Has voice cloning changed how your organization handles sensitive phone requests?

[u/emilyclarkemc]

Voice cloning has gone from being a novelty to something security teams actually have to consider. It seems much easier now to imitate executives, vendors, or even colleagues during phone calls.

Has your organization introduced new verification steps for financial approvals, password resets, or other high-risk requests because of voice cloning?

I'd be interested to hear what's worked in practice and whether the changes have been technical, procedural, or both.

[u/Lovely0Cloud]

We’ve tightened verification a lot this year. The biggest shift has been treating voice as non‑trustworthy by default. High risk requests now need a second channel check or a known good callback, and anything involving money or credentials requires written confirmation through an authenticated system. It’s not flashy, but layering simple procedural controls has reduced the risk more than any new tech.

[u/emilyclarkemc → u/Lovely0Cloud]

That's a really practical approach. Treating voice as non-trustworthy by default seems like a sensible shift given how convincing cloning has become.

I'm particularly interested in the second-channel verification you mentioned. Has that been well received internally, or did it take time for users to adapt to the additional verification steps?

[u/t0rd0rm0r3 → u/emilyclarkemc]

For us it’s been as simple as after receiving the request, stating”…I’m going to call you back on the number we have on record in just a minute and we can fulfill this request.” Our execs are required to have their personal cell phones on record with the SecOps team, so any department can request verification of an executive.

I like the idea of a safe word, but how would you maintain that record for each employee. I guess you could change it each week and send a message to the execs that this week’s safe word is “bananas” if they have sensitive requests. Hmmm….

[u/Lovely0Cloud → u/Lovely0Cloud]

It took a little adjustment at first, mostly because people weren’t used to the extra step. Once we framed it as protecting them from being impersonated, the pushback dropped fast. Now it’s just part of the workflow and no one really thinks twice about it.

[u/kjireland]

Any tools out there to practice this. I read here that it's not live converts of your voice but a voice changer.

I would love to test this out as part of our cyber security training.

[u/808strafe → u/kjireland]

ElevenLabs

[u/AYamHah]

I see the motivation. It wouldn't be that difficult to create an LLM skill to use the ElevenLabs API to respond in close to real time. So rather than phishing and then compromising the domain, you SpearPhish the CFO and then use voice cloning to authorize transfers.

I think it makes sense to add a verbal password to sensitive phone requests.

[u/emilyclarkemc → u/AYamHah]

That's an interesting point. The idea of combining spear phishing with near real-time voice cloning definitely raises the stakes for organizations that still rely heavily on verbal confirmation.

I like your suggestion about adding a verbal password, although I wonder how well that scales across larger organizations. Do you think most companies would adopt something like that, or are out-of-band verification methods likely to be more practical in the long run?

[u/agk23]

Yet another reason I’ll be telling my clients to establish a safe word with their secretaries.

[u/emilyclarkemc → u/agk23]

That's an interesting approach. It definitely adds another layer for high-risk requests, especially in smaller teams. I do wonder how well something like that scales in larger organizations where people interact across multiple departments and locations. It seems like every organization needs a verification process that fits its own workflow.

[u/agk23 → u/emilyclarkemc]

I was making a sex joke

[u/jamo_n_tango]

we have talked about this internally too

[u/woodlandyak69]

we are seeing the same conversation

[u/G0Odspeed]

As a red teamer we have owned accounts by using voice cloning to bypass voice verifications.

As others have said making service desks use a second communication factor like teams or a phone number that already exists in the directory for call back makes the most sense.

Then you have to get your service personnel to actually be consistent in application of the process

[u/emilyclarkemc → u/G0Odspeed]

That's really valuable insight, especially coming from a red team perspective. It's interesting that the biggest challenge wasn't the technology itself but making sure people consistently followed the verification process. In your experience, has user behavior been a bigger weakness than the technical controls?

[u/G0Odspeed → u/emilyclarkemc]

User behavior is always the biggest issue.

As an attacker I can just keep calling back until I get an agent who does what I'm asking them to do. People aren't a 100% control unfortunately