How a deepfake voice call authorises a fraudulent payment

The phone rings. The caller ID matches a number you know. The voice on the line is the one you have heard dozens of times — the same cadence, the same slight accent, the same way the sentence trails off just before the critical instruction. "We need to move the funds today. Send it to the account in the instruction email." You hang up satisfied that you have just spoken with your counterpart. You have not.

That call was generated by a machine, assembled in real time from a few seconds of publicly available audio, and engineered specifically to clear the one remaining hurdle in a wire-fraud operation: the voice confirmation that your procedures require.

This is not a hypothetical. It is, right now, the fastest-growing category of payment fraud in the world, and it is hitting settlement professionals — closing attorneys, title companies, escrow officers, OTC desks, and brokers — with particular precision, because their work combines three things attackers prize above all else: large single transactions, time pressure at the moment of disbursement, and a culture of authorising by voice.

The scale of what is already happening

Deepfake-as-a-service has become one of the fastest-growing areas of underground cybercrime, and in the first five months of 2026 alone, discussions about deepfake fraud on the dark web already exceeded the total for all of 2025 by 39%.

The FBI's 2025 Internet Crime Report logged 24,768 Business Email Compromise complaints totalling $3.05 billion in losses, with AI-assisted deepfake involvement in BEC growing from under 5% of incidents in 2023 to 40% of incidents by Q1 2026.

Deepfake-enabled vishing attacks — voice-based impersonation over phone or VoIP — surged by over 1,600% in the first quarter of 2025 compared to the fourth quarter of 2024 in the US alone, and Deloitte's Center for Financial Services projects that AI fraud losses in the United States could reach $40 billion annually by 2027.

Cyber-enabled fraud cost $13.7 billion in reported losses in 2024, according to the FBI's Internet Crime Complaint Center, and deepfake scams increased 40% year over year, per security firm Entrust's 2026 Identity Fraud Report.

Real estate and property settlement alone tells a stark story. AI-enabled wire fraud cost US real estate buyers $275 million in 2025 according to the FBI IC3, and deepfake scams increased 40% year over year. Those are only the losses that were reported. Industry estimates suggest only 15–20% of BEC losses are reported to law enforcement, with reputational concerns and incomplete attribution keeping the true scale hidden from public statistics.

The benchmark case that the security industry returns to repeatedly is the January 2024 incident involving engineering firm Arup. A finance employee was deceived by a video call where every participant — including the apparent CFO and several colleagues — was AI-generated, and the firm lost $25.6 million. The employee had initially suspected phishing, but the live video call with convincing AI-generated colleagues, synchronised facial movements, and realistic voice replication overcame his scepticism entirely, and the fraud was discovered only through manual verification with corporate headquarters some time later.

That case has since been eclipsed in sophistication, if not always in dollar value. In January 2026, a Swiss businessman transferred several million Swiss francs after a series of calls with what he believed was a trusted business party, later confirmed to be a voice clone. The technology, the distribution channels, and the economics of the attack have all improved dramatically since Arup.

How the voice is built

The mechanics are worth understanding in detail, because the defences that work emerge from understanding where the attack is fragile.

Voice cloning uses machine learning to generate synthetic speech that matches a specific person's tone, cadence, accent, and even breathing patterns. Attackers begin by collecting short audio samples from public sources — company websites, podcast appearances, recorded presentations, earnings calls, or social media posts.

According to McAfee research, just three seconds of audio is enough to produce a voice clone with an 85% accuracy match to the original speaker. Three seconds. That is shorter than a typical voicemail greeting. The raw material is everywhere: earnings calls, conference keynotes, podcast appearances, voice notes, and social media clips. McAfee also reported that 53% of adults share their voice online weekly, which means most people — and nearly every executive — have already published their training data without realising it.

The pipeline breaks into three stages. Fraudsters first collect audio from public sources such as social media, interviews, or videos. The AI then analyses the sample to capture unique vocal traits such as tone, pitch, and cadence. The AI uses this data to create a synthetic voice that mimics the original speaker with remarkable accuracy, and the cloned voice can be used in real-time or pre-recorded scams, making it a highly versatile tool.

Modern cloning does not just mimic the voice — it mimics the cadence, the slight hesitations, the way a sentence is shaped. That is where the art lies. It is the subtle cues that human brains are wired to recognise and trust.

Voice cloning technology has crossed what researchers call the "indistinguishable threshold," meaning most human listeners can no longer reliably tell a cloned voice from the real one. In one study, human detection accuracy for high-quality deepfake audio dropped to below 25%. Your ear is no longer a reliable security control.

Attackers combine voice cloning with pretexting — the fabrication of a scenario using data gathered through OSINT (Open Source Intelligence). The more data the attacker has gathered, the more convincing the pretext scenario becomes. By the time the call is placed, the attacker knows the names of the parties involved, the approximate transaction size, the expected closing date, the title company being used, and the attorney on the file. None of that is secret. All of it was assembled from email headers, public records, LinkedIn profiles, and in some cases from email inboxes already compromised weeks earlier.

The full attack chain, step by step

Understanding this as a multi-stage operation — not a single phone call — is essential. The voice call is the final step of a carefully prepared campaign. Here is how it typically assembles.

The FBI achieved a 58% recovery rate for real estate wire fraud in 2025, but that figure reflects funds frozen before they left the US banking system. Once funds exit to international accounts, recovery rates drop to near zero.

Why settlement professionals are the primary target

The settlement industry exists to coordinate the disbursement of large sums between multiple parties at the precise moment a transaction closes. A property purchase of $2 million USD (approximately $3.1 million AUD) involves funds flowing to sellers, agents, lenders, title companies, and attorneys — often all within minutes of each other. An OTC desk settling a commercial block trade may disburse $15 million USD (around $23 million AUD) or more in a single transaction window. The combination of factors that make this work legitimate are exactly the factors that make it attractive to attackers.

Time pressure is built in. Closing deadlines are real. Penalties for delayed settlement are contractual. Parties are waiting. An attacker who introduces urgency is not doing anything that feels unusual — urgency is the normal texture of a closing day.

Multiple parties, many points of contact. A complex transaction involves a buyer, a seller, a buyer's broker, a seller's broker, a lender, a title company, a closing attorney, and often a settlement agent. Each of those parties has staff. Each of those staff members is a potential target. Attackers target the human layer — finance employees conditioned to respond quickly to executive requests — using synthetic media that is indistinguishable to the human eye and ear.

Wire instructions change legitimately. Lenders change disbursement accounts. Sellers switch banks between contract and closing. Attorneys use trust accounts that change by transaction. The attacker's instruction change is plausible because instruction changes are a normal part of the process.

Voice verification was the backstop. For years, the industry trained itself to verify wire instruction changes by phone, on the theory that a fraudster could spoof an email but could not spoof a voice. Deepfake voice technology is now being used in phone calls to impersonate real estate agents and title company representatives — meaning that the phone call verification step that previously provided certainty now requires an additional layer. The last line of defence has been compromised.

Impersonation scams showed a 1,400% year-over-year growth in 2025. Scams involving AI components extract 4.5 times more money than traditional scams, averaging $3.2 million per operation.

A concrete scenario: the closing-day voice call

Consider a commercial real estate closing — a $4.8 million USD (approximately $7.4 million AUD) office building sale. The settlement agent has been in email contact with the buyer's attorney for three weeks. The closing is scheduled for 3:00 PM on a Thursday.

At 11:15 AM on closing day, the settlement agent receives an email from a domain that reads [firmname]-law.com rather than [firmname]law.com — one hyphen that most people will not notice. The email explains that the attorney's client trust account has been flagged by the bank for a routine compliance review and that funds should be routed to a secondary account for today's disbursement only. The email includes a PDF with wire instructions bearing the firm's correct letterhead, generated by AI from a template scraped from the firm's website.

At 11:42 AM, the settlement agent's phone rings. The caller ID shows the attorney's known mobile number. The voice is unmistakably the attorney's — the same diction, the same slight habit of saying "correct" at the end of a sentence. The voice confirms the account change, mentions that this is embarrassing and they'd rather not make a thing of it, and says they appreciate the agent handling it quietly. The call is 83 seconds long.

At 12:05 PM, the settlement agent initiates the wire to the new account. The real attorney learns what happened the following morning when the real funds never arrived in the real trust account.

This scenario is not a thought experiment. Scammers are cloning the voices of closers and even attorneys, then calling buyers or sellers at critical moments — usually right before closing — to provide fraudulent wire instructions. The voice sounds exactly like someone the recipient trusts, so they do not think twice.

What does not work as a defence

The instinctive responses to this threat are mostly inadequate. That is not a criticism of the professionals who rely on them — they were designed for a different threat environment.

Recognising the voice. As established above, voice cloning technology has crossed the indistinguishable threshold, and in one study, human detection accuracy for high-quality deepfake audio dropped to below 25%. The ear is not a control.

Checking caller ID. Caller ID is trivially bypassed because attackers spoof numbers matching the executive's known mobile or office line with tools that cost nothing and require no technical knowledge.

Email confirmation of a verbal instruction. Email confirmation of verbal instructions provides no meaningful protection when the email account has been compromised or a convincing lookalike domain passes casual inspection.

AI detection software. Detection models are trained on specific deepfake synthesis pipelines. When attackers use synthesis tools the detector was not trained on, performance collapses. Detection is worth pursuing as a layer, but it cannot be a primary control. AI-powered audio detection tools exist and are worth evaluating, but they carry meaningful accuracy constraints and should be treated as a signal layer rather than a standalone defence. No detection tool reliably identifies every synthetic voice in real-time conditions.

"We'd know if something felt off." The evidence says otherwise. Most organisations still rely on controls that were designed for a threat environment that no longer exists in 2026. Experienced professionals with years of industry knowledge have authorised fraudulent wires after deepfake calls, not because they were naive, but because the synthetic voice was indistinguishable and the scenario was engineered to be plausible.

What actually works

The defence that consistently stops voice-based payment fraud is not voice detection technology. The defence that actually works is not better listening — it is out-of-band verification through a pre-established, independent channel, exactly the same control that stops classic wire fraud, extended to cover voice.

Here is what that means operationally:

Establish authentication before the transaction begins. At the outset of any engagement, agree on a verbal authentication method with every party who could send or receive wire instructions. This can be a code word, a challenge question about a specific prior interaction, or a pre-agreed callback number that is written into the engagement letter. The counter-protocol is to establish a verbal authentication code with the closing attorney and title company at the transaction's outset.

Never validate a change on the same channel that delivered it. If a request arrives via phone, verify through encrypted messaging or a known internal system. Never validate high-value requests using the same channel that delivered them. If the request came by email, call back on a number from the firm's public website — not the number provided in the email. If it came by phone, send a verification message through a pre-established channel.

Require dual authorisation. Remove single-human failure points. Two people must independently verify and approve transactions using separate channels. One person receiving a convincing voice call is a risk. Two people, checking independently through different channels, is a dramatically lower risk.

Implement a mandatory callback policy with a pause. If a counterpart calls requesting an urgent wire transfer, hang up. Call them back on their known, trusted number. Fraudsters rely on the urgency of the moment to prevent the target from taking a breath and verifying. Thirty seconds of pause destroys the attack architecture. The attacker's entire strategy depends on the urgency preventing that pause.

Treat voice exposure as a risk factor. Executives and senior leadership should receive training on voice exposure risk, since executive recordings are frequently used to generate AI voice cloning models. Public-facing audio — conference presentations, webinar recordings, media interviews, podcast appearances — is training data for the clone. This does not mean eliminating public communication; it means being deliberate about what is published and building internal awareness around the risk.

Build verification into the contract, not just the process. The best time to establish a verification protocol is at engagement, not at crisis. Wire instruction change procedures should be documented in engagement letters, closing checklists, and deal workflows. A professional who arrives at closing day with a pre-agreed, documented verification protocol is far harder to defraud than one relying on ad hoc judgment under time pressure.

The structural problem with traditional wire transfers

Every defence described above addresses human-layer controls, and all of them are necessary. But there is a structural dimension to this problem that is worth naming directly.

Traditional wire transfers — the primary payment mechanism for settlement in real estate, commercial transactions, and OTC trades — have two properties that compound the risk of deepfake fraud. First, they depend entirely on the authorisation event, which is the moment the attacker is targeting. The wire instruction is the attack surface. Second, when funds move across multiple correspondent banks and accounts, the disbursement to multiple parties at closing requires a sequence of separate instructions, each of which is a potential interception point.

In a multi-party disbursement — where funds go simultaneously to a seller, a broker, a lender, a title company, and a closing attorney — the traditional approach involves separate wire instructions for each party. Each of those instructions is a document that can be spoofed, a confirmation call that can be cloned, and a delay that leaves a window open for interception.

Settlement finality — the legal moment when a transfer becomes unconditional and irrevocable — lies at the heart of financial stability. When settlement is slow, uncertain, or exposed to after-the-fact reversals, the system must absorb significant credit, liquidity, and operational risks.

This is where the architecture of the payment itself becomes relevant. When the disbursement terms are encoded into a smart contract that executes atomically — all parties receive their preset shares in a single transaction, simultaneously, with no sequential instructions — the attack surface collapses. There is no phone call that could re-route the funds after the transaction is committed, because the distribution logic is written into the transaction itself before the money moves. There is no instruction document to spoof. There is no sequence of wire confirmations to intercept one by one.

The same characteristic that creates recovery challenges — payment finality — is also one of the principal reasons institutions are interested in blockchain-based payments. Financial markets have long favoured systems that provide final and irrevocable settlement. The finality that makes fraudulent onchain payments hard to reverse is the same finality that makes a correctly structured onchain disbursement impossible to redirect after execution. The risk window is not days — it is the moment before the transaction is signed.

This is the architecture that shaka.deal is built for. Rather than issuing multiple sequential wire instructions on closing day — each one a potential target — shaka.deal routes the total deal amount in a single onchain transaction that splits and distributes instantly to every party at their preset shares, simultaneously, with settlement that is mathematically final. The routing logic is set before the payment is initiated. Once the transaction executes, there is nothing to intercept, no follow-up call that changes where the funds go, no instruction document to spoof. Settlement professionals who use it do not give up their role in structuring and managing the deal — they gain a disbursement mechanism that cannot be redirected by a voice, however convincing.

What professionals should take away

The threat model has changed. The attack model is direct: email handles the setup, while synthetic audio and video override scepticism at the exact moment a victim might otherwise pause. The industry's longstanding answer to that scepticism — call and confirm — has been systematically compromised.

When a company loses funds to a deepfake video call and regulators investigate, the question is not simply whether the attack was sophisticated, but whether the organisation had adequate, documented controls in place at the time. The FBI's explicit public warnings, combined with the documented frequency and dollar value of these attacks throughout 2025 and into 2026, mean that organisations can no longer credibly claim they were unaware of the threat when setting their internal fraud prevention standards.

The practical response is not panic — it is an upgrade to verification procedure that matches the current threat. Pre-establish authentication codes. Mandate callbacks through independent channels. Require dual sign-off on any wire instruction change. Never authorise based on a single channel. And when evaluating the payment infrastructure itself, ask whether the architecture of the disbursement reduces the number of exploitable instructions — or multiplies them.

The deepfake voice is extraordinarily good. The process that it exploits does not have to be.

Shaka.deal is a non-custodial onchain payment router on Ethereum. It routes and distributes deal payments in one transaction, simultaneously, to all parties at preset shares. It is built for settlement professionals who need disbursement that is instant, split, and certain.