Voice and phone
AI voice scams against UK organisations
Phone requests are the hardest for staff to judge. Treat a familiar voice as a claim to check, not as proof, and confirm risky requests by calling back.
Last reviewed against NCSC (UK), UK Government (DSIT and Home Office) and Anthropic. Sources
The gap
Voices are harder to judge than text
In the Vodafone Business research, 40% of respondents could recognise voice-based scams, against 63% who could spot text phishing and 24% who could identify image or search engine scams [8]. Phone scams featured in 39% of the incidents respondents reported, behind email at 82% [8]. The research was sponsored by a telecoms provider, so read the figures as indicative.
Reports
What security leaders say
The Register's report of a Gartner survey said 44% of businesses had met a fake-audio call aimed at staff, and in 6% of those cases the call led to harm such as disruption, lost money or stolen intellectual property [7]. With an audio screening service in place that share dropped to 2% [7]. The article does not give the sample size, and the screening result comes from the same reporting, so treat it as a lead for your own testing.
Handling a call
What staff should do
-
1
Tell the caller courteously that you will check and come back. -
2
Finish the call. -
3
Look up the person's number from a directory or contact record you already hold. -
4
Ring that number and ask whether the request is genuine. -
5
If you cannot confirm it, do not act and report the attempt.
Rules
Make the process hold when the voice is right
Never release money on a call alone
Require a written approval step, separate from the call, for new payees and changed bank details.
Limit what a service desk can reset by phone
Decide which requests, such as multi-factor resets, need a second proof of identity that a voice cannot supply.
Say it is fine to hang up
The NCSC advises that staff are not reprimanded for struggling to spot phishing and that reporting is easy [3]. The same culture helps with calls.
Keep reading
Read next
Fake applicants
Anthropic reported North Korean operatives using AI to win remote technical jobs under false identities. What UK employers can take from the case.
Read the guide
Prompt injection
What prompt injection is, why the NCSC says it may never be fully fixed, and the practical limits that reduce its impact on your AI tools.
Read the guide
Train staff
What to teach, how to run reporting and why the NCSC advises against relying on training alone when attackers use AI to polish their lures.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Defending against AI-assisted social engineering is a matter of decisions: who may approve what, how requests are confirmed and what AI tools may do. A virtual CISO helps leaders set those rules and have them tested.