harder to question in the moment.

02 / How it works
1
They harvest a voice or face from public clips — podcasts, webinars, socials.
2
They clone it with off-the-shelf AI tools.
3
They call or video you with urgency and secrecy.
4
They push for a transfer, a password or an approval — now.

→ The pressure is the point: act now, tell no one, and you never get the chance to check.

The tells

The voice is convincing; the situation isn't:

Urgency + secrecy'Now, and don't mention it.'
An odd channelA call or app they'd never normally use.
Skips the processNo paperwork, no approvals.
Won't be called backResists you ringing them on a known number.
!
Hang up and call back on a number you trustNo matter how right the voice sounds, never action money or credentials off a single call. Hang up and ring the person back on the number you already have for them. Agree a team 'safe word' for genuine emergencies. A real boss will thank you for checking.
03 / Why it's dangerous
  • We trust voices and faces far more than emails.
  • The source clip is tiny — seconds of public audio is enough.
  • It removes the paper trail — nothing to forward to IT.
  • Urgency shuts down checking before you think to.
04 / How you stop it
  • Call back on a known number before actioning anything.
  • Agree a verbal code word for genuine urgent requests.
  • Keep the two-person rule for transfers — a call doesn't bypass it.
  • Be sparing with the voice and video of key staff you publish, where practical.
  • Train the team that 'the boss rang' is not proof it was the boss.
The voice was perfect · The caller was not
An Eriu Technology security briefing  ·  Awareness & defence only