A finance worker joins a video call with his company's CFO and several senior executives. Everyone looks right. Everyone sounds right. He wires out more than twenty-five million dollars — and every other person on that call was a deepfake. That case is documented, and it's the extreme end of something now aimed at businesses of every size: AI voice clones and synthetic video built to trick your team into moving money. Preparing for it doesn't take exotic software. It takes a protocol.
The Shift
The numbers say this is no longer a curiosity. The FBI counted more than twenty-two thousand AI-related fraud complaints in 2025, with losses approaching nine hundred million dollars. IBM's latest breach research finds that one in four malicious breaches now involves AI, with deepfake impersonation the most common pattern — and an AI-involved breach can add up to a million dollars to the cost. Meanwhile, small businesses are adopting AI quickly and loosely: in Pax8's Q3 2026 survey of more than a thousand SMBs, sixty-seven percent of AI-using businesses had built their own solution, and thirty-five percent discovered employees running unsanctioned "shadow AI" tools in the past six months. The same technology that makes a cloned voice dangerous is the one your competitors are using to answer phones and follow up leads. The answer isn't to avoid AI — it's to run it with governance.
The Law
Regulators are treating synthetic voices as a serious fraud vector. Pennsylvania's Act 47 takes effect Sunday, October 18, 2026: automated and AI-voice calls require documented prior express written consent, calling hours are limited to 9 AM to 7 PM Monday through Saturday with no Sundays or holidays, and — critically — if you have no consent record, the law treats consent as absent. Maryland's deepfake fraud law took effect October 1, making AI impersonation used for fraud a felony. For your own outbound calling and texting, the lesson runs both ways: document consent like it will be audited, because it may be.
Who's Doing It
The businesses beating these scams share three habits. First, callback on a known number: any payment request that arrives by phone or video gets verified by hanging up and dialing the number already in the company records — never a number supplied in the request itself. Second, a code word: a rotating word or phrase only the real team knows, required before money moves; a cloned voice doesn't know it. Third, two-person approval: above a threshold you set, a second human approves every payment, every time. None of this costs anything, and it would have stopped the twenty-five-million-dollar call cold. Phone makers are also starting to ship on-device fake-call detection — useful backup, never the plan itself.
Your Move
This week: write the three rules down, tell your team that no real executive will ever punish them for verifying, and pick your approval threshold. Then run the other side of the audit before Sunday — confirm that every automated or AI-voice call your business makes has documented consent behind it and respects the new Pennsylvania hours, wherever you call. Want a structured look at where your business leaks time, money, and risk? Take The Agency's free AI audit — eleven questions, an instant scored report, no obligation. Or hear this episode first: Scale with AI — October 15, 2026. And if you'd rather map it with a human, start a conversation with The Agency — this is exactly the kind of system we build.