Notes · 6 of 8
Nobody hangs up on their boss.
Cloning a voice is cheap now, and the people who answer your phones can't hear the difference. What protects them is a rule you sign before the call comes.
Picture a Thursday afternoon in your office, two days before a filing deadline. Someone in the front office gets a call that sounds exactly like you, asking her to push a corrected notice to the website before she leaves. You sound rushed, you're clearly between meetings, and you want it done. Without a rule you signed in advance, she is not going to hang up on her boss.
That hesitation is what the caller counts on.
In June 2025, someone posing as the U.S. Secretary of State got through to three foreign ministers, a U.S. governor and a member of Congress, using AI to copy his voice and his writing style. In December the FBI said campaigns like it had been running since at least 2023, that senior state officials were among the people impersonated, and that the targets were whoever would pick up when an official calls: other officials, their contacts, their families.
That's you, and the people who pick up when you call.
Anyone who wants to copy your voice already has what they need from your board meetings, press briefings and radio interviews. Your staff directory and your statutory calendar are on your website too, so they know which afternoons your office is buried in deadline work and which deputy answers the phone. What they can't know is whether that deputy will wire money, share a login code or pull down a public notice because the caller ID and the voice both match yours.
It's the request, not the voice
The FBI says a cloned voice can sound nearly identical to the real thing, so don't build your defense on anyone hearing the difference. Build it on what's being asked. Five requests always wait for a callback: changing what the public is told, sharing a login code, moving the conversation to another app, moving money, or changing a bank account. That's where a rule has to hold, whoever's talking.
It usually comes as a pair. A fake email from your address sets up the call, or a fake call follows up on the email, and each one makes the other look real. Ask whoever runs your email whether forged mail in your name gets rejected (the setting is called DMARC). If it doesn't, the email half of that pair is wide open.
What only you can do
Require — in writing, over your signature: none of those five happens on a single call or message. The person calls back on a number they already had, because an impostor can't answer the line you dial. That includes calls from you.
Ask — every office and vendor you answer for: what's your rule when someone senior calls with an urgent change, and when did you last test it?
Confirm — by testing it. On a quiet afternoon, ask a deputy for one of those five requests and see whether they stop and call you back. When they do, thank them in front of the team. A rule only holds if your people know they won't be faulted for slowing you down.
Decide — who takes the callback when you're in a hearing, in court or on a plane, so an urgent check never stalls because you couldn't pick up. Name that person in the rule.
Copy and send: Starting today, I won't ask anyone to change what we tell the public, share a login code, move money, change a bank account, or move our conversation to another app by a single call or message alone. If a call, video, text or email that sounds or reads like me asks for one of those, stop and call me back on the number you already have on file. If you can't reach me, call [NAME].
The short version, to forward:
Require (a callback, in writing) · Ask (each office and vendor for their rule) · Confirm (test it on a quiet day) · Decide (who takes the callback when you can't)
Nothing was hacked
In January 2024, a finance employee at a large engineering firm sent about $25 million after a video call with people who looked and sounded like the company's finance chief and several colleagues. Every face on the call was fake. The company said none of its systems were compromised, and that's the point. Nobody broke in. Someone asked, in a familiar voice, and got a yes.
Nobody can stop someone from sounding like you. You can decide what sounding like you is allowed to do.
Sources
The Washington Post (via Anchorage Daily News), "A Marco Rubio impostor is using AI voice to call high-level officials," July 8, 2025. https://www.adn.com/nation-world/2025/07/08/a-marco-rubio-impostor-is-using-ai-voice-to-call-high-level-officials/
FBI, "Senior US Officials Impersonated in Malicious Messaging Campaign," May 15, 2025. https://www.ic3.gov/PSA/2025/PSA250515
FBI, "Senior U.S. Officials Continue to be Impersonated in Malicious Messaging Campaign," December 19, 2025. https://www.ic3.gov/PSA/2025/PSA251219
CNN, "British engineering giant Arup revealed as $25 million deepfake scam victim," May 16, 2024. https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk/index.html