A Cloned Voice Can Talk Your Collections Clerk Out of a Starter-Interrupt Code. The Callback Rule That Stops It

The call comes in at 4:50 on a Friday

"Hey, it's Marcus Reynolds, I'm at work, my car won't start, I've got the light flashing on the dash. Can you give me the code?"

Your collections clerk has taken that call four hundred times. She knows Marcus. She has heard his voice every month for a year and a half. She pulls up the account, sees he is nineteen days down, and does what she has always done on a Friday afternoon — gives him the twenty-four-hour code off the GPS unit and asks him to come in Saturday with two payments.

Except in 2026 that was not Marcus. A voice good enough to fool someone who talks to him monthly now costs a few dollars and needs about thirty seconds of source audio, which anybody can get from a voicemail greeting or a public video. The unit rolls out of the county Friday night, the phone stops working Saturday, and on Monday you are looking at nine thousand four hundred dollars of unpaid principal on a car nobody can find. Your recovery agent will bill you either way.

Every phone-authorised action on a buy-here-pay-here lot, listed out

The starter-interrupt code is the loud one, but it is not the only door. Write down every action somebody at your lot will take today on nothing but a voice:

• Releasing a twenty-four-hour or seventy-two-hour code on a GPS starter interrupt unit
• Granting a payment deferral or moving a due date
• Marking a payment as promised and pulling the account out of the repo queue
• Giving out a ten-day payoff figure and where to send the funds
• Releasing a title or a lien release to somebody claiming to be the customer's credit union
• Changing the phone number, address or reference on file — the quiet one, because it sets up all the others
• Telling a wholesaler you will hold a unit and hand over the keys on a check that is "in the mail"

Here is the sentence to pin to the wall behind the collections desk. A voice on the phone is no longer evidence of who is calling, so any action that moves money, releases a vehicle, or changes an account has to be confirmed by something the caller cannot fake with audio. That is the whole change. Everything else is procedure.

The callback rule, written so a new clerk can follow it

You do not need software to fix this. You need a rule with three steps and no exceptions, including for you.

Step one: the number does not count as proof. Caller ID is trivially faked. If the request is on the list above, you call back on the number in the deal jacket — not the number on the screen, not a number the caller gives you. Ninety-five percent of legitimate customers do not even notice, because they pick up.

Step two: ask something that lives in your system, not on the internet. Not mother's maiden name. Not the last four of the Social, which is on half the breach dumps in existence. Ask the amount and date of the last payment, or the down payment on the original deal, or the name of the reference listed on line three of the credit application. Set a four-digit word or number at delivery, write it in the file, and use that.

Step three: the code never goes out by voice. Text it to the phone number that was already on file before the call started. If the caller says "that's my old number, text this one instead," you are done — that is the tell, and it is the tell in almost every one of these.

flowchart TD
  A["Caller says the car will not start"] --> B{"Does the number match the deal jacket?"}
  B -->|No| C["Hang up, call the number on file"]
  B -->|Yes| D{"Can the caller state last payment date and amount?"}
  D -->|No| C
  D -->|Yes| E{"Is the account inside the grace window?"}
  E -->|No| F["Escalate to collections manager, no code given"]
  E -->|Yes| G["Code texted to the phone already on file"]
  G --> H["Reason and recording logged on the account"]

The one that costs more than a car: the payoff wire

The starter code fraud takes a nine-thousand-dollar unit. The payoff fraud takes your flooring line. Picture a call to your office manager on the last day of the month: it is your voice, or a very good copy of it, saying you are at the auction, the flooring payoff has to go out today, and remittance instructions changed — here is the new account. She has heard you say something close to that a dozen times in real life. She sends it.

The rule for money leaving the building is even simpler than the collections rule: no wire or payment instruction is ever changed on a phone call. Not yours, not the auction's, not the lender's. Changes go through a callback on the number already on record, and for anything over a set amount, two people. Tell your office manager, in front of witnesses, that she has permission to refuse you. Then do not get annoyed when she does.

What the rule costs versus what one loss costs

Owners resist this because it sounds like friction on a line that already gets three hundred calls a week. So price it.

The rule pays for itself if it stops one incident every seven years. It will not take seven years. And that table leaves out the second-order costs: the recovery agent's bill, the skip-trace, the insurance argument, and the week your collections manager spends on it instead of working the roll rate on your other 299 accounts.

Where a human still has to make the call

Do not turn this into a machine that says no. Your customers are people whose transmission went out on the way to a job they cannot afford to miss, and half your portfolio's performance rides on them believing you will work with them. Verification is the gate. Judgment is still human, and it stays with your collections manager.

Second, do not use voice-matching software as your proof of identity. That is the trap. If a cloned voice can fool your clerk, it can fool a voice-matching check, and the check gives everybody a false sense of safety. Out-of-band callback plus a fact from your own file beats voiceprints every time and costs nothing.

Third, if you use an AI agent to answer the lot's phone after hours — and plenty of independent dealers now do — that agent must be built so it cannot release a code, a payoff or an account change on its own. Take a message, confirm the callback number against the file, book the callback. That is the right ceiling for an automated answer on a line that also handles money.

Fourth, none of this replaces your Red Flags identity theft prevention program or your written security program under the FTC Safeguards Rule. If anything, a cloned-voice incident is exactly the kind of event those documents are supposed to anticipate. Add a paragraph to yours this quarter.

Frequently asked questions

My customers already think we make it too hard to get a code. Will this drive them off?

Script it as protection, not suspicion: "I'm going to call you right back at the number on your file — we've had people trying to unlock cars that aren't theirs." Customers on a buy-here-pay-here note understand car theft better than most. In practice the callback adds under two minutes and the complaints come from about one caller in fifty.

What if the customer genuinely changed their phone number?

Then the number change is its own verified transaction, not a step inside another one. Change it in person at the lot, or verify it against something else in the file — the reference on the credit application, the employer's main line — and never in the same call as an unlock or a deferral. Fraud almost always arrives as a number change wearing a costume.

Can I just record every call and sort it out later?

Record, yes, and check your state's consent rules first — some require both parties to agree. But recording is evidence after the fact, not prevention. The car is already gone by the time you listen to it.

Does this apply if I don't carry my own paper?

Yes, in a different shape. If you sell retail and assign contracts to Westlake or a credit union, your exposure is payoff quotes, title and lien releases, and wire instructions rather than starter codes. Same rule, different list of actions.

If your line rings after hours and nobody wants to carry the cell phone anymore, that is a fair reason to put an AI agent on it — with the ceiling described above. CallSphere builds AI voice and chat agents that answer the phone and the website chat 24/7, take the details, and book the callback or the appointment. Configure it so it never releases a code, a payoff figure or an account change on its own, and route those callers to a verified callback the next morning. The point of an after-hours agent is that nothing gets lost, not that everything gets authorised.