“I know their voice” used to feel like intimate verification. It is now a dangerous confidence signal.
Synthetic voice, edited audio, compromised calls and carefully researched impersonation have reduced the cost of sounding plausible. More importantly, most fraud does not require a perfect clone. Context, urgency and the listener’s desire to help do the rest.
Voice should establish intent, not identity
A call can explain what the principal wants. It should not alone authorise a new beneficiary, credential reset, transfer of records, change of ownership, emergency access or override of normal procedure.
The same applies to video. A recognisable face and voice may improve confidence, but they remain content delivered through a potentially compromised channel.
Use consequence-based confirmation
- Low consequence: ordinary conversation may be sufficient.
- Material but reversible: confirm through a second established channel.
- High consequence: require a second person, transaction-specific confirmation or pre-agreed signing method.
- Authority-changing: use formal evidence and a cooling period where possible.
Do not use personal trivia as the second factor. Research, prior leaks and social relationships make it weak. The second factor must be independent of the call’s content and channel.
The position
Private organisations should explicitly retire “recognised voice” from their control language. Staff need permission to interrupt even a convincing principal and complete the verification step. A genuine principal may be annoyed for ninety seconds. An institution may live with that. It may not live with a persuasive synthetic order.