When a Phone Call Sounds Like Your Boss

Imagine receiving a phone call from your company’s CEO asking you to urgently process a payment, change an employee’s direct deposit information, or send a confidential payroll report. The caller sounds exactly like your CEO, uses familiar expressions, and appears to know details about your organization. Would you question whether the call was legitimate?

With advances in artificial intelligence (AI), cybercriminals can now create convincing imitations of real people’s voices. These AI-generated recordings, commonly known as voice deepfakes, are making impersonation scams more difficult to recognize and creating new security risks for employers.

How Do Deepfake Voice Scams Work?

Cybercriminals can use AI-powered voice cloning technology to imitate an individual’s voice using samples obtained from publicly available videos, social media posts, recorded presentations, or other audio sources. Some tools can generate realistic speech from relatively short recordings.

Attackers may use these cloned voices during telephone calls or in recorded voice messages to impersonate executives, managers, coworkers, or other trusted individuals. They may also manipulate caller ID information to make a call appear to originate from a legitimate business number.

Unlike traditional phishing emails, voice scams exploit the trust employees place in familiar voices. A request that might seem suspicious in an email may appear more credible when delivered by someone who sounds like a supervisor or company executive.

Why Are HR and Payroll Departments Targets?

HR and payroll personnel routinely handle sensitive employee information and financial transactions, making them attractive targets for impersonation scams.

A fraudulent caller impersonating an executive, employee, or authorized representative might request:

• Changes to an employee’s direct deposit or banking information.
• Copies of payroll records, employee Social Security numbers, or other confidential information.
• Immediate payment of an invoice or transfer of company funds.
• Access to employee benefits information or enrollment records.
• Password resets, account access changes, or disclosure of security credentials.

Attackers frequently create a sense of urgency, claiming that a request is confidential, time-sensitive, or must be completed before a deadline. They may also discourage employees from contacting anyone else to verify the request.

How Can Employers Protect Against Voice Impersonation?

Because AI-generated voices can be highly convincing, employees should not rely solely on recognizing a caller’s voice or telephone number to confirm identity.

Employers should establish verification procedures for requests involving sensitive information, financial transactions, or changes to employee accounts.

Recommended practices include:

• Verify requests through a separate channel. If a caller requests a sensitive action, contact the individual using a previously established telephone number or other trusted communication method. Do not rely on contact information supplied during the suspicious call.
• Require additional verification for financial changes. Changes to direct deposit information, banking instructions, or payment destinations should follow established authentication and approval procedures, regardless of who appears to be making the request.
• Be cautious of urgency and secrecy. Requests that demand immediate action, bypass normal procedures, or discourage independent verification should be treated as potential warning signs.
• Limit access to sensitive information. Employees should only access and disclose confidential HR, payroll, and benefits information when authorized and necessary for their job responsibilities.
• Report suspicious communications promptly. Employees should notify their IT or security team if they receive an unusual request, even if they did not disclose information or complete a transaction.

Employers should also reinforce that established security procedures apply to everyone, including senior executives. No employee should feel pressured to bypass verification requirements simply because a request appears to come from someone in a position of authority.

A Familiar Voice Is No Longer Proof of Identity

AI-generated voice scams demonstrate why traditional methods of recognizing and trusting callers are no longer sufficient. Even a convincing voice, familiar telephone number, or detailed knowledge of company operations does not guarantee that a communication is legitimate.

For HR and payroll departments, the best defense is a combination of employee awareness, consistent verification procedures, and prompt reporting of suspicious activity. Taking a few additional moments to independently confirm a sensitive request can help prevent financial losses, unauthorized account changes, and the exposure of confidential employee information.