A phone call from a panicked "grandchild." A voicemail from the "CEO" asking finance to rush a wire. A text from the "IRS" with a link that looks exactly right. AI has not invented new scams — it has made the old ones sound and look real. Here is what is actually happening and what genuinely works to stop it, for your family and for your business.
Why AI Changed the Scam Playbook
Voice-cloning tools can now recreate a recognizable version of someone's voice from a short public clip — a video posted online, a voicemail greeting, a conference recording — and use it in a live or recorded phone call. The old advice to "listen for something off" is far less reliable than it used to be, because the thing that used to give a scam away, an unfamiliar or robotic voice, is exactly what AI now fixes for the scammer.
The Family Emergency Scam, Now With a Cloned Voice
The Federal Trade Commission has warned that scammers are using AI voice cloning to enhance the classic "family emergency" con: a call or message claiming a loved one is in jail, in an accident, or in trouble abroad and needs money wired immediately, often paired with pressure to keep it secret from other family members. The FTC's core advice has not changed even though the technology has: stop, hang up, and call the family member back directly on a number you already know to be theirs, rather than any number the caller gives you.
The Business Version: Deepfake Executives and Fake Vendors
The same technique shows up in business email compromise, where a scammer impersonates an executive, vendor, or client — sometimes now with a cloned voice on a follow-up call — to push a bookkeeper or finance employee into an urgent, off-process wire transfer or a change to vendor banking details. What makes these attacks effective is not sophistication; it is urgency and a plausible authority figure asking for something that feels slightly outside normal process, timed for a moment when the target is busy or the real decision-maker is unreachable.
What the Numbers Say
Business email compromise remains one of the costliest categories of cybercrime the FBI tracks. According to the FBI's Internet Crime Complaint Center (IC3), total losses reported to IC3 reached $16.6 billion in 2024, with business email compromise complaints alone accounting for roughly $2.8 billion of that figure — and close to $8.5 billion in cumulative BEC losses reported over the prior three years. These are reported losses only; the actual figure is almost certainly higher.
The IRS Is Warning About This Too
The IRS's own annual "Dirty Dozen" list of tax scams now flags AI-enabled impersonation as a rising threat — fraudsters using deepfake audio and video to impersonate IRS agents or tax professionals, and AI-generated content circulating on social media as if it were legitimate tax advice. The IRS's guidance is consistent with the FTC's: verify independently, do not act on unsolicited pressure to move money or share personal information quickly, and never treat AI-generated answers to a tax question as a substitute for advice from someone who actually knows your situation.
Five Practical Defenses That Actually Work
None of these require any technical expertise, and all of them work whether the threat is a cloned voice or an old-fashioned con: First, agree on a family code word that would never come up naturally in conversation, and ask for it if anyone calls in apparent distress. Second, always call back on a number you already have — never one given to you during the suspicious call. Third, in the business, require a second, independent confirmation (a phone call to a known number, not a reply to the same email or a callback to a number in the message) before changing any vendor bank details or approving an unusual wire. Fourth, treat urgency itself as a warning sign — real emergencies rarely require you to skip your normal verification steps. Fifth, limit how much personal audio and video of yourself and your family is public, since that is the raw material scammers use to build a convincing clone.
How VarStan Helps
As your bookkeeping and advisory partner, we build dual-control payment approval and vendor-verification steps directly into how we handle your accounts, so an urgent-sounding email or call is never enough, on its own, to move money out of your business. We also help clients think through where their family and business finances overlap — because the same discipline that protects a business wire transfer protects a family from a convincing phone call. If you want a second set of eyes on your current approval process, that is a conversation worth having before you need it.