Most of us are used to thinking of cybersecurity as an email problem. And to be fair, dodgy links and phishing messages are still very much alive and kicking. But they’re no longer the only headache worth worrying about. Over the last year or two, scammers have started to create more sophisticated phone call scams powered by AI-generated voice deepfakes.
These calls sound uncannily real. We’re talking directors, clients, partners; anyone an attacker can scrape a handful of voice clips from. And for Birmingham firms, especially those in finance, law or manufacturing where people rely heavily on fast phone decisions, these calls have the potential to be a huge problem.
What are voice deepfakes?
In simple terms, a voice deepfake is an AI-generated audio clip that mimics a real person’s voice. What once required hours of clean recordings can now be done with as few as ten short audio samples. That means a scammer doesn’t need to hack your CEO’s voicemail or steal high-quality studio audio. A speech at an event, a podcast appearance, a social media video, or even an old webinar can be enough.
Once the voice model is created, cybercriminals can make it say almost anything, turning it into a powerful tool for impersonation. We’re already seeing cases where attackers call employees pretending to be a managing director, a finance partner, or even a long-term client giving “urgent” instructions. If someone heard a familiar-sounding voice, would your team question it?
Why Birmingham businesses are particularly exposed
There’s something unique about how many Birmingham SMEs operate: they’re relationship-driven, often hierarchical, and built on trust. Employees know their directors by voice as well as long-standing clients by voice. And in busy environments, especially in manufacturing hubs like the Jewellery Quarter or industrial estates around Digbeth or Aston, a rushed phone call can feel pretty normal.
Imagine this scenario:
Your accounts clerk gets a call from someone who sounds exactly like your MD. The voice is confident, stressed, and urgent: “We’ve got a supplier issue; I need you to process a payment now. I’ll explain later.”
That’s all it takes. When the voice sounds right, people tend to act first and think later. This dynamic makes local firms in law, finance, and manufacturing especially vulnerable. A Colmore Row law firm, for example, might be used to receiving urgent client instructions. A manufacturing director might often call staff while on the road. Offices that depend on quick decisions are therefore prime targets.
Does your cybersecurity policy cover voice deepfakes?
Most IT policies still treat cyber-security as something that happens exclusively on screens; phishing emails, suspicious links, dodgy attachments. Very few say anything about phone calls.
Even fewer have rules around verifying unexpected instructions that come through voice alone. And almost none explain what employees should do if the caller sounds like a senior leader, but something feels “off.” This gap is exactly where deepfake scams have the opportunity to thrive.
Most IT frameworks currently overlook:
- Verification steps for urgent financial requests made over the phone
- Procedures when a caller claims to be senior leadership
- Guidance on how to safely decline or pause a suspicious phone request
- Awareness training on how voice spoofing works
- How attackers gather audio samples from social media or public events
If your policy doesn’t mention any of these, it’s out of date, even if it was refreshed just a year ago.
Steps you can take today to protect your business from voice deepfakes
The good news is that you don’t need advanced AI tools or expensive new systems to protect your team. What you do need is clarity, training, and a policy that matches the modern threat landscape.
Train employees to verify unexpected requests, even from familiar voices
If someone calls asking for a payment, password, or sensitive data, staff should follow a clear verification process. This might mean calling the requester back using a verified internal number or checking with a second colleague.
Add phone-call verification rules to your IT policy
Make it *very* explicit: no financial transactions or data disclosures should ever be approved solely based on a phone call. Put the process in writing and make sure every department follows it.
Teach staff that voices can be spoofed just like emails
Many employees know an email can be faked, but they’ve never considered that a voice can be, too. Awareness alone dramatically reduces the chance of knee-jerk compliance.
Encourage a culture where it’s OK to slow down
Scammers rely on urgency. Empower staff to say, “Let me verify this before I continue.”
Review public audio sources
If your leadership team posts webinars, speeches, or public videos, ensure they’re aware that these can be scraped. You can’t eliminate risk (unless none of you ever speak again – not practical!) but you can reduce the amount of public voice data available.
Frequently Asked Questions
How do voice deepfakes work?
They use AI models trained on small samples of real speech. Once trained, the AI can generate completely new audio that sounds like the original speaker.
What does a voice scam look like in Birmingham?
An accounts clerk at a Jewellery Quarter manufacturing firm might receive a call from someone who sounds identical to their director, demanding an urgent wire transfer to cover “supplier issues.”
Can staff detect voice deepfakes?
Not reliably. Some are impressively convincing, which is why verification protocols matter more than detection skills.
What should go into a new IT policy to address this?
Clear rules stating that no payments, sensitive data, or system access should ever be granted based solely on a phone request, no matter who the caller claims to be.
Summary (TL; DR)
- AI isn’t just generating fake emails, it’s cloning voices, too.
- SMEs are particularly at risk because attackers exploit trust in familiar voices.
- Most IT policies don’t cover phone-based impersonation at all.
- Add verification rules and train staff to question unexpected voice requests.
- Invest in cybersecurity training for your team that covers voice deepfakes.
Need help with your business cybersecurity or any other aspect of your IT set up? Book a free, no obligation chat with Mark to talk about how we could work together!