AI voice cloning and impersonation scams: how to protect your business or church

The FTC warns that a scammer needs only a short clip of someone's voice, often taken from content posted online, plus a voice-cloning program to imitate them on a call. The FBI says criminals use generative AI to make fraud more believable at scale: cloned voices of relatives asking for emergency money, and fake audio or video of company executives.

• The urgent boss: a call or message from "the owner" asking someone to pay an invoice, wire money or change a vendor's bank details, quickly and quietly.
• The family emergency: a cloned voice of a relative in trouble, asking for money now.
• The pastor's favor: an email or text that appears to come from a pastor, asking members to buy gift cards for someone in need.

Pastor impersonation scams have been reported by churches across the U.S. Scammers often use names and details from church websites and online bulletins, send messages from look-alike email addresses, and ask members for gift cards. One Virginia church suspected scammers imitated the pastor's voice using audio from an online service.

You don't need to stop posting sermons. Do tell your congregation clearly, and often, that church leaders will never ask them to buy gift cards or send money by text or email.

• Urgency and secrecy: "I need this in the next hour" or "don't tell anyone yet."
• Unusual payment: gift cards, wire transfers, cryptocurrency or new bank details.
• A new channel: a personal email address, a new phone number, or a text instead of the usual way you talk.
• Pressure not to verify: "I'm in a meeting, I can't talk, just do it."

1. 1Call back on a known numberVerify any request for money or data by calling the person on a number you already have, never one from the message. This is the FTC's core advice.
2. 2Agree a code wordThe FBI recommends families agree on a secret word or phrase to confirm identity. Business teams and church leadership can do the same.
3. 3Two people for paymentsRequire two approvals for payments and for any change to bank details.
4. 4Say it publiclyPut "we will never ask you for gift cards or money by text or email" in your newsletter, website and staff onboarding.
5. 5Report itReport scams to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov, and warn your people quickly.

Adapt this for your business, nonprofit or church and share it with everyone who handles money or personal information.

Payment and request verification policy

Why: Scammers can now imitate a real person's voice, writing style and even video. A familiar voice or name is no longer proof of who is asking.

1. Call back before you act
Any request to send money, buy gift cards, change bank details or share passwords or personal data must be confirmed by calling the person on a number we already have on file — never a number given in the message.

2. Two people for payments
Payments over [$ amount], and every change to a vendor's or employee's bank details, need approval from two people.

3. Gift cards are never a payment method
We will never ask staff, volunteers or [members / customers] to buy gift cards or send card numbers.

4. A pause is always OK
Urgency and secrecy are red flags. No one will be in trouble for taking time to verify a request, even from [the CEO / the pastor].

5. Report it
Forward suspicious messages to [name / email]. Report fraud to ReportFraud.ftc.gov and the FBI at ic3.gov.

Approved by [name], [date]. Reviewed every [6 / 12] months.

Add it to your AI policy, or for churches, your church AI policy.