The Voice on the Phone Sounds Right: AI Impersonation and the Case for Callback Rules
Only 42% of small business owners could spot a deepfake scam in a CommBank test. Australians lost $166.8 million to payment redirection in 2025. A verification rule beats better detection.
When Commonwealth Bank tested small business owners on their ability to identify deepfake scams, they got it right 42% of the time. That is worse than a coin toss, and the same owners reported feeling confident. Only 41% said they were familiar with deepfake scams at all, and just 55% had verified their suppliers' payment details in the previous six months. The tools criminals now use to imitate a supplier, a director or a family member are increasingly convincing, and many businesses still rely on their own judgement to catch them.
The scale of the problem is already measured
The National Anti-Scam Centre reported that Australians lost $2.18 billion to scams in 2025, up 7.8% on 2024. Payment redirection scams, the category that covers fake invoices and "we've changed our bank details" requests, accounted for $166.8 million. The agency noted "increasing sophistication in scam activity through Artificial Intelligence (AI) and the industrialisation of criminal syndicates".
The Australian Signals Directorate's Annual Cyber Threat Report 2024–25 shows what this costs a business that is hit. The average self-reported cybercrime cost per incident was $56,600 for small businesses (up 14%), $97,200 for medium businesses (up 55%) and $202,700 for large businesses (up 219%). Business email compromise made up 15% of the top cybercrimes reported by businesses. That ASD report does not mention AI, so the direct link between AI tools and individual business losses is not yet quantified in the national figures. The direction of travel is clear enough, though: the same fraud types are getting easier to execute convincingly.
What AI changes about the scam
Older fraud attempts often gave themselves away through poor spelling, an odd email address or an unfamiliar voice. AI removes most of those tells. CommBank's Queensland small business banking lead, David Coote, said the bank is seeing "deepfake invoices, voice clones of senior executives, and realistic messages that can catch even the most vigilant business owners off guard".
ASIC's August 2026 release shows the same capability applied to investment fraud. The regulator removed more than 19,400 scam websites in the 2025–26 financial year, an increase of 182% on the year before, and reported scammers building networks of fake sites, fabricated news articles and AI-generated videos. Among the most impersonated figures were the Prime Minister, Gina Rinehart and Dick Smith. ASIC Chair Sarah Court said that "a simple online search is not enough to verify whether an opportunity is legitimate". The lesson for a business owner is broader than investing. If a convincing video or voice can be produced for a public figure, it can be produced for your accountant or your largest client.
Why detection is the wrong defence
The CommBank result is the key finding for decision-makers. If business owners identify the fakes less than half the time, then staff training that says "spot the fake" is not a control. It is a hope. A solo operator approving their own payments and a 200-person firm with an accounts team face the same weakness: a payment decision that depends on whether a request feels genuine.
The effective alternative is to make authenticity irrelevant. A rule that every change to bank details, and every urgent payment request outside the normal process, is confirmed by calling a number you already hold works whether the voice is real or cloned. It does not require anyone to judge audio quality. CommBank's guidance follows the same logic: stop if something looks different, check changes using a verified phone number, and reject anything that does not feel right.
Write a one-page payment verification rule this week
Set a rule that no change to supplier bank details, and no urgent or unusual payment request, is actioned without a callback to a number from your own records, not one supplied in the request. Apply it to the boss as well: a director's voice message asking for a transfer gets the same callback. Then check your existing suppliers' details against signed contracts or past invoices, since only 55% of small businesses had done so in the previous six months.
A rule you can run today
The cost of the control is a two-minute phone call. The cost of skipping it, on ASD's figures, averages $56,600 for a small business and $97,200 for a medium one. Because the rule works regardless of how good the fake is, it will not need updating as the technology improves. The practical test is to ask who in your business can move money, what would make them act on a message, and whether a verified callback sits between the two.