AI has made the oldest business frauds cheaper to run: a cloned voice of the owner asking finance to pay an urgent invoice, a video call with a convincing face, an email in a supplier’s exact style announcing new bank details. UK Finance’s Annual Fraud Report 2026 records authorised push payment losses of £576.4 million in 2025, of which £75.6 million was from businesses, and notes organised criminals increasingly using deepfakes, cloned voices and synthetic identities to impersonate trusted people. Small firms are exposed because they run on trust and verbal approvals. Four controls stop most of it: no payment, payee change or data release on a voice or video request alone, confirmed by calling back on a number already held; two named people on every new payee and every change of bank details; DMARC, SPF and DKIM on the firm’s own domain so it cannot be spoofed; and a culture where staff are thanked for checking, never criticised for delay. None of them needs technology to detect deepfakes, which is fortunate, because detection is unreliable.
- APP losses, 2025
- £576.4m; £75.6m from businesses (UK Finance)
- What AI changed
- Cost and convincingness, not the fraud
- Controls
- Call back, two people, DMARC, culture
What the fraud looks like now
A finance assistant gets a call that sounds exactly like the managing director, stressed, on a bad line, needing a supplier paid before a deadline. A bookkeeper receives an email from a long-standing supplier’s real-looking address with a letter on headed paper announcing a change of bank account. A junior joins a video call where the person who looks and sounds like a director asks for a payroll file. A cloned voice needs seconds of audio from a podcast, a webinar or a voicemail; the lure email is written by a model in the supplier’s style from their public correspondence. UK Finance’s 2026 report describes exactly this shift: AI-enabled social engineering that gets people to authorise payments themselves, bypassing the bank’s controls.
Why small firms are the target
Large firms have segregated duties, payment approval workflows and a treasury team that has seen it before. Small firms have an owner who approves things by phone, a bookkeeper who acts on an email, and a culture where questioning the boss feels rude. The fraud is designed for that. It also targets the moments a firm is busiest: month end, a director travelling, a new starter in finance. The control that matters is therefore procedural, not technical, and it has to work when the owner is the one apparently asking.
The four controls
Four procedural controls, none needing new technology, that defeat every variant of the fraud together.
- 01
Call back, always. No payment, payee change, credential reset or data release happens on a voice, video or email request alone. The person confirms by calling a number already held on file for the requester, never a number in the message. This one rule defeats voice clones, deepfake calls and spoofed emails together, and it takes two minutes.
- 02
Two people on every change. A new payee or a change of bank details requires a second named approver in the banking or accounts system, not a verbal go-ahead. Above a threshold, the same for payments. Small firms can do this with two logins and a rule.
- 03
Protect your own domain. SPF, DKIM and DMARC set to reject on the firm’s domain, which the NCSC recommends and which stops criminals sending email that appears to come from you to your own staff and customers. Ask your IT provider; it is a morning’s work.
- 04
A verification culture. Staff are told in writing that they will never be criticised for delaying a payment to check, that the owner will never pressure them to skip the callback, and that a request that discourages checking is itself the warning sign. Thank the person who checks, publicly.
What about deepfake detection?
Detection tools exist and improve, and none is reliable enough to be the control. A firm that relies on spotting the fake will eventually not spot it. The callback rule does not care whether the voice was real; it verifies the request through a channel the fraudster does not control. Train staff to recognise the pattern, urgency, secrecy, a change of payment details, pressure not to check, rather than the artefacts of a synthetic voice, which get better every month.
If it happens
Contact the bank immediately, because recovery depends on speed; report to Action Fraud; tell the supplier whose identity was used; preserve the messages; and review which control was missing rather than who was fooled, because the person who was fooled was following the process the firm actually had. Then adopt the four controls, in writing, that week.
The same rules for your own AI
If the firm runs an AI assistant or agent that can act on instructions, the same logic applies inside it: an email or a message that tells the assistant to pay, send or change something is untrusted input, and the assistant must have a person confirm consequential actions through a separate route. The NCSC’s warning about prompt injection is the machine version of the callback rule.
RelatedAI for the shared inbox
Common questions
How does AI voice cloning fraud work?
A criminal clones a director’s or supplier’s voice from seconds of public audio and calls a member of staff with an urgent, plausible request to pay or change bank details. The control is a callback on a number already held, never on the number given.
How much do UK businesses lose to this kind of fraud?
UK Finance’s 2026 report puts authorised push payment losses at £576.4 million in 2025, £75.6 million of it from businesses, and says criminals increasingly use deepfakes, cloned voices and synthetic identities.
Can software detect deepfakes reliably?
Not reliably enough to be the control. Verify the request through a channel the fraudster does not control instead: a callback on a known number and a second approver on every change.
What is the single most effective control?
No payment, payee change or data release on a voice, video or email request alone, confirmed by calling back on a number already on file. It defeats every variant at once.
What is DMARC and why does it matter?
An email standard that, with SPF and DKIM, stops criminals sending email that appears to come from your domain. The NCSC recommends it; it protects your staff and your customers from impersonation of you.
What should we do if we have paid a fraudulent request?
Contact the bank immediately, report to Action Fraud, tell the impersonated supplier, preserve the messages, and fix the missing control rather than blaming the person.