The Broker Calls at 4:50 Friday With 4,000 Pieces of the Part You're Short. That Voice Now Costs $40 to Fake.

4:50 on a Friday, and the line goes down Monday

Your buyer is at her desk with her coat on. The kit for the 800-piece order is 3,200 pieces short on one part — a power management chip on allocation since spring, franchised lead time 38 weeks, and the customer's engineer will not approve an alternate because the board is Class 3 into a medical program. The phone rings: the independent distributor she has bought from twice before. Same voice, same clipped way of saying her name, same complaint about the traffic.

He has 4,000 pieces. Date code is good, he will run the AS6081 testing, and he needs the wire today because another shop is asking. Total $61,400 — eight times book price, and normal for an allocated part in a panic. He mentions the wire instructions changed last month, new bank. He will text them.

She has done this exact transaction before. The difference in 2026: that voice cost about forty dollars and eleven seconds of source audio to make, and there is a real chance she is talking to nobody at all.

Every phone-authorised action in a board shop, listed

Worth writing down, because most owners never have. In a contract assembly business, these happen on a verbal:

• Broker and independent-distributor buys during allocation. Same-day wire, often to a new account outside your AVL, usually five figures.
• A remit-to change. Somebody calls accounts payable claiming to be a franchised distributor and says the bank details on the invoice are out of date. Your AP clerk is one person trying to be helpful.
• A verbal deviation. "This is the program manager — run the alternate capacitor, I'll send the paperwork Monday." Your line lead wants the line running. The lot gets built, the deviation never arrives, and the first article on AS9102 Form 3 does not match the AML.
• Release of finished goods. "Ship the 500 boards to this address instead, we changed distribution centers." Forty thousand dollars of assembled product with your name on the box.
• Credit-hold release and terms changes, granted because the caller sounded exactly like the person whose account it is.

The problem is not that voices can be copied — it is that your process treats a recognised voice as an authorisation, and a recognised voice is now something anyone can buy. Eleven seconds of your buyer's voice sits in the trade show video you posted. Your controller is on a 2023 podcast. Your customers' program managers introduce themselves on every call.

Why "I know his voice" stopped being a control

Through 2024 and 2025, cloned voices had tells. They stumbled on interruptions, went flat when excited, and could not answer fast enough to be believable in an argument. By 2026 speech-to-speech systems answer in about two-tenths of a second, hold a conversation, handle interruption, and can look something up mid-call. The capability that makes a good service agent possible makes an excellent impersonator possible. Nothing about your business changed; the cost of faking the check you relied on fell to nearly nothing.

The timing is cruel. Attempts cluster when your defences are weakest: allocation season, the pre-buy weeks before Lunar New Year shutdowns, the last week of the quarter when shipping is pushing product out. A caller saying "line down, I need this today" is not suspicious in this trade. It is Tuesday.

flowchart TD
  A["Caller: 4,000 pieces available, wire today"] --> B{"Is this bank account already on the signed supplier form?"}
  B -->|Yes| C["Buy proceeds under the standing purchase order"]
  B -->|No| D["End the call. Dial the number on file, not the one given."]
  D --> E{"Supplier confirms the quote, the quantity and the account?"}
  E -->|No| F["Log the attempt, notify the controller, no wire leaves"]
  E -->|Yes| G["Buyer and controller both approve in writing, wire Monday"]
  F --> H["Re-source through the AVL or a franchised distributor"]

The verification step that actually closes it

You do not need voice-detection software. You need three rules costing four minutes each, on a card taped to the buyer's monitor and the AP clerk's.

Rule one: callback on the number of record. Not the number the caller gives, not the caller ID, not the email signature. The number on your signed supplier setup form in the ERP vendor master. If the caller objects, that is your answer. A real broker with real stock takes a callback in ninety seconds; he wants the sale more than you want the part.

Rule two: no bank account change on a phone call, ever. A remit-to change needs a form, a callback to a known contact, and confirmation by a second person — your controller, not the AP clerk who took the request. Make it a rule the clerk cannot break even if she wants to, so she is never the one saying no. The policy is.

Rule three: two people on money above a threshold. Pick a number that fits your shop — $10,000 is common for a 60-person assembler — and above it a wire needs the buyer and the controller. Not two clicks from one desk. Two people who each know why the money is moving.

For verbal deviations the rule is simpler: no material substitution or process deviation enters a Class 3 build on a phone call. It goes in writing, from the customer's authorised engineering contact, into the ECO record before the lot runs. If the line sits two hours, it sits. A rejected lot costs far more.

Tuesday morning, the same call, handled

Same broker, same part, same urgency. Your buyer says: "Send the quote to my work email and I'll call you back on the number on our supplier form in five minutes." She hangs up, opens the vendor master, dials the number on file, and either reaches the man she just spoke to or does not. If she does, she reads back quantity, date code, price and the account on file. If the account differs, the buy stops and the controller gets a note.

Elapsed time: six minutes. Cost when the call was real: a bemused broker. Cost when it was not: nothing, plus a logged attempt for your quality manager, because these run in waves through a supply base and your customers will want to know.

One change worth making alongside it: an agreed verification phrase with the two or three customers whose program managers authorise things by phone. Not a typed password — shared context that comes up in conversation. Old-fashioned, and it works, because it is the one thing a copied voice does not come with.

The arithmetic: what the exposure is worth in a year

Illustrative assumptions; substitute your own history. Your shop makes 18 payments a year outside your franchised base — brokers, independents, one-off tooling and stencil vendors — averaging $22,000. Assume a successful impersonation lands once every four years, and the loss is the wire plus about $6,000 in expedite, scrap and rebuild while you re-source.

Even allowing pessimistically for lost allocations, the rule pays for itself many times over. And the expected-loss figure understates the damage: a fraudulent shipment of finished goods with your part number on it becomes a counterfeit-parts conversation with a defense customer, which is a different order of problem than money.

What verification will not catch

Be honest about the limits. A callback protects you against a stranger with a copied voice. It does not protect against a compromised email account at a supplier you trust, where the wire instructions are wrong because their systems were breached. It does not stop an insider. And it does nothing if the number in your vendor master came from a fraudulent setup form two years ago — which is why annual verification of the vendor master against signed forms belongs on your quality manager's audit schedule alongside the AS9100D checks.

It also will not survive an owner who overrides it. The common failure in shops this size is the founder taking a call on his cell, saying "just pay it," and the clerk complying because he signs the checks. If you make the rule, you are the first person it applies to. Tell your controller she has permission to stop you.

Frequently asked questions

Can software just detect a fake voice for me?

Detection tools exist and are improving, but building the control on detection is building on sand — copying improves faster than detecting. Build around a channel the impersonator does not have: a callback to a number you already held, and a second approver. Those work no matter how good the voice gets.

Our broker relationships are built on speed. Won't this cost us parts?

Occasionally, yes. Once in a while a legitimate lot goes elsewhere because you took six minutes. Price that against a $22,000 wire and a rebuilt lot. Tell your regular brokers about the policy in advance — a real supplier respects it, because they get impersonated too, and it protects their name as much as your cash.

What about customers calling to authorise a change on the floor?

Same principle, different consequence. A verbal from a cloned program manager that puts an unapproved part into a Class 3 assembly creates a nonconformance, a corrective action and possibly a recall. Deviations go through the ECO process in writing from a named authorised contact, and line leads must know they will never be criticised for holding a lot while that happens.

Should we tell our customers we do this?

Yes, and it is quietly good marketing. Medical and aerospace customers audit your controls anyway. A one-page description of your supplier-verification and deviation rules sits well in the quality manual and reads well in an audit. Shops that can show a written control here look far more mature than shops that cannot.

A note on the line that rings

Every rule above depends on knowing who called and what they asked for, and on that record surviving the call. CallSphere builds AI voice and chat agents that answer business phone lines and website chat, take the caller's details, log what was requested, and route or book the follow-up — so a request touching money or a build never rests on one person's memory. It does not judge whether a voice is authentic, and no honest vendor would claim otherwise. It makes sure the request is written down, timestamped and handed to whoever verifies it.