Voice cloning takes 30 seconds. Here's why your CFO should know
In early 2024, voice cloning required hours of training data and sophisticated infrastructure. By mid-2026, commercial APIs offer convincing voice clones from 30 seconds of audio, accessible for under €10 per generation.
The wire fraud problem
Voice authentication used to be a 'something you have' alongside passwords. It was reasonable: voices were considered hard to forge. That assumption no longer holds.
The pattern security teams report most often: an attacker sources a CEO's voice from a public podcast or earnings call. Generates a clone. Calls the CFO outside business hours, claiming an urgent wire transfer is needed for an acquisition closing tonight. The CFO recognizes the voice. The wire goes through. The actual CEO learns Monday morning.
Impersonation is already a multi-billion business: people in the US alone reported losing $3.5 billion to impersonation scams in 2025 (source: U.S. Federal Trade Commission, June 2026).
What changes for executive teams
Three procedural shifts every team should make:
- Voice alone is no longer authentication. Add a second factor (pre-shared verbal codes, callback to known numbers, or out-of-band confirmation) for any financial action.
- Reduce public voice exposure where possible. Earnings calls and podcasts are part of the job, but not every internal video needs to be public.
- Monitor for clones of executive voices in the wild. If a clone exists, it will be used. Detecting it before it's deployed buys response time.
What technology can do
Voice clone detection is improving but isn't perfect. It works best on clean recordings and is less reliable over phone calls, where compression hides the traces it looks for. The right approach is layered: detection where possible, procedural verification where it's not, and continuous monitoring for unauthorized clones surfacing online.
The bottom line
Voice cloning is now infrastructure, not a novelty. Every executive in a public role has a voice profile that can be cloned. Treating it as a security asset (monitored, authenticated, protected) is no longer optional.