A few seconds of speech is now all a fraudster needs. With just three to four seconds of recorded audio, AI tools can clone a person’s voice well enough to fool colleagues, family members and finance teams. Indian enterprises are fast becoming prime targets.
The raw material is everywhere. Executives speak on earnings calls, podcasts, webinars, LinkedIn videos and YouTube interviews. Every public appearance gives attackers a ready-made voice sample, and free or low-cost cloning tools can turn it into a realistic fake within minutes.
The threat is already widespread. A McAfee survey found that 47% of Indian adults had experienced an AI voice scam or knew someone who had, nearly double the global average. Of the Indian victims, 83% lost money.
For businesses, the stakes are far higher. In early 2024, an employee at engineering firm Arup in Hong Kong transferred about US$25 million after a video call in which the “CFO” and other colleagues were all deepfakes. In India, scammers have used deepfake videos of prominent business leaders to promote fake investment schemes.
Attacks on companies usually follow a familiar script. A “CEO” calls finance to approve an urgent payment. A “vendor” asks to change its bank details. A “senior manager” requests passwords or confidential files. Because the voice sounds genuine, employees skip the usual checks.
Defences must evolve as fast as the threat. Companies should require a call-back on a known number before acting on any payment or data request, agree on code words for sensitive approvals, and train staff to treat urgency as a warning sign. Deepfake detection and voice-forensics tools can also flag synthetic audio and video in real time.
India’s data protection rules add urgency. Under the DPDP framework, organisations are accountable for protecting personal data, including voice and facial data. In a world where hearing is no longer believing, verification, not trust, must become the default.
