What to do after a voice clone attack.
If a caller sounded like a real executive, employee, vendor, client, or family member and pushed your team to act, respond like the attacker may call again. The first job is to stop the instruction, verify the real person, preserve evidence, and warn everyone likely to be targeted next.
Last reviewed May 2026 / Vicall Research / Not legal advice
Assume the same voice will be used again.
Voice cloning is rarely a one-call event. If the attacker has a usable voice and a working script, finance, HR, IT, front desk, and leadership may all receive follow-on calls.
Stop the action requested by the caller.
Pause payments, account changes, password resets, code sharing, payroll changes, and confidential data releases tied to the call.
Reach the real person through a verified channel.
Use an internal directory, known vendor contact, prior contract, or face-to-face verification. Do not trust caller ID and do not call back the number that called you.
Preserve the voice evidence.
Save call logs, screenshots, voicemails, recordings if available, phone numbers, timestamps, and the exact words used by the caller.
Warn the likely next targets.
Notify AP, payroll, IT helpdesk, front desk, executives, and anyone with payment or account authority that a cloned voice may be used against them.
If money or access moved, escalate.
Contact the bank, file IC3, revoke credentials, reset sessions, and notify counsel and insurance based on what the call caused.
What cloned voices usually ask for.
Urgent wire
A cloned executive or partner asks for a confidential same-day transfer, usually with pressure not to discuss it.
Vendor payment change
A cloned vendor, project manager, or account rep confirms new banking details over the phone after a fake email.
Payroll diversion
A cloned employee or executive asks HR to change direct deposit or run an off-cycle payment.
Verification code
A fake IT, bank, or executive call asks an employee to read a one-time code or MFA prompt.
Password reset
A cloned manager pressures the helpdesk to bypass identity checks and reset access.
Sensitive disclosure
A cloned client, patient, official, or attorney asks staff to release records or account information.
Industry-specific response playbooks.
Use the general steps above first. Then check the playbook for your sector because reporting, insurance, and notification obligations differ.
Do not rely on employees to hear the difference.
Process controls
- Verified-directory callback before any payment or account change
- Dual approval for wire, ACH, payroll, and vendor bank changes
- Passphrases for phone-authorized exceptions
- Blame-free reporting channel for suspicious calls
Technical controls
- Live synthetic-audio detection on business calls
- Risky-phrase alerts for wire transfer, routing number, password, and verification code
- MSP-managed rollout for client companies
- Landline coverage for office phone systems
Report money movement and social engineering.
If a voice clone attack caused a wire transfer or account compromise, use the official reporting and recovery paths. The FBI's BEC page directs victims to contact their financial institution and report to IC3.
Voice clone response questions.
Can I prove the call was AI-generated?
Sometimes, if you have audio and a forensic process. But response should not wait for proof. If the call pushed a high-risk action and could have been cloned, stop the action, verify separately, preserve evidence, and warn likely targets.
What if the caller sounded exactly like the real person?
That is the core problem. Modern voice clones are designed to defeat human recognition. Trust the process: clean-channel verification, dual approval, and live-call detection.
Where does Vicall fit?
Vicall runs detection during the live call. It can flag synthetic audio and optional risky phrases before an employee acts on a wire instruction, credential request, payroll change, or urgent executive command.
Protect the next call, not just the inbox.
Vicall gives employees a live warning when a cloned voice or risky call script appears during the conversation.