When Even the CEO's Voice Can Be Faked: Rewrite How You Approve Phone and Voice Orders
Block, the company led by Jack Dorsey, has unveiled a new voice model. According to Zoomit, it can simulate natural human conversation, and its voice is nearly indistinguishable from a real person's. TechCrunch also reports that, according to Block, the model can run locally on a MacBook M4 Max.
That second detail is the one business leaders should focus on. Voice cloning tools have existed for some time, but a model of this quality running on a laptop, without a data center, lowers both the cost and the skill needed to misuse it. Put simply, convincing voice forgery is no longer reserved for sophisticated, well-funded groups.
The risk scenario is a familiar one. Someone in finance gets a call from the "CEO," who urgently asks them to wire money to a new supplier's account. Alternatively, a voice message from the "CFO" asks for a customer list or account details. These attacks rely less on technology than on two old levers: urgency and the seniority of the person making the request.
Iranian organizations are especially exposed to this threat. In many companies, a large share of approvals happens through a phone call or a voice message on WhatsApp or Telegram, often from personal accounts outside official company systems. At the same time, executives' voices are easy to find in interviews, webinars, social media, and even internal work groups. When hearing the boss's voice is itself the authorization, faking that voice is enough.
The first fix is two-channel verification. Any financial instruction or request for sensitive information that arrives by phone or voice message should be confirmed through a second, independent channel. For example, the employee calls back on the number listed in the company's internal directory, not the number that called them. Another option is to log the request in writing through an official system or company email. Above a defined amount, require approval from two people.
The second fix is a verbal code word. Senior executives and finance staff can agree on a passphrase or challenge question in person, never store it in messaging apps, and change it periodically. Alongside this, state clearly that no instruction is urgent enough to skip the procedure. The CEO should personally commit not to blame any employee who delays an order for a few minutes in order to verify it.
The third fix is staff training. A few short, scenario-based sessions with simulated calls work better than a long memo. Employees should recognize the warning signs: unusual urgency, requests to keep the matter confidential, a new account number, and pressure to bypass the normal process. They should also understand that a familiar voice alone is no longer proof of legitimacy.
Our suggestion is to start small. Write a one-page procedure for verifying voice instructions, rehearse it with your finance team and executive assistants, and review it every few months. Voice-cloning technology is moving fast, but a simple, well-established process remains one of the most effective shields an organization has.
Z Solutions