A Cloned Voice Asks Accounts Payable to Change the Paving Contractor's Bank Before the $340,000 Draw

Forty-one minutes of the Finance Director's voice is already public

Go to your city's YouTube or Granicus channel and open the March budget workshop. The Finance Director walks the council through fund balance for forty-one minutes. Clean audio, single speaker, no crosstalk. That recording is required to be public in most states, and it should be. It is also everything anyone needs to reproduce her voice convincingly on a telephone.

The same channel gives away more than the voice. Your agenda packet names the paving contractor that won the resurfacing award, the contract amount and the date the council approved it. Your minutes record when the Notice to Proceed was issued. Someone reading nothing but publicly posted municipal documents knows who owes what to whom and roughly when the next progress payment clears. In every other industry that person would have to guess. In yours you publish it, because you are required to.

So the question is not whether someone can call your Accounts Payable Clerk sounding like the Finance Director. They can. The question is which single phone-authorized action in a city hall is worth the effort, and what stops it.

The one phone call that moves the most money

It is not a wire request from the Mayor, though that gets tried. It is a change of remittance details on an existing vendor in the vendor master file. Somebody calls Accounts Payable, identifies themselves as the paving contractor's controller — or, in the nastier version, as your own Finance Director calling from the road — and says the company changed banks, here is the new routing and account number, please update it before the pay application on the resurfacing contract goes out Thursday.

That is a small clerical edit in Tyler Munis or BS&A or whatever runs your finance side. Nobody signs a check. Nobody approves anything unusual. The payment already approved by council, already encumbered, already supported by a pay application with the schedule of values attached, simply lands in a different account. And unlike a check you can stop, an electronic payment is typically gone within a day or two, and getting any of it back depends on whether the receiving bank will freeze what is left.

Caller verification, in this context, means confirming who is on the phone through a channel the caller did not choose, before anything in the vendor master file or a utility account changes. That definition is doing a lot of work. The channel the caller did not choose is the whole control.

Why "I recognized her voice" stopped being a control in 2026

Every AP clerk in America has been running an informal voice check for thirty years. You know the contractor's office manager. You know the way the Finance Director says your name. That check was never written into a procedure because nobody had to write it down. It just worked.

What changed is that voice cloning from a short sample got cheap and got good, at the same time that speech-to-speech systems began holding a natural back-and-forth with roughly a fifth of a second of delay. The caller no longer sounds like a recording played at you. They pause where a person pauses, they answer what you ask, and they can say "hang on, let me pull the contract number" and come back with it, because everything they need is in the agenda packet you posted.

The defenses that still hold are the boring ones, and they always were the real ones: callbacks to a number you already had, written authorization from a named signer, a waiting period, and two people instead of one. Voice was never a strong control. It was just the one everybody used.

flowchart TD
  A["Caller: new bank for the paving pay app"] --> B["AP clerk opens a change ticket, changes nothing"]
  B --> C["Callback to the number in the signed contract file"]
  C --> D{"Authorized signer confirms?"}
  D -->|No answer, or a new number offered| B
  D -->|Yes| E["Written request on letterhead plus contract PIN"]
  E --> F["Finance Director approves as second signature"]
  F --> G["Prenote sent, three business days, then release"]

The change-of-remittance procedure that actually holds

Write it down, put it in the AP desk manual, and make it apply to every vendor without exception, including the ones you have paid for twenty years. Six steps:

• The clerk never changes the record on a call. The call opens a ticket. That is all a phone call can do.
• Call back on the number in the contract file or on the W-9 in the vendor folder — never the number the caller gives you, never the number in the signature block of the email that prompted the call.
• Require it in writing on company letterhead, signed by a person named as an authorized signer in the executed contract. Not "the accounting department." A name you can match to a document you already have.
• Use a callback code set at contract execution. When the Purchasing Agent routes the contract for signature, capture a four-digit code and a direct number for whoever may change banking details. It costs nothing and it defeats a caller who has read every public document you have.
• Dual authorization. The AP Clerk cannot save a banking change alone; the Finance Director or Treasurer approves it in the system, logged with a date and a name.
• Send a prenote and hold three business days. Then release. If a vendor cannot wait three days for a bank change they have known about for weeks, that itself is information.

One more thing, unrelated to technology: your public-entity risk pool's crime coverage very likely carries a social engineering fraud sub-limit far below your largest progress payment, and often conditions coverage on a documented verification procedure. Pull the policy and read the endorsement. If the adjuster's first question after a loss is "show me the callback log," you want a callback log to exist.

The utility counter version of the same problem

The vendor file is the big-dollar target. The utility billing line is the high-volume one. In a city where the water account can be transferred, the mailing address changed, a payment arrangement approved, or a shutoff released over the phone, every one of those is an action a convincing voice can trigger. The address change is the sneaky one: change it, and the delinquency notices, the shutoff notice and eventually the lien paperwork all go somewhere the property owner never sees.

The fix is the same shape and it does not require interrogating a 78-year-old resident about her water bill. Read-only questions — balance, due date, when the meter was last read — can be answered on the phone. Anything that changes an account, moves a due date, or releases service should end with a secure link sent to the contact already on file, or a trip to the counter with an ID. If an AI agent answers your utility line, that boundary belongs in its instructions as a hard rule.

What the control costs and what one miss costs

Illustration only, with the assumptions stated. Suppose your city runs six progress payments over $50,000 a year, averaging $118,000, across street, water main, and facility contracts. Suppose you process twelve legitimate vendor banking changes a year, and the procedure above adds twenty minutes of AP Clerk time to each.

You cannot prove the odds and neither can anyone else. What you can prove is the ratio: roughly $124 a year of clerk time against one loss that would mean a special council meeting, a police report, a call to the risk pool, and an explanation of why an approved payment for a finished street went to a stranger. Every finance office already accepts this trade on check stock and signature plates.

Where the human has to stay

No verification step survives a friendly clerk who does not want to be difficult with a longtime vendor, so the procedure has to protect her. Make it a written rule with the Manager's name on it, so "I'm not allowed to do that on a call, I'll open a ticket" is the policy talking. That one sentence removes the social pressure the attack depends on.

Do not buy a product that claims to detect a cloned voice and then let it make the call for you. Treat every voice as unverified and route the decision through the callback, the letterhead and the second approver. And keep the counter open: the resident who cannot manage a secure link and the vendor whose controller retired last month both need a path that ends in someone showing identification in person.

Frequently asked questions

Should we stop livestreaming council meetings?

No, and in most states you could not lawfully stop if you wanted to. The recordings are a public good and a legal obligation. Assume every department head's voice is public and build controls that do not depend on recognizing it.

Our AP clerk has been here nineteen years and knows every vendor. Isn't that enough?

It was enough until this year, and it is exactly the confidence the attack is built to use. Familiarity is the reason she would hesitate to insist on a callback. Write the rule so insisting is not her choice.

Can we let an AI agent answer the utility line if this is the risk?

Yes, with a boundary. An agent answering balance, due date, hours and outage questions removes real volume from the counter. An agent that can change a mailing address or release a shutoff on voice alone is a liability whether or not the caller is human. Draw the line at read-only.

What is the first thing to do Monday?

Pull the last twelve months of vendor banking changes out of your finance system and check how many have a documented callback. If the answer is none, that is your answer, and the fix is a one-page procedure plus a line on the contract routing sheet.

CallSphere builds AI voice and chat agents that answer municipal phone lines, take routine utility and permit questions, and capture caller details around the clock. The relevant point for this article is where the boundary sits: an agent should handle the questions that only require information, and hand anything that changes an account or moves money to a human path with a callback behind it.