Protect Your Business From a Voice Clone: One Word Stops It

A few months ago I recorded a two-minute welcome video for a landing page. My voice, my face, out on the open web where anyone can download it.

That clip is more than enough raw material to build a synthetic version of me that could call you, sound exactly like me, and ask you to wire money. If you run a business and your voice exists anywhere online, you're in the same spot.

The good news: the fix costs nothing, takes about 10 minutes, and comes down to a single word you agree on today.

I'm going to skip the fear and give you the plan, because the plan is genuinely small. The whole defense is one word plus one habit, and you can have both in place before your coffee gets cold. Let me show you exactly what to set up, who to tell, and the tells to listen for, all of it drawn from what the FBI actually published rather than from a vendor trying to sell you something.

Why your own voice is already enough to clone

Here's the part most people get wrong. They assume a scammer needs hours of your audio, some Hollywood rig, and a reason to target you specifically. None of that is true anymore.

A short clip is plenty, and short clips of most business owners are everywhere: a podcast guest spot, a webinar replay, an Instagram reel, a voicemail greeting, a testimonial video. If you've ever spoken into a camera or a microphone for your business, the raw material exists.

This isn't a hypothetical I dreamed up. In May 2025, the FBI's Internet Crime Complaint Center (IC3) put out a public service announcement describing malicious actors who, since April 2025, have been impersonating senior US officials through text and voice messages aimed at other officials and their contacts.

The FBI names 2 techniques directly: "smishing" (malicious text messages) and "vishing" (voice messages), and it notes those voice messages are often AI-generated.

The FBI titled its May 2025 alert "Senior US Officials Impersonated in Malicious Messaging Campaign."

The targets in the FBI alert are high-profile, but the method has no ceiling and no floor. It scales down to a solo coach and a bookkeeper just as easily as it scales up. The technique doesn't care how big you are.

So the question isn't whether your voice can be faked. Assume it can. The question is what happens on the other end when a faked version of you calls someone who trusts you and asks them to do something with money or access. That's the moment you get to control, and it's cheaper to control than you'd think.

The one word that stops the whole thing cold

A codeword closes the one gap a clone can't cross, and it costs nothing to set. A clone can copy how you sound, but it can't know a secret you never said out loud on the internet.

A codeword is a single word or short phrase that you and the people who matter agree on in advance. It's the answer to one question: "What's the word?" A real you knows it instantly. A synthetic you, no matter how perfect the voice, has no idea.

The FBI's own advice: agree on a secret word or phrase with your family to verify each other's identities.

You want a codeword in 2 places:

• With your family, so a panicked "Mom, I'm in trouble, I need money" call has a hard stop built in.
• With your business circle, meaning the specific people who can move money or grant access on your behalf: a bookkeeper, an assistant, a virtual assistant, a business partner, a key client if you handle their funds.

Keep it simple and keep it human. A good codeword is easy for your people to remember and impossible for an outsider to guess. Skip anything a stranger could find or reason out: not your dog's name, not your street, not your kid's birthday, not your favorite team.

Pick something with no paper trail. An odd pairing of 2 unrelated words works beautifully, something like "velvet tractor" or "copper Tuesday." Weird is the point. Weird is what a scraper of your public life can't reconstruct.

One more rule: the codeword lives offline. Don't email it, don't text it, don't put it in a shared doc or a password manager note titled "codeword." Say it out loud, in person or on a call you initiated, and let people commit it to memory. The instant it's typed into a system, it becomes something that can leak.

Change the word if it ever gets typed, ever gets spoken in front of someone outside the circle, or ever gets demanded by a call that turns out to be fake. Otherwise leave it alone, because a word your people actually remember beats a word you rotate on a schedule and everyone forgets.

Set your family and client codeword in 10 minutes

Here's the actual ten-minute version. No software, no accounts, nothing to buy.

1. Choose 2 codewords, one for family and one for your business circle. Different words for the 2 groups, so a leak in one doesn't compromise the other.
2. Tell your family in person or by a call you place to them (not one they place to you). Explain it in one sentence: "If I ever call asking for money or something urgent and weird, ask me for the word. No word, no action."
3. Tell your business circle the same way. Your bookkeeper, your assistant, anyone who can touch money or logins. Same one-sentence rule.
4. Agree on what triggers it. Anything that touches money, access, or codes gets the word. The trigger table further down spells out exactly which requests demand it and which ones don't, so your normal calls stay normal.
5. Practice it once. Have one person actually ask you for it on a normal call this week, so it feels routine instead of awkward when it counts. There's a drill prompt below if you'd rather rehearse it privately first.

That's the whole setup. 10 minutes buys you the answer to the single most dangerous phone call your business can receive.

Here's who to actually contact, so nobody gets missed:

The callback rule that backs the word up

A codeword is your first line. The callback rule is your second, and it's just as free. It exists for the moments when someone forgets to ask for the word, or the caller talks fast enough to skip past it.

The rule is one sentence: if a call or message asks for money or access, hang up and call back on a number you already had. Not the number that just called you. Not a number the caller reads out to you. The number already saved in your phone, or printed on last month's statement, or on the person's real website. You end the current contact and you re-open contact through a channel you control.

This matters because caller ID lies. A scammer can make "Mom" or your bank's real name appear on the screen, so the voice can be perfect and the name can be right and the whole thing can still be fake.

Calling back on a known number routes around all of it, because you're now talking to the real person or the real institution, not to whoever set up the incoming call.

The FBI's alert reinforces the same instinct from a different angle.

The FBI warns these actors operate "by sending targeted individuals a malicious link under the guise of transitioning to a separate messaging platform."

Translation: they try to pull you off your normal channel and onto their turf. The callback rule does the opposite on purpose. You go back to your turf, every time, before anything happens.

What to do the moment someone fails the word

It'll feel awkward. Do it anyway, and don't explain yourself while you're still on the call.

1. End the call. No arguing, no "prove it some other way," no telling them why you're hanging up. Anything you explain is free coaching for the next attempt.
2. Call the real person on your known number. Confirm they're fine and that they never called you. It takes a minute, and it's the part that actually settles your nerves.
3. Tell everyone who holds that codeword that it got probed. One message does it: "Someone tried a fake call on me today. Heads up, and expect a new word from me."
4. Pick a new word and pass it around the way you did the first one. Out loud, on calls you place.

Then report it. File it with the FBI's Internet Crime Complaint Center. If money actually moved, call your bank first and report second, because the bank is the only one who can try to stop a transfer while it's still in flight.

What to tell your bookkeeper, VA, or assistant today

If you're a solo business owner, the person most likely to get the fake call is whoever handles your money or your calendar. You may never be the target yourself. That's who a scammer wants, because that's who can act. So the most important 5 minutes here is the conversation with that person.

Give them a standing instruction, and make it a rule they're allowed to enforce even against a call that sounds exactly like you. Word it plainly:

Any request to move money, change where money goes, buy gift cards, share a password,
or send a verification code has to be confirmed with the codeword and a callback to my known
number, no matter how much the voice sounds like me. If I ever get annoyed that you slowed
down to check, that's me being wrong and you being right. You will never be in trouble for
verifying.

That last line does real work. Most fraud succeeds on pressure, on a "boss" who's angry and rushed and needs it done now. When you tell your team in advance that you'll never punish them for pausing, you take away the exact lever the scammer pulls. You're pre-authorizing the delay. A synthetic voice can fake authority, but it can't override a rule you set while calm.

Give them the trigger list too, including the half that keeps normal work moving:

For financial advisors, bookkeepers with fiduciary duties, or anyone in a regulated seat, one honest note: I'm a marketer, not a lawyer or a compliance officer. Treat this as a practical security habit, and check anything about client-fund controls or reporting obligations against your own firm's compliance rules and your regulator's guidance.

Copy this into Claude to write the whole plan for you

You don't have to draft the family text and the team instruction yourself. This is the kind of small, exact writing job that AI is great at.

Open the Claude desktop app, paste the prompt below, fill in the 2 blanks, and you'll get clean messages you can send in a minute. This is genuinely how I'd do it.

You're helping me set up a defense against AI voice-clone scams for my small business and my family. I run a solo business and my voice exists in public videos and podcasts online.

I've chosen two codewords:
- Family codeword: [WEIRD TWO-WORD PHRASE, e.g. "velvet tractor"]
- Business codeword: [A DIFFERENT WEIRD PHRASE]

Write me three short, warm, plain-English messages I can send today. Use contractions. No jargon. No fear-mongering. Keep each one under 120 words.

1. A message to my family explaining the family codeword: if anyone ever calls or texts sounding like me and asking for money or something urgent, they ask for the word first, and no word means no action. Tell them not to save the word anywhere digital.

2. A standing instruction to my bookkeeper/assistant: any request to move money, change payment details, buy gift cards, share a login, or send a verification code must be confirmed with the business codeword AND a callback to my known number, even if the voice sounds exactly like me. Reassure them they'll never be in trouble for slowing down to verify.

3. A one-paragraph "what to do if a call feels off" cheat sheet I can pin near my desk: hang up, call back on a number I already had, ask for the word, and never send a verification code to anyone who calls me.

At the end, give me a 5-item checklist to make sure I actually rolled this out.

Change the codewords to your own, send the 3 messages, and you've operationalized the entire thing. The writing is the easy part once you know what to say, and now you do.

Now practice it once. Step 5 above asks for a rehearsal, and this is the easiest way to run one without putting a real person on the spot. Paste this second prompt into a fresh chat and let it play the fake caller while you hold the line.

Run a five-minute tabletop drill with me. You play a convincing AI voice clone of me calling my bookkeeper, and I'll play the bookkeeper. Stay in character until I end the drill.

Context: I'm a solo business owner. The fake me is calling on a Friday afternoon, sounds friendly and slightly rushed, and wants a supplier's bank details changed and a payment sent before the weekend. You may use urgency, mild authority, familiarity, and reasonable-sounding excuses for why a callback isn't possible right now. Do not use profanity or threats.

My job is to hold the line: ask for the codeword, refuse to act without it, and insist on hanging up and calling back on my saved number.

Rules:
- One or two sentences per turn, like a real phone call.
- Push back realistically when I stall, but never break character to coach me mid-drill.
- Stop immediately if I type END DRILL.

After the drill ends, step out of character and give me:
1. Every pressure tactic you used, in plain language.
2. The exact moments I wavered, quoting what I said.
3. Three sentences I can memorize and use verbatim next time to end a call like this politely.

Spot the tells the FBI actually names

The codeword and callback are your structure. It still helps to know what a fake sounds and looks like, because sometimes you'll catch it before the codeword even comes up. The FBI's alert lists a few specific things to watch for, and I'm sticking to what it actually says rather than inventing red flags.

• Listen for artificial qualities in the voice. Synthetic audio can carry a flatness, an odd cadence, or a too-perfect smoothness. If something in the sound feels slightly off, trust that.
• Check for imperfections in images and video. The FBI specifically calls out looking for subtle flaws "such as distorted hands or feet" in any accompanying visuals. Hands and feet are still where fakes tend to fall apart.
• Verify identity independently. Look closely at the email address, phone number, URL, and spelling of any message. Small mismatches are the whole game.
• Never hand over a verification code. The alert is blunt that you should never provide a two-factor code to anyone over email or text. No legitimate caller needs you to read them a code.
• Be suspicious of "let's move to another app." That malicious link to switch platforms is a documented move. Staying on your normal channel is safer.

A text can't be challenged with a spoken codeword, so for messages the callback rule is the entire defense. Never reply in the thread and never tap a link that moves you to another app, because both of those keep you on the sender's turf. Open a call on the number you already had saved and ask your question there instead.

Here's the same set split so you can scan the signal on its own:

Tells help, but the reason I lead with the codeword is that it doesn't depend on you being sharp in a stressful moment. A rule catches what a tired brain misses.

What actually stops a clone versus what only feels safe

A lot of the "safety" instincts we all have were built for a world before synthetic voice, and they quietly stopped working. Here's the honest comparison, so you spend your 10 minutes on the things that hold up.

The pattern is simple once you see it. Anything based on how the caller sounds is beatable, and anything based on a secret you hold is not. Put your trust in the second column.

10 minutes today, protected for the year

I shipped an iPhone app that Apple approved in under 3 weeks, and I did it without knowing how to code.

The same tech that lets a solo operator run like a full team is the tech a scammer uses to fake a voice, so the answer is small, boring defenses that make the fake fall flat, plus AI doing the tedious parts like drafting the exact messages your family and team need.

If you want more of these ten-minute, no-terminal plays, every AI skill I build lives in the Solo Creators AI Studio, and you can reach me directly there. You can find it at the Solo Creators AI Studio.

No pressure. The codeword and the callback rule above cost nothing and work whether you ever come find me or not. Go set them up. It's the highest-return 10 minutes you'll spend on your business this month.