Scale with AI — October 21, 2026

Quick Take

• The voice on the phone has stopped being proof of anything — a short clip of audio can now be enough to imitate your bookkeeper, your supplier, or you.
• Deepfake fraud is measured in the tens of billions of dollars, the U.S. takes about a third of observed incidents, and businesses your size are prime targets because one person can still approve a payment alone.
• The FCC said this week it is not planning to open the door to AI voice calls without consent. Your rules did not change: consent, calling hours, honest identification, opt-outs honored immediately.
• Businesses handling this well run one boring written rule — no payment, bank change, or password reset on a voice or video request alone — backed by a callback on a known number, a private code word, and two-person approval.
• Your move: write the rule, set the verification kit while nothing is urgent, and call your own number after hours to hear whether your business could be mistaken for a scam.

The Shift

Building a convincing artificial voice used to take a studio, money, and time. That barrier is gone. Voice technology has collapsed into single systems that listen, understand, and speak in one motion, in dozens of languages, with thousands of voices. The same leap that lets a small business answer every call professionally after hours also lets a scammer sound like your bookkeeper, your supplier, or you. Three old habits are now unsafe. I recognized the voice, so I trusted it — a voicemail greeting or a video posted online can be enough material to imitate someone. They knew details about our company, so it must be internal — those details are often public, sitting in listings and reviews. I saw their face on video, so it had to be real — international police warned this month that generated faces and video defeat exactly those trust signals. Seeing and hearing are no longer verification; they are just the claim. And the scale is not hypothetical. A fraud report published this month estimates deepfake-driven fraudulent transactions in the tens of billions of dollars, with the United States accounting for about a third of observed incidents. Voice cloning was about a fifth of cases, and video impersonation even more. This has moved from a trick aimed at celebrities to a routine tool aimed at businesses your size — because your size is where one person can still approve a payment alone.

The Fine Print

The Law starts with a door that did not open. A national political group asked federal regulators to allow AI voice calls to cell phones without consent first. This week, a spokesperson for the Federal Communications Commission said the agency is not planning to grant that request and has no plans to move forward with it. That is a statement, not yet a formal order — but the meaning for your business is clear: the rules did not loosen, for campaigns or for companies. An AI voice is treated as an artificial voice under the federal telephone consumer protection law, and that has been settled for more than two years. If your business calls or texts with automated or artificial voices, you need the right consent on file, you call inside allowed hours in the customer's time zone, you identify yourself honestly, and when someone says stop, the calls stop — and you can prove it. What did change is the trust around your calls. Customers are being warned that a voice on the phone might be generated, so the businesses that win are the ones whose calls are expected, clearly identified, and easy to stop. A surprise call from an unrecognized number now works against you even when it is legitimate. Honest identification, a name the customer recognizes, and a simple way to reach a human are no longer courtesies — they are the difference between your call being answered and your call being treated as a scam. Compliance is not just avoiding a fine anymore; it is whether anyone believes you.

Who’s Doing It

Businesses handling this well share one written rule, and it is beautifully boring: no payment, no bank detail change, and no password reset happens on a voice or video request alone. Ever. Not when the voice sounds right, not when it is urgent, and not when the person asking appears to be the owner — especially not then, because urgency and authority are the two ingredients every one of these scams is built from. In practice they do three things. First, a callback rule: verify any sensitive request by calling a number already on file, not a number supplied in the request — if it is real, a two-minute delay costs nothing; if it is fake, that delay saves the company. Second, a code word: owners and key staff agree on a private phrase in advance, never written in an email or message thread. Third, a second pair of eyes: payments above a limit the owner sets need two people, so no single employee can be talked into moving money alone. International police guidance this month recommends exactly this pattern. Notice what is not on the list: software that claims to detect the fake. Detection has a place, but owners doing this well treat the process as the protection — a detector can be wrong, and it gets harder to be right as voices improve. A callback to a known number works even when the fake is perfect. And there is a customer-facing side: those businesses tell customers up front how they will and will not ask for things — we will never call and ask you to change a payment method on the spot, our system will always say who it is, you can always reach a person. That five-minute conversation turns a fear customers already have into a reason to trust you more than the next company.

Your Move

Three steps, this week. Step one: write the rule down. One sentence is enough — no payment, bank change, or password reset on a voice or video request alone. Put it where your team can see it, and make clear that nobody is ever in trouble for pausing to verify, even if the request seems to come from you. That permission to pause is the whole defense. Step two: set your verification kit. Agree your code word, save the known-good numbers you will call back on, and set the payment amount above which two people must approve. Do it while nothing is urgent — you cannot invent a safe word in the middle of a convincing emergency. Step three: audit how your business sounds. Call your own number after hours. Check whether your answering identifies itself honestly, whether a customer would know it is your business, and how hard it is to reach a human. If your legitimate calls could be mistaken for a scam, fixing that protects revenue you already earned. And if you want this built properly — the consent records, the honest identification, the verification rules, and an answering system customers actually trust — that is what we build at The Agency: technology, rules, and training in one system that fits your business. Start with the free AI audit at theagencyllc.net. The voice on the phone is no longer proof. Your process can be.

Key Takeaways

• Voice is no longer proof: voice technology has collapsed into single systems that listen, understand, and speak in one motion — which makes a convincing imitation of your bookkeeper, your supplier, or you cheap to produce.
• Three old habits are now unsafe: I recognized the voice, so I trusted it; they knew details about our company, so it must be internal; I saw their face on video, so it had to be real. International police warned this month that generated voices, faces, and video defeat exactly those trust signals.
• A fraud report published this month estimates deepfake-driven fraudulent transactions in the tens of billions of dollars, with the United States accounting for about a third of observed incidents; voice cloning was about a fifth of cases, video impersonation even more.
• The FCC said this week it is not planning to grant the political AI-voice waiver — business rules are unchanged: an AI voice is an artificial voice, and consent, calling hours, honest identification, and instant opt-outs still apply in full.
• Process beats detection: a callback to a number already on file, a private code word never written in email or messages, and two-person approval above an owner-set limit hold up even when the fake is perfect.
• The three-step start: write the one-sentence rule (no payment, bank change, or password reset on a voice or video request alone), set the verification kit while nothing is urgent, and audit how your own business sounds after hours.

Full transcript

Alex: Welcome to Scale with AI for Wednesday, October twenty first, twenty twenty six. Today we are talking about trust, because the voice on the phone has stopped being proof of anything. A familiar voice used to settle a question. It does not anymore, and businesses that understand that early will protect their money and keep their customers trusting them.

Jordan: This is our scam protection episode. If your business takes payment instructions, changes bank details, resets passwords, or books work over the phone, this is your episode.

Alex: Segment one, The Shift. Building a convincing artificial voice used to take a studio, money, and time. That barrier is gone. Voice technology has collapsed into single systems that listen, understand, and speak in one motion, in dozens of languages, with thousands of voices. The same leap that lets a small business answer every call professionally after hours also lets a scammer sound like your bookkeeper, your supplier, or you.

Jordan: Explain what that actually means inside a normal business day.

Alex: Three old habits are now unsafe. I recognized the voice, so I trusted it. A voicemail greeting or a video posted online can be enough material to imitate someone. They knew details about our company, so it must be internal. Those details are often public, in listings and reviews. I saw their face on video, so it had to be real. International police warned this month that generated faces and video defeat exactly those trust signals. Seeing and hearing are no longer verification. They are just the claim.

Jordan: And the scale is not hypothetical.

Alex: A fraud report published this month estimates deepfake driven fraudulent transactions in the tens of billions of dollars, with the United States accounting for about a third of observed incidents. Voice cloning was about a fifth of cases, and video impersonation even more. This has moved from a trick aimed at celebrities to a routine tool aimed at businesses your size, because your size is where one person can still approve a payment alone.

Jordan: Segment two, The Law.

Alex: The Law starts with a door that did not open. A national political group asked federal regulators to allow political calls to cell phones using artificial voices, without consent first. This week, a spokesperson for the Federal Communications Commission said the agency is not planning to grant that request, and has no plans to move forward with it. That is a statement, not yet a formal order. But the meaning for your business is clear. The rules did not loosen, for campaigns or for companies.

Jordan: Spell out the rules an owner actually lives under.

Alex: An artificial voice is treated as an artificial voice under the federal telephone consumer protection law, settled for more than two years. If your business calls or texts with automated or artificial voices, you need the right consent on file, you call inside allowed hours, you identify yourself honestly, and when someone says stop, the calls stop, and you can prove it. None of that changed this week. What changed is the trust around it. Customers are being warned that a voice on the phone might be generated, so the businesses that win are the ones whose calls are expected, clearly identified, and easy to stop. A surprise call from an unrecognized number now works against you even when it is legitimate.

Jordan: So compliance is not just avoiding a fine anymore. It is whether anyone believes you.

Alex: Honest identification, a name the customer recognizes, and a simple way to reach a human are no longer courtesies. They are the difference between your call being answered and your call being treated as a scam.

Jordan: Segment three, Who's Doing It. Who is handling this well?

Alex: Businesses handling this well share one written rule, and it is beautifully boring. No payment, no bank detail change, and no password reset happens on a voice or video request alone. Ever. Not when the voice sounds right, not when it is urgent, and not when the person asking appears to be the owner. Especially not then, because urgency and authority are the two ingredients every one of these scams is built from.

Jordan: What do they do instead, in practice?

Alex: Three things. First, a call back rule. Verify any sensitive request by calling a number already on file, not a number supplied in the request. If it is real, a two minute delay costs nothing. If it is fake, that delay saves the company. Second, a code word. Owners and key staff agree a private phrase in advance, never written in an email or message thread. Third, a second pair of eyes. Payments above a limit the owner sets need two people, so no single employee can be talked into moving money alone. International police guidance this month recommends exactly this pattern.

Jordan: I notice what is not on that list. Software that claims to detect the fake.

Alex: Detection has a place, but owners doing this well treat the process as the protection. A detector can be wrong, and it gets harder to be right as voices improve. A call back to a known number works even when the fake is perfect. Assume the imitation will be flawless, and design the rule that still holds.

Jordan: And there is a customer facing side to this too.

Alex: There is, and it is an opportunity. Those businesses tell customers up front how they will and will not ask for things. We will never call and ask you to change a payment method on the spot. Our system will always say who it is. You can always reach a person. That five minute conversation turns a fear customers already have into a reason to trust you more than the next company.

Jordan: Segment four, Your Move. Three steps for this week.

Alex: Step one, write the rule down. One sentence is enough. No payment, bank change, or password reset on a voice or video request alone. Put it where your team can see it, and make clear that nobody is ever in trouble for pausing to verify, even if the request seems to come from you. That permission to pause is the whole defense.

Jordan: Step two?

Alex: Step two, set your verification kit. Agree your code word, save the known good numbers you will call back on, and set the payment amount above which two people must approve. Do it while nothing is urgent. You cannot invent a safe word in the middle of a convincing emergency.

Alex: Step three, audit how your business sounds. Call your own number after hours. Check whether your answering identifies itself honestly, whether a customer would know it is your business, and how hard it is to reach a human. If your legitimate calls could be mistaken for a scam, fixing that protects revenue you already earned.

Jordan: And if an owner listening wants this built properly, the consent records, the honest identification, the verification rules, and an answering system customers actually trust?

Alex: That is what we build at The Agency. Technology, rules, and training in one system that fits your business, so you do not have to become a security expert on top of running your company. Start with a free A I audit at the agency l l c dot net. The voice on the phone is no longer proof. Your process can be.

Sources

1. INTERPOL — deepfake awareness campaign and multi-step verification guidance, October 2026 ↗
2. FCC — AI voice calls, artificial-voice rules and consent ↗
3. The Agency — Free AI Audit ↗