When a Familiar Voice Can No Longer Be Trusted
Why impersonation has become a technology problem
A convincing voice is no longer evidence of who is calling.
For a long time, a recognisable voice was treated as a form of proof. If the person on the line sounded like a chief executive, a client or a family member, that was usually enough to act. Tone, accent and turn of phrase felt personal and hard to fake. That assumption is now outdated.
Inexpensive software can reproduce a person's voice from a small sample of recorded audio. Security researchers note that only a few seconds of speech can be enough to build a usable clone, and the raw material is often already public. Interviews, conference talks, earnings calls and social media clips all provide it. A 2026 McAfee study found that most people worldwide were not confident they could tell a cloned voice from a real one. The technology has quietly removed one of the oldest shortcuts we use to decide who to trust.
Why this reaches families as well as boardrooms
The same tools that target finance teams also target private households.
Most coverage of this threat focuses on companies, and for good reason. Finance teams, executive assistants and payroll staff can move money or change records quickly, which makes them attractive targets. A single call that appears to come from a senior leader, asking for an urgent transfer or a change of bank details, can do real damage before anyone pauses to check.
The same method works against private individuals and families. A call that sounds like a relative in distress, or a message that appears to come from a trusted adviser, applies the same pressure in a more personal setting. For high net worth families and the offices that support them, the exposure is not only financial. It touches privacy, reputation and a sense of safety at home. The tools do not distinguish between a corporate target and a private one. The defences should not either.
Why the request always feels urgent and legitimate
Pressure and plausibility are the method, not a side effect.
These approaches are designed to work on careful people. The request is usually plausible, the timing is awkward, and the pressure to act quickly is deliberate. A convincing voice supplies the authority. A short deadline removes the room to think. The combination is what makes otherwise sensible people act before they verify.
This is why the problem is better understood as social engineering than as a technical trick. The cloned voice is only the opening. What follows is a familiar pattern of urgency, secrecy and a reason not to use the normal channels. Recognising that pattern matters more than being able to detect the fake itself, because the pattern stays consistent even as the technology improves.
Why technology alone will not solve this
Detection tools help, but the reliable defence is a habit.
There is growing interest in software that claims to detect synthetic audio. Some of it is useful, and it will improve. It is not a complete answer. Detection is a contest that moves quickly, and an organisation that relies on tools alone is always responding to the last version of the threat rather than the next one.
The more durable defence is procedural and human. No instruction to move money, change payment details or release sensitive information should rest on a voice or a video alone, however convincing. The principle is simple to state. The work is in making it a settled habit rather than an occasional precaution, so that verifying a request is treated as normal and not as a sign of distrust.
Why verification has to be agreed in advance
A second channel only works if everyone already knows to use it.
The single most effective control is also the least technical. A sensitive request received through one channel should be confirmed through a different and trusted one before anything happens. A call is verified by ringing back on a known number. An email instruction is checked by speaking to the person directly. None of this is complicated, but it only works if it is agreed before it is needed.
That is the quiet case for preparation. In the moment, under pressure, people tend to follow the path of least resistance. If the expectation to verify has been set in advance, written down and practised, it holds. If it has not, a confident voice and a tight deadline will usually win. The same applies at home. A simple agreement within a family about how an unusual request will be confirmed can prevent a great deal of harm.
Why this belongs on the risk register, not the IT backlog
The real exposure is who can authorise an action on their own.
It is tempting to file this under cyber security and leave it with the technology team. That understates it. The exposure is not really about audio. It is about how decisions to move money or release information are authorised, and how easily that authority can be triggered by someone who sounds right. Those are questions of governance and process, and they sit with leadership.
For boards, insurers and law firms, the practical question is straightforward. Where in the organisation can a single person act on a single instruction, and what would it take to slow that point down just enough to verify. Answered in advance, it is an ordinary piece of housekeeping. Answered after a loss, it becomes an expensive lesson.
Could a convincing voice move money in your organisation today?
A short review can show where a single instruction is enough to act, and where a simple check would prevent it.
Most organisations have strong controls on paper. Far fewer have tested how those controls hold up against a confident voice and an urgent request. A calm, practical review can show where verification is genuinely required and where it is quietly assumed.
About SJ Group International
A discreet, executive led consultancy supporting clients through security, risk and crisis matters.
SJ Group International advises private clients, family offices, corporates and other organisations on security, risk, crisis management and preparedness. The firm is known for calm, senior-level support, discreet delivery, and a practical approach shaped by real-world experience.
Explore our Services, view our Training, or make a discreet enquiry.
Clarity before action. Readiness before crisis.