🔴 What Happened

In February 2024, a finance employee at a multinational firm in Hong Kong transferred $25 million to fraudsters after a video call with what appeared to be the company’s CFO and several senior colleagues. Every person on the call was a deepfake generated from publicly available footage. That incident has since become a blueprint. Voice cloning technology can now produce a convincing replica of any person’s voice from as little as three seconds of publicly available audio — a podcast clip, an earnings call recording, a LinkedIn video. The FBI’s 2025 Internet Crime Report, published earlier this year, included a dedicated AI section for the first time, logging more than $893 million in AI-enabled scam losses across more than 22,000 complaints. Meanwhile, 71% of organisations now report an increase in AI-powered fraud attempts over the past twelve months.

⚡Why It Matters to SMB Operators

The controls most small businesses rely on — call your supplier to confirm, video-verify an unusual request, check the sender domain — were built on one assumption: that the person on the other end is a real human being. AI has made that impersonation dramatically more scalable, and accounts payable sits at the intersection of trust and timing — teams processing invoices under pressure to keep operations running smoothly are exactly the target attackers look for. For an SMB without a dedicated fraud team, a single authorised payment redirected to a cloned account number can be a liquidity event, not just an irritation. Attackers intercept legitimate invoice exchanges and quietly alter the destination account, then send a short message claiming a supplier has updated their banking details — a request that, on its own, looks entirely routine. The danger is not that your staff are careless. The danger is that they are following a process that no longer fits the threat.