By Sagar Shankaran, Founder of CallSphere
A cloned voice can redirect every payment a client's customers make. What outsourced AR teams should verify, how the callback works, and what the exposure is.
Key takeaways
It is 4:15 on a Friday. Your accounts receivable clerk — the one who sends invoices for eleven of your clients out of QuickBooks Online and chases the aging every Tuesday — picks up. The voice is the owner of your third-largest client, a commercial flooring contractor. Same clipped delivery, same habit of starting sentences with "so listen." He says they moved from the credit union to a national bank this week, the new account is live Monday, and can you update the remit-to on the invoices going out today because there's a $58,000 progress billing in the batch.
He gives the routing and account numbers. He is slightly impatient, which is exactly how he always sounds at 4:15 on a Friday. Your clerk has heard this voice on twenty calls. She makes the change.
Every payment his customers send for the next ninety days goes to a stranger. Your firm did not lose a dollar out of its own account. Your client lost their receivables, their customers paid an invoice that carried your firm's fingerprints, and the professional liability conversation that follows is the worst one you will have this year.
Here is what actually changed, stated plainly: copying someone's voice well enough to fool a person who knows them now takes a short sample and costs almost nothing, so any business that changes where money goes based on a phone call has an open door.
The sample is not hard to get. Your client's owner has a voicemail greeting. He did a podcast for a trade association. His company posted a walkthrough video on Facebook. Thirty to sixty seconds of clean audio is the whole requirement. And the 2026 version does not sound like the stilted robot from three years ago — the systems answer conversationally in about a fifth of a second, so the caller interrupts you, laughs at the right moment, and handles your follow-up question without an awkward pause.
Bookkeeping and outsourced accounting firms are a better target than the clients themselves, and fraudsters have worked this out. You hold the payment instructions for a dozen businesses. Your staff are trained to be responsive. And your controls are usually written for the money leaving the account — dual approval in BILL, a positive pay file at the bank — not for the money coming in, where a single edit to an invoice template quietly reroutes every customer payment.
Hear it before you finish reading
Talk to a live CallSphere AI voice agent for financial services in your browser — 60 seconds, no signup.
Sit down with your team and write the real list. In most outsourced accounting shops it is shorter than people expect, and it is not the list in your procedures manual.
That last one gets people in the last week of January, when everyone in this trade is sending W-2s and 1099-NECs and nobody has slept. The request looks exactly like the eighty other requests in the queue.
flowchart TD
A["Call at 4:15 Friday: we switched banks, update our remit-to"] --> B{"Does the request change where money lands?"}
B -->|No| C["Handle it, log the call in the client workflow note"]
B -->|Yes| D["No action on this call. It goes in the change queue."]
D --> E["Call back the number written in the engagement letter"]
E --> F{"Owner confirms on callback and gives the code word?"}
F -->|No| G["Stop. Alert the client owner and your E&O carrier contact"]
F -->|Yes| H["Second approver edits the invoice template, 24-hour hold"]
H --> I["Notice sent to the client's top customers about the change"]
I --> C
The control is not "verify the caller." It is never authorize a money-direction change on an inbound call, ever, for anyone, including the client's owner, including your own managing partner. The staff member's line is friendly and final: "Absolutely — I'll get that queued and call you back on the number we have on file to confirm before it goes live."
Three details make it work. First, the callback goes to the number recorded in the engagement letter, not the number on caller ID and not a number the caller offers on the call. A cloned voice cannot answer a phone that belongs to someone else. Second, a short shared phrase, agreed with each client at onboarding and stored in your workflow system where staff can see it — not clever, just a phrase the caller would not find on LinkedIn. Third, a 24-hour hold on remit-to and vendor bank changes, with a notice to the client's owner by email, so the fraud has to survive a night.
Then write it into the engagement letter, one paragraph, at the next renewal: banking and remittance changes are confirmed by outbound callback to the number of record and take effect the following business day. Clients do not push back on this in 2026. Half of them will tell you their bank already does the same thing.
Illustrative, and you should redo it with your own client list. Suppose your firm sends invoices for 11 clients, the median client bills $190,000 a month, and a redirect goes unnoticed for one collection cycle — realistically three to five weeks, because the client sees deposits are light and blames slow payers first. Say the exposure on one successful redirect is $170,000 of misdirected receivables, of which the client eventually recovers a portion by chasing customers who can prove they paid.
| Item | Assumption | Amount |
|---|---|---|
| Misdirected receivables, one client, one cycle | $190,000 monthly billing, ~4 weeks exposed | $170,000 |
| Your professional liability deductible | Typical small-firm policy | $10,000 |
| Firm time on investigation and customer letters | 60 hrs at $62 loaded | $3,720 |
| Lost client, one year of fees | $2,400/mo × 12, more likely than not | $28,800 |
| Cost of the control | 14 bank-change requests a year × 6 minutes callback | 84 minutes, about $87 |
You do not need to believe the $170,000 figure. Cut it by 80% and the arithmetic still ends the same way, because the control costs an hour and a half a year. This is the rare fraud control where the honest comparison is embarrassing.
Still reading? Stop comparing — try CallSphere live.
See the financial services AI agent handle a real call — complete, industry-specific, and live in your browser. No signup.
Do not solve this with a voice-detection product. The claim that software can hear whether a voice is synthetic is a moving target and it will fail on the call that matters, on a bad cell connection, at 4:15 on a Friday. Verification has to rest on something the fraudster cannot have — possession of a known phone number, a shared phrase, a second human approver — not on how the audio sounds.
Second, the hard part is not the policy, it is permission. A junior AR clerk will break the rule for a client owner who gets irritated, because nobody ever got yelled at for being fast. The owner of the firm has to say, in a team meeting, in plain words: if you follow the callback rule and a client complains, I will back you, every time, and if you skip it because someone was impatient, that is the mistake. Then hold to it the first time it costs you a little goodwill.
Third, review who on your team can even make these changes. In most firms four people can edit an invoice template and only one of them should be able to. Tighten the roles in QuickBooks Online and in your bill-pay system, and check them again after every staff change.
Caller ID spoofing affects the inbound call, not the outbound one. When you hang up and dial the number in your file, the call routes to whoever actually controls that number. That is precisely why the rule is about direction — you calling them — and not about recognizing the voice.
Then they can confirm on the callback in four minutes and you can still make the change today, with a second approver. The 24-hour hold is for remit-to changes on invoices going to their customers, where a one-day delay costs nothing and reversing a redirect costs a quarter. Explain it that way and owners agree quickly.
Yes, and email is still the more common route in. Same rule, same list of money-direction actions. Written requests get the same outbound callback — not a reply to the email, which is how business email compromise works in the first place.
Some firms do, and it helps in a dispute, but check your state's consent rules first — several require all parties to consent — and put the notice in your engagement letter. Recordings are evidence after the fact; they prevent nothing. Spend the effort on the callback rule.
The control above only holds if the call actually reaches a trained person instead of a voicemail box that gets cleared in a hurry. CallSphere builds AI voice and chat agents that answer a firm's main line and web chat, take who is calling and what they want, and route or book accordingly — and they can be told, in plain instructions, never to accept or act on a banking or remittance change and always to hand those to a named staff member for callback. It is a front door with a rule written on it, not a fraud detector; the verification stays with your people.
Written by
Sagar Shankaran· Founder, CallSphere
LinkedInSagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
Consignee changes, bank details, hold releases and DEA calls: how a contract manufacturer verifies the caller when the voice itself proves nothing in 2026.
Bank-detail changes, gift card activations and pallet releases all run on a voice an independent grocer trusts. Three controls that close the gap this week.
A cloned controller can reroute a payroll run or a Bill.com vendor payment. The verification step, dual control and engagement-letter passphrase that stop it.
Shorts, spoils and billback deductions researched unattended overnight, with PODs and credit memos attached, so the controller approves a queue at 7 AM.
A cloned voice can ask your SOC to un-isolate a host or release a break-glass credential. The authority list, callback and client code that stop it at 2 a.m.
A cloned voice can release a repaired tractor or approve $9,000 of injector work at 9pm. The five-line callback rule a heavy-duty truck shop puts on the wall.
© 2026 CallSphere Inc. All rights reserved.
Made within San Francisco
Watch how CallSphere handles real customer calls, schedules appointments, and processes payments — live.
Try Live DemoBook a DemoCalculate Your ROI