AI Voice Cloning Fraud: What the UK Government Just Warned, How Much Businesses Are Losing, and What to Do First

UK businesses lost £1.28 billion to payment fraud in 2025, a record high, and a growing share of those losses are starting with a phone call (UK Finance Annual Fraud Report 2026).

On 15 April 2026 the UK government wrote an open letter to every business leader in the country, warning that AI is changing the cyber threat in ways most businesses have not caught up with. AI voice cloning is one of the clearest, fastest-moving examples.

This is a plain guide to what voice cloning is, what the government actually said, what it is costing UK businesses, and the order to deal with it.

If you are searching for:

AI voice cloning scams UK
deepfake CEO fraud
voice clone fraud business
AI vishing UK 2026

You are in the right place.

What is AI voice cloning?

Voice cloning is the use of AI to build a synthetic copy of a real person's voice. Modern tools can do it with only 3 seconds of audio.

Once the clone exists, an attacker can make it say anything in real time. It keeps the original person's accent, cadence and tone. On a phone call, it sounds like them.

The source material is usually free and already public. LinkedIn videos, conference talks, podcast guest spots, webinar recordings, voicemail greetings, even the recorded welcome message on your company's hold music. If your CEO or finance director has spoken in public, the raw material is sitting on the open internet.

What did the UK government say in April 2026?

On 15 April 2026 the Secretary of State for Science, Innovation and Technology Liz Kendall and Security Minister Dan Jarvis published an open letter to UK business leaders on AI cyber threats.

The headline points, in the government's own words:

AI models are doing work that previously needed rare expertise, including finding weaknesses in software and writing the code to exploit them
The government's AI Security Institute (AISI) tested a new model from Anthropic called Mythos and found it "substantially more capable at cyber offence than any model we have previously assessed"
AISI now assesses that frontier AI model capabilities are doubling every 4 months, compared to every 8 months previously
Criminals "will target ordinary companies, of every size, in every sector. Attackers go where defences are weakest"

The letter does not call out voice cloning by name. It is broader than that. But it is the clearest official warning yet that the threat curve has changed, and voice cloning is one of the most visible ways it is hitting UK businesses right now.

The government's recommended actions are direct:

Take cyber security seriously at the top of your organisation. Use the Cyber Governance Code of Practice. Smaller businesses should use the NCSC Cyber Action Toolkit
Get Cyber Essentials certified. Free cyber insurance is included for small organisations that achieve it
Follow NCSC advice and sign up to the free Early Warning service

How big is this in pound terms?

The numbers, all from UK government and UK Finance sources:

£1.28 billion lost to UK payment fraud in 2025, up 4% on the year (UK Finance Annual Fraud Report 2026)
£576.4 million of that was authorised push payment (APP) fraud, where someone is tricked into authorising the payment themselves. Up 19% year on year
17% of APP fraud cases originated through telecoms channels, the phone-call end of the threat
£221.5 million lost to investment fraud alone, up 40% on the year
38% of UK businesses reported a phishing attack in the last 12 months, the most common breach type by a wide margin (Cyber Security Breaches Survey 2025/2026)
69% of affected businesses said phishing was the most disruptive type of breach they experienced

UK Finance recorded more than 4 million fraud cases across the year. Voice cloning sits at the higher-value end of that picture, because the attacker is usually going after a specific finance approver and a specific payment.

The 2019 UK energy firm case, where a cloned CEO voice was used to authorise a transfer of around £200,000, is no longer the outlier. It is the template.

How is a voice clone actually used in an attack?

The pattern is consistent across the UK cases on record:

The attacker scrapes public audio of a senior leader from LinkedIn, YouTube, podcasts, webinars or a voicemail greeting
They generate a voice clone. With current tools this takes minutes, not days
They identify a target who can move money or change a supplier bank record. Usually a finance team member, an executive assistant, or an accounts payable approver
They call. The cloned voice creates urgency, secrecy and authority. "Confidential acquisition." "Stuck in a meeting, need this done before close of business." "Don't loop anyone else in until it is signed off"
The payment goes out. By the time anyone calls back through normal channels, the money is gone

The defence is not a clever filter on your phone system. It is your process.

Why "I know my boss's voice" no longer works

It used to be a reasonable rule. Until 2023, voice cloning needed expensive kit and proper technical skill. Now it does not. Consumer-grade tools costing less than the price of a Microsoft 365 licence, plus a short audio sample, will do the job.

Detection by ear is no longer reliable. Studies show humans correctly identify high-quality synthetic voices less than half the time. Once an attacker layers in urgency, authority and a plausible reason for the secrecy, even trained staff struggle.

The Cyber Security Breaches Survey 2025/2026 found that only 27% of UK businesses have a board member with responsibility for cyber security, down from 38% in 2021. The threat curve is going up, board-level ownership is going down.

What should UK businesses do this week?

The advice from government, NCSC and UK Finance points in the same direction. Practical steps, in order:

Set a two-channel rule for payments. Any new payment, change of supplier bank details, or unusual request must be verified on a second, pre-registered channel before it goes ahead. Not a callback to the number that just rang
Agree a verbal challenge phrase for senior leaders and finance approvers. Rotate it. No tool required, just discipline
Turn on multi-factor authentication on every account that can authorise a payment or change supplier bank details
Lock down your email domain with DMARC at p=reject. This stops attackers spoofing your own domain in the look-alike emails that often accompany the voice call
Get Cyber Essentials certified. It is the government-backed baseline and the letter from Kendall and Jarvis names it directly. Free cyber insurance is included for small organisations that achieve it
Use the NCSC Cyber Action Toolkit if you are a small business and need a free starting point
Update your phishing awareness training to include AI voice and video, not just suspicious emails. The "spot the bad grammar" rule is out of date

Where to start if you want a proper plan

If your phones, your email, your supplier records and your finance approvals all sit across different systems and providers, joining them up is where the protection actually lives.

At West Pier Technologies we hold Cyber Essentials Plus and we work across telephony, Microsoft 365, connectivity and cyber security for UK businesses. We will:

review your payment authorisation and supplier change process
audit your email domain authentication (SPF, DKIM, DMARC)
check your Microsoft 365 and Teams security against current NCSC and Cyber Essentials baselines
run AI-aware phishing and voice cloning awareness training for your team
map a Cyber Essentials path if you do not already hold the certification

Contact West Pier Technologies today to plan your defence against AI voice cloning fraud.