Deepfake Scams on Small Businesses: How Voice Clones Work and How to Stop Them

The short answer

Deepfake scams use AI-cloned voices, faked video calls and AI-written messages to impersonate a boss, supplier or relative and push someone into sending money or sharing access. The defence is mostly procedural, not technical: no payment or bank-detail change is approved on the strength of a call, video or email alone, and every unusual request is verified through a channel you already trust. This is general information, not legal advice.

How big is the problem?

The honest answer is that no one knows precisely, because most fraud is never reported and victims often cannot tell AI was involved. The numbers we do have are a floor, not a ceiling.

• The FBI's 2025 Internet Crime Report counted more than 22,000 complaints that referenced AI, with adjusted losses above US$893 million. It attributed over US$30 million to business email compromise (BEC) scams involving AI, and more than US$5 million to "distress" scams that use voice cloning to mimic a loved one.
• Total losses reported to the FBI in 2025 were US$20.877 billion, with BEC the second-largest category after investment fraud.
• In Canada, the Competition Bureau and Canadian Anti-Fraud Centre reported over $704 million in fraud losses for 2025, and estimate only 5% to 10% of frauds are reported. The Acting Commissioner of Competition said "AI has armed fraudsters with powerful tools to create highly convincing impersonations."

The FBI also notes many victims do not realise AI played a part, which is why its AI-specific figures are likely to be understated.

How deepfake scams on businesses actually work

Most attacks are old frauds with better costumes. The FBI's public service announcement of 3 December 2024 lists the main techniques: short cloned voice clips, real-time video that impersonates executives or authority figures, and AI-generated text and profiles that look legitimate.

Scam	What the employee experiences	What the criminal wants
Fake executive call	A voice that sounds like the owner asks for an urgent wire or gift cards	Money, fast, before anyone checks
Deepfake video meeting	A video call with "colleagues" approving a confidential transfer	Large transfers that look authorised
Supplier bank-detail change	A polished email or call from a known vendor with "new banking details"	Redirected invoice payments
Help-desk impersonation	A "staff member" calls IT to reset a password or MFA	Account access
Fake job applicant	An interview where lip movement and audio do not quite line up	Access to internal systems

The best-known case is Arup. In early 2024 an employee in its Hong Kong office joined a video call with what appeared to be the company's CFO and other colleagues, all fakes built from earlier recordings, and made 15 transfers totalling HK$200 million (about US$25 million), as reported by Construction Management. Arup said its financial stability and internal systems were not affected. Small businesses face the same trick at smaller scale, and with fewer people around to notice.

The Canadian Anti-Fraud Centre's spear phishing guidance describes the same patterns without the AI: executives asking for gift cards, urgent large transfers to foreign accounts, suppliers changing payment details, and "head office" calling staff. AI simply removes the tell-tale signs, like poor grammar or an unfamiliar voice.

A practical defence checklist

Payment controls

• Two channels, always. A request that arrives by phone, video or email is confirmed through a different channel you already hold: the number in your directory, not the one in the message. The CAFC and the FTC's voice-cloning alert both centre on this.
• Two people for money above a threshold. Pick a dollar figure and require a second approver beyond it.
• Bank-detail changes wait. New payee details are verified by phone with a known contact and held for a set period before the first payment.
• No gift cards, ever. Make it a written rule that the business never pays anyone in gift cards or crypto on request.

People

• Agree a code phrase for owners and finance staff, as the FBI suggests families do. If "the boss" cannot give it, the call ends.
• Give permission to slow down. Scammers rely on urgency and secrecy. Tell staff in writing that no one will be blamed for verifying a real request.
• Train on real examples once or twice a year, including a short fake voicemail so people hear how convincing it is.

Systems

• Lock down accounts with multi-factor authentication and strict help-desk rules for resets. Our cybersecurity service covers this ground.
• Patch and monitor. If no one owns IT security day to day, managed IT services can cover updates, backups and alerting.
• Limit public voice and video of finance staff where practical. The FBI notes criminals need only short clips.
• Automate the boring checks. Payment-approval workflows that force a second sign-off remove human pressure from the moment of decision; see what to automate first.

If it happens

1. Call your bank immediately to try to recall or freeze the transfer.
2. Report it: in Canada to local police and the Canadian Anti-Fraud Centre; in the US to the FBI's IC3.
3. Preserve the evidence: call logs, emails, video links, payment records.
4. Reset credentials that may have been exposed, and tell staff what happened.

Will deepfake detection tools save you?

They can help, but do not build your defence on them. The FBI's own tips focus on looking and listening for flaws and, above all, verifying independently. Detection is an arms race. A call-back to a known number is not.

Key takeaways

• Deepfake scams are classic payment and impersonation frauds with AI-cloned voices and faces.
• FBI data show at least US$893 million in AI-linked losses in 2025; the real figure is likely higher.
• Verification through a second, known channel and two-person approval stop most attacks.
• Write the rules down so staff feel safe saying "I'll call you back."

Frequently asked questions

How can you tell if a voice on the phone is AI?

Often you cannot, which is the point. The FBI suggests listening for odd tone or word choice, but the reliable test is to hang up and call the person back on a number you already have, or ask for a pre-agreed code phrase.

What should a small business do first to prevent deepfake fraud?

Adopt a written rule that no payment, bank-detail change or password reset is approved on the strength of one call, video or email, and that every unusual request is verified through a separate, known channel.

Where do Canadian businesses report deepfake scams?

Report to your local police and to the Canadian Anti-Fraud Centre, and contact your bank straight away. Quick reporting gives the best chance of stopping or recovering a transfer.

Sources

1. 2025 IC3 Annual Report — FBI Internet Crime Complaint Center, 2026
2. Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud — FBI IC3, 3 December 2024
3. Fraud Prevention Month to bring hidden crime into the spotlight — Competition Bureau Canada, 6 March 2026
4. Spear phishing — Canadian Anti-Fraud Centre
5. Scammers use AI to enhance their family emergency schemes — Federal Trade Commission, 20 March 2023
6. Arup victim of multimillion deepfake scam — Construction Management, 21 May 2024

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our Cybersecurity, managed it services, business process automation services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.