An AI-cloned voice is impersonating the business owner: how to stop payment diversion

Never authenticate a transaction by voice alone

A familiar voice can be taken from videos, podcasts, meetings, messages, or short calls and reproduced with accessible tools. The FTC warns that cloned speech can be difficult to detect by ear. Spain’s INCIBE documented a case where customers received calls apparently using a business owner’s voice to redirect future payments to a different bank account.

Pause every transfer, bank-account change, gift-card purchase, code disclosure, or access request made by call or voice note. Hang up and call a corporate number known before the incident; if no one answers, contact another authorized person. Do not use the number, link, or contact supplied by the caller, and do not accept urgency or secrecy as verification.

Verification should cover the order, contract, beneficiary, amount, and dual approval. An internal word or procedure can help, but a personal question may be answered from social media. Sensitive transactions should combine an independent channel, a verifiable record, and two people with separate roles.

• Caller number, handle, and time
• Original audio or voicemail
• Exact request and amount
• Proposed account or beneficiary
• Independent verification channel

Preserve evidence without confronting the actor

Save the original recording where lawful and available, voicemail, file, metadata, displayed number, carrier, messages, email, payment instructions, and timeline. A screenshot of an audio waveform is not a substitute for the file. Preserve relevant authentic public samples that may have been used, but do not gather unnecessary material or publish the false call.

Separate confirmed facts from the theory. It may involve synthetic audio, a human imitation, edited phrases, a compromised account, or someone with inside information. Caller ID can also be spoofed. Do not publicly claim AI was used without sufficient analysis; respond to the observable risk while the method remains uncertain.

Review email, phones, meetings, storage, AI tools, social accounts, vendor access, and finance systems. Look for forwarding rules, sessions, recovery changes, and exposed calendars or invoices. If several people were contacted, collect examples centrally and protect their data.

If money moved, act within minutes

Contact the bank or payment provider immediately through a verified number and ask it to contact the receiving institution. Provide the unchanged amount, time, reference, and beneficiary. The FBI tells Business Email Compromise victims to alert financial institutions immediately; a cloned call may be part of the same scheme alongside fraudulent email or meetings.

In the United States, reports may go to IC3 and ReportFraud.ftc.gov. In Spain, INCIBE offers 017, and the bank, police, insurer, privacy team, or qualified legal support may be appropriate. Mexico and other countries have equivalent channels. Reporting does not guarantee freezing or recovery; payment method, intermediaries, jurisdiction, and speed matter.

If credentials or codes were disclosed, change access from clean systems, review sessions, revoke apps, and use strong authentication. Warn potentially contacted customers or vendors through authentic channels. Never pay a recovery service promising guaranteed return of funds; it may be another scam.

Protect reputation and change the process

Publish a warning only when risk is verified and it can prevent harm. State that calls from a particular number or requests changing bank details are unauthorized and explain the authentic procedure without sharing the audio or receiving account. Give customer service one consistent response and a secure reporting channel.

Make a rule that bank-detail changes are never accepted through voice, video, email, or chat alone. Maintain an approved beneficiary list, waiting periods, callbacks to known contacts, and dual approval. Train with simulations without shaming employees: recognizing a voice is no longer an adequate control.

ReputationGeo.ai can organize evidence, coordinate warnings, prepare bilingual reports, and monitor reappearances. Banks, carriers, platforms, and authorities decide independently. We do not guarantee identification, audio removal, recovery, blocking, or timing. This is general information, not technical, financial, or legal advice.

How to turn this guidance into a responsible plan

Begin with evidence, not assumptions. Save the exact URLs, screenshots, publication dates, search phrases, review profiles and AI answers that are creating concern. Record where each item appears, who controls the source and whether the information is inaccurate, outdated, private, misleading or simply unfavorable. These distinctions matter because removal, correction, response, suppression and monitoring are different remedies. A credible adviser should explain those differences before recommending work or discussing timing.

Next, define the audience and the decision at risk. A result seen by prospective clients in Spain may require different language, sources and local signals from a result affecting investors in the United States. Decide which names, brands, locations and search questions matter most. Prioritization prevents a campaign from becoming a vague attempt to control the internet and turns it into a measurable program focused on accuracy, trust and discoverability.

Evidence, people and measurements to prepare

Create a baseline before changes begin. It can include the first two pages of Google for agreed searches, ratings and review volume, visibility of owned pages, recurring themes in AI answers and the status of platform or publisher requests. Keep personal data to the minimum necessary and share sensitive documents only through an agreed secure process. If a legal right may apply, involve qualified counsel in the relevant jurisdiction; reputation strategy does not replace legal advice.

Assign an owner for approvals, factual verification and customer responses. Review progress consistently, but do not judge the program by one daily ranking. Useful measures include corrected or removed items, response completion, the share of credible owned and independent sources, search-result composition, branded query trends and whether public information answers real questions. The objective is a more accurate and resilient digital record, not an artificial promise that criticism will disappear.

Keep a decision record, not just a list of links

For every material item, record the exact source, the factual concern, the person responsible for verification, the proposed route and the reason that route is proportionate. Include the date of any request, response deadline, platform reference number and next review date. This record prevents duplicate or contradictory reports and helps a new decision-maker understand why an item was corrected, challenged, answered, monitored or left alone.

A sound record also separates confirmed facts from interpretations. Label legal questions for qualified counsel, service failures for operational owners and public explanations for communications review. If an item changes, preserve the before-and-after evidence without collecting more personal data than necessary. This discipline is especially important when search engines and AI systems update unpredictably: it shows what actually changed and avoids claiming credit for movements that may have several causes.

• Source, URL, date and affected search or prompt
• Verified facts, disputed claims and supporting evidence
• Chosen route, owner, status and next review date
• Privacy, amplification and escalation risks