Will AI voice cloning appear in email scams?

Yes, and it's already happening. Voice cloning scams aren't a future problem you can put off thinking about. Attackers are already harvesting executive audio from earnings calls, YouTube videos, and conference recordings, then using cheap AI tools to generate convincing fake voicemail files. Those files get dropped into phishing emails as attachments under subject lines like "Urgent voice message from CFO" or "Listen before you respond."

The technical bar for this is surprisingly low. Several publicly available tools can clone a voice from as little as 30 seconds of audio. That means any executive who's done a podcast, a webinar, or a public earnings call is already a potential target. The cloned audio doesn't need to be perfect. It just needs to be good enough to create urgency and short-circuit critical thinking.

How these attacks typically play out:

• Voicemail attachment in a BEC email. A phishing email arrives with a cloned voice note attached, impersonating your CEO asking for a wire transfer or credential reset. The email gives it context. The voice gives it credibility.
• Phone follow-up after the email. The attacker sends a phishing email first, then calls the target using a cloned voice to "confirm" the request. Two-channel pressure is much harder to dismiss.
• Fake voicemail portals. The email doesn't even include a real audio file. It includes a screenshot of a voicemail notification with a "play" button that links to a credential-harvesting page. The cloning happens offsite, or doesn't need to happen at all because the visual framing is enough.

So what can you actually do about this?

Train your team to treat voice as unverifiable by default. This is the hard truth most organizations haven't accepted yet. A voice in a voicemail attachment is not proof of identity, any more than a logo in an email is proof of legitimacy. Explain why, not just what to watch for.

Set up out-of-band verification for anything financial or access-related. If someone claiming to be your CFO asks for action via email or voicemail, the rule should be to verify through a pre-established method that isn't email or the phone number provided in that same message. A known Slack channel, a pre-saved direct number, a team call. Pick one and make it a policy.

Treat unusual delivery as a red flag, not a convenience. A legitimate executive almost never needs to send you a voicemail attachment inside an email. If the message is that urgent, why isn't it a real call? Ask that question out loud with your team.

Establish a "weird request" safe word or verification code. Some companies now use a short, private confirmation word that employees can ask for in any unusual request scenario. It sounds low-tech because it is. It also works.

The good news is that AI-based phishing detection is also advancing. Some email security platforms are starting to flag voicemail-in-email patterns and anomalous sender behavior. But right now, your strongest defense is a culture that's comfortable asking "wait, let me verify this" without feeling rude about it.

If your organization handles wire transfers, has public-facing executives, or works in finance or legal, this threat deserves a real conversation at your next security review. Not a paragraph in a training deck. An actual drill.