Gordy McDonald played a video in Aviemore that stopped the room.
A young woman’s voice, urgent and distressed, asked her parents for money. She had been in an accident. She needed help immediately. Could they transfer some funds?
The voice was completely synthetic. Generated by AI from a few seconds of real audio taken from social media. The person it was imitating had no idea it existed. The room, 74 business owners, went very quiet.
This is not a future threat. It’s happening now. Gordy and Mark Gallagher both believe this attack will speed up the most in the next two to three years.
WHAT A BUSINESS OWNER EXPERIENCES
A call arrives from someone whose voice you recognise. Your CEO. A senior colleague. A family member in trouble. The scenario is entirely believable. The urgency is real. Your instinct is to help immediately.
The call asking for an urgent payment transfer while the boss is travelling. The panicked message from a family member who needs money right now. The supplier who sounds exactly like the contact you have dealt with for years. You can now do all this with a laptop, free tools, and just a few seconds of audio from social media.
WHAT IS REALLY HAPPENING
Criminals gather voice samples from videos that are already public. A talk you gave at a conference. A podcast appearance. A birthday video a family member shared. Your company’s promotional reel. AI models reconstruct voice, tone and cadence from as little as three seconds of usable audio. From that, they can generate a new recording saying anything they choose.
The business applications are already in use. Fake CEO voice calls instructing finance staff to approve urgent payments. Fabricated video calls using cloned faces in real time. Synthetic media can be used for blackmail. It can harm reputations. It can also pressure people into decisions they wouldn’t make with more time.
WHY SMALL BUSINESSES ARE THE MOST EXPOSED
Large organisations have formal approval processes. Compliance teams and IT departments also monitor for any anomalies. In a small business, your staff trust you personally. They recognise your voice. They want to be helpful and responsive. They do not want to waste your time by second-guessing when you sound stressed and rushed.
That culture is a real strength of small businesses. This attack aims to exploit it.
The good news is that the defence requires no technology at all.
ACTION THIS DAY
1. Agree a safe word with your senior team today. Choose a word or short phrase that would never appear in normal business conversation. Anyone calling in an urgent or unusual situation should be able to say it on request. If they cannot, the call stops and you verify through a number you already hold. It sounds low-tech. It works precisely because criminals cannot know it.
2. Set a firm rule and say it out loud at your next team meeting: no financial action on the basis of a voice call alone. Every payment, no matter how urgent, needs written confirmation through a separate channel. Not a new number. Not a new email address. A channel that was already in place before the call arrived.
3. Do a quick audit of your public audio. If you have videos of yourself speaking online, know that the audio can be used for voice cloning. You do not need to take everything down. Your team must grasp the verification rule so well that no voice, no matter how familiar, slips past it.
CONVERSATION TO HAVE WITH YOUR TEAM
At your next meeting, ask everyone this: If you received a call that sounded like me asking for an urgent transfer while I was away, what would you do? The right answer is: I would tell you I need to call you back on the number I already have, and then do exactly that. Make clear that this response is not rude, not disrespectful, and not optional. It is the rule. Make sure everyone knows that following it is expected and will never be questioned.
This is Article 1 in the Cyber Resilience for Business Owners series. It’s based on the Highlands and Moray Chambers Joint Cyber Resilience Event in Aviemore, February 2026. Speakers: Gordy McDonald (Police Scotland), Mark Gallagher (Police Scotland).
