FBI Warns of Surge in Business Email Compromise Targeting CFOs with AI Voice Cloning
The FBI's IC3 issued a warning about a significant increase in BEC attacks targeting CFOs and finance teams at small businesses, using AI-generated voice cloning to impersonate executives in phone calls.
The New BEC Threat: AI Voice Cloning
Business Email Compromise (BEC) has long been one of the most financially damaging cyber threats facing small businesses. In 2025, BEC attacks cost U.S. businesses over $2.9 billion according to FBI IC3 data. In 2026, attackers have added a dangerous new capability: AI-generated voice cloning. Using publicly available audio samples — often from LinkedIn videos, YouTube interviews, or company website recordings — attackers can now generate convincing voice replicas of executives in real time. Finance teams receive a phone call that sounds exactly like their CEO or CFO, instructing them to process an urgent wire transfer.
How the Attack Works
A typical AI-enhanced BEC attack follows this pattern: First, attackers compromise or spoof an executive's email account and send a message to the CFO or finance team about an urgent, confidential wire transfer. When the finance employee tries to verify by calling the executive, the attacker intercepts or anticipates this and calls the employee first using an AI-cloned voice. The voice clone confirms the wire transfer request and provides urgency and authority. The finance employee, believing they have verified the request verbally, processes the transfer. By the time the fraud is discovered, the funds have been moved through multiple accounts and are unrecoverable.
Protecting Your Organization
The most effective defense against AI voice cloning BEC attacks is a strict, documented wire transfer verification protocol. Establish a policy that all wire transfers above a defined threshold (e.g., $5,000) require dual approval and verbal verification using a pre-established callback number — not a number provided in the request. Create a code word system for executive-initiated financial requests that only internal staff know. Train your finance team to recognize the social engineering tactics used in BEC attacks, including artificial urgency, requests for secrecy, and pressure to bypass normal procedures. Consider implementing email authentication controls (DMARC, DKIM, SPF) to reduce email spoofing.
- Implement a verbal verification protocol for all wire transfers — call back on a known number, not one provided in the request
- Train finance staff to recognize BEC tactics including AI voice cloning
- Require dual approval for all wire transfers above a defined threshold
- Never process a wire transfer request received only via email without voice verification
- Report suspected BEC attempts to the FBI's IC3 at ic3.gov
Need Help With This Threat?
Our San Antonio security team can assess your exposure, apply patches, and protect your business before attackers strike.
Stay ahead of the next threat
Get weekly security alerts — breaches, patch updates, compliance news, and threat intel — delivered free to your inbox every week.