The latest AI voice tools can convincingly clone someone with just a few seconds of audio, from a TikTok, a voicemail, even a Zoom recording. That’s why those “grandchild in trouble” calls feel so real, and why newer scams sound like your boss, your bank, or your vendor.
Beyond emergency cash pleas, attackers now use cloned voices to “verify” sensitive data, reading off pieces of your Social Security number or account info to coax you into correcting the rest. Pair that with spoofed caller ID and you’ve got a high pressure con that can trick even cautious people.
Southwest Cloud Partners put together this practical guide for families and businesses in Las Vegas & Henderson. Share it. Print it. Make it policy.
→ Book a 15-minute consult for a free audit of your security, policies, and procedures.
The playbook criminals use (in plain English)
- Clone a voice from a short public clip. (Yes, it’s that easy now.)
- Spoof the phone number to look like Mom, the CEO, a bank, or your vendor.
- Create urgency: “I need help now. Don’t tell anyone. Read this code back to me.”
- Harvest data or money: wires, gift cards, crypto, or “account recovery” details they reuse elsewhere.
If the call demands secrecy + urgency + immediate payment or sensitive info, assume it’s fraud until you prove otherwise.
Family & friends protocol (post this on the fridge)
- Secret word/phrase: Agree on a code word that must be said before any money or sensitive info is discussed. No code word, no conversation. (Change it after any scare.)
- Call-back rule: Hang up and call back using a number you already have saved, not a number given in the call or text. (Never trust caller ID at face value.)
- No reading numbers aloud: Don’t confirm SSNs, bank numbers, or 2FA codes on a live call ever.
- MFA the right way: Avoid SMS text codes on critical accounts; use an authenticator app or, better, phishing-resistant options like security keys / passkeys.
- Weekly phone reboot: It won’t stop scams, but it’s a useful hygiene step recommended by U.S. agencies to disrupt some mobile attacks.
Business policy: stop AI voice fraud at the front door
From the desk of the Virtual CIO/CTO, Make these rules part of your Written Information Security Plan (WISP) and employee handbook:
Verification & approvals
- Two-person approval for purchases, gift cards, payroll changes, and all wires/ACH.
- Out-of-band verification: For money or data requests by phone/voice, require a call-back to a number on file or a signed ticket in your system. No exceptions.
- Vendor banking changes: Always verify via a known contact at a known number; never accept changes made solely by email/voice.
Authentication
- Ditch SMS codes on admin, finance, email, and bank accounts. Use app-based codes at minimum; ideally FIDO2/WebAuthn passkeys or security keys (phishing-resistant).
- Carrier protections: Add a port-out/SIM-swap PIN with your mobile provider to reduce number-takeover risk.
Phones & calling
- Treat “Verified Call / STIR/SHAKEN” as helpful but not definitive, spoofing still happens. Always follow your call-back rule.
- Lock voicemail with a strong PIN; don’t store sensitive voice messages.
Training
- Quarterly 10-minute refreshers: urgency scams, voice cloning, and how to escalate.
- Post a one-page flowchart at front desk/AP: “Unexpected payment request → STOP → verify out-of-band.”
If you suspect a voice scam right now
- Hang up. Do not argue.
- Call back on a saved number or through the company directory.
- Freeze the transaction: contact your bank/processor immediately if money moved.
- Save evidence: voicemails, numbers, caller ID screenshots.
- Report to your bank’s fraud line and file with the FTC; notify your IT team.
Why we keep saying “don’t rely on SMS codes”
Text messages can be intercepted (e.g., SIM-swap or telecom-network interception), and they’re not phishing-resistant. U.S. cyber authorities advise moving to authenticator apps or FIDO2/WebAuthn passkeys for high-value accounts.
The first line of text messages are often visible on the lock screen! Hide the content of all text messages on your lock screen.
Need help turning this into policy and controls?
Southwest Cloud Partners can:
- Roll out passkeys/security keys and disable risky SMS fallbacks
- Enforce two-person approvals and call-back workflows in your tools
- Add carrier SIM-swap protections and mobile-device baselines
- Run a 30-minute staff training + tabletop exercise on AI voice fraud
→ Book a 15-minute consult to implement the policy and tech in one sweep.
References & further reading
- FTC: AI-enhanced family emergency (“grandparent”) scams & voice cloning. FTC.gov
- FCC: Caller ID spoofing & call authentication (STIR/SHAKEN). FCC.gov
- Microsoft VALL-E research coverage: 3-second voice cloning. Ars Technica
- CISA (with FBI): Don’t use SMS for MFA; prefer phishing-resistant MFA. CISA
- NSA mobile device best practices: weekly reboot guidance. U.S. Department of War
