AI Voice Scams Are Hitting Kenyan Businesses. Here's Your Defence

Your director's voice can now be faked with three seconds of audio, so the question is no longer whether you'd recognise it, it's whether your process still needs you to.

Wanjiru runs finance for a mid-sized logistics firm in Industrial Area. On a Tuesday afternoon, her phone rings. It is the managing director, his voice tired and rushed, the way it always sounds after back-to-back meetings.

He needs an urgent supplier payment sent before 4pm, he says. A new account, details coming by text. He is boarding a flight and cannot talk long. He thanks her, tells her she is a lifesaver, and hangs up.

The voice was his. The tone was his. The small laugh at the end of the sentence, the one he always does, was his too.

Except it was not him. It was three seconds of his voice, pulled from a YouTube clip of a panel he spoke at last year, fed into a cloning tool, and turned into a phone call that nearly moved KES 400,000 into a stranger's account.

Here is how this scam actually works

Forget the version of fraud you learned to watch for. This is not a badly spelled email from a "prince." It is quieter and much harder to spot.

• The scammer needs only a short clip of someone's voice, often lifted from a video call recording, a podcast appearance, a conference talk, or even a voicemail greeting.
• A cloning tool turns that clip into a voice model that can say anything, in that person's tone, with normal pauses and inflection.
• The scammer calls someone with authority to move money, usually in finance, and creates urgency: a flight, a meeting, a deadline in the next hour.
• They ask for something that sounds completely ordinary: pay this supplier, approve this transfer, confirm this account change.
• The target hears a familiar voice and does what familiar voices have always earned the right to expect: trust.

Here is the reframe. The old advice was "if it sounds odd, hang up." The new reality is that it will not sound odd. The voice will be right. Which means the voice can no longer be your test.

Why Kenyan businesses are a real target

This is not a problem that lives somewhere else and might eventually arrive. Two things about how business gets done in Kenya make voice fraud a natural fit for scammers rather than an edge case.

First, money moves fast and it moves by phone. Bank transfers, mobile money, and phone-authorised approvals are normal, everyday tools, not rare exceptions that trigger extra scrutiny. A director calling finance to authorise a payment is not unusual. It is Tuesday.

Second, once money leaves, it is genuinely hard to get back. A transfer made under pressure, in good faith, on a legitimate-sounding instruction, does not come with an easy undo button. By the time anyone realises the call was not real, the funds have usually already moved on.

Put those two together and you get the exact conditions this scam is built for: fast payment rails, high trust in voice authorisation, and low recoverability once the transaction clears.

"But I would recognise my own boss's voice"

This is the objection every business owner raises first, and it is worth answering directly because it is exactly the assumption this scam is designed to exploit.

You would recognise your boss's voice on a normal call, about a normal thing, when you are not under pressure. That is not the situation you will be in.

You will be busy. The call will be short. There will be a deadline attached, usually one that conveniently expires before you have time to double-check anything. Your brain will pattern-match the voice, hear the urgency, and move to comply, because that is what years of taking instructions from that voice have trained you to do.

Recognising a voice by ear was never really the safeguard. It was a habit that worked well enough before cloning existed. It does not work now, and no amount of "I know my director's voice" changes that. The fix has to sit outside the call itself.

The defence is a process, not a product

You cannot train your ear to beat this. You can build a process that does not depend on your ear at all. None of what follows requires new software or a big budget. It requires a handful of rules that everyone who can move money actually knows and actually follows.

1. Adopt a call-back rule. Any payment instruction that arrives by phone, however urgent, gets verified on a second, already-known channel before it is actioned. Call the person back on the number already saved in your system, not a number given during the call. Or message them on an established WhatsApp thread. If the instruction is real, a two-minute delay changes nothing. If it is not, that delay is the whole defence.
2. Set a safe word for money matters. Agree a short phrase, changed periodically, that only real staff and directors know, and require it for any voice-authorised payment above a set amount. A cloned voice cannot produce a word it was never given.
3. Require dual approval above a threshold. Pick a number that matters to your business, say KES 100,000, and above that, no single voice instruction moves money alone. A second person must independently confirm, on a separate channel, before release.
4. Train the actual targets, not everyone in general. Finance staff and reception are who these calls go to, because they are the people positioned to move money or pass on instructions quickly. They need to know this scam exists, know the call-back rule by heart, and know they will never be blamed for taking two minutes to verify.
5. Put a written record between the call and the payment. Even a one-line note, "verbal instruction received, call-back completed, confirmed by [name] on [channel]," creates a habit of pausing before money moves, and a paper trail if something goes wrong.

None of these steps assume the fraud will look obviously wrong. All of them assume it will sound completely convincing, because that is the world we are actually in now.

What the old checklist versus the new checklist looks like

It helps to see the shift side by side. Most finance teams are still running a checklist built for a threat that has already moved on.

Can AI help you defend against this, not just enable the attack?

It is a fair question, since AI is the thing that made this attack possible in the first place. The honest answer is that AI can also sit on your side of the fence, quietly, in the background. The same pattern-matching that makes cloning possible can be pointed at your own transaction history instead. A well-built defence workflow watches for the things a human under pressure might miss: a payment instruction to an account that has never been used before, a request that breaks from a supplier's usual payment timing, an amount that sits oddly against your typical spend for that category. When something falls outside the pattern, it does not block the payment on its own. It holds it for a human to look at, with the anomaly flagged plainly, before anything moves. That is the right role for AI here. Not to decide whether a voice is real, because that is a losing game to play, but to catch the transaction itself acting unusual and buy your team the two minutes the call-back rule needs anyway.

A worked example: what the call-back rule would have cost, and saved

Back to Wanjiru. Under the rule, here is what actually happens on that Tuesday call.

She takes the instruction. She does not act on it. She calls the director back on the number already saved in her phone, the one used for every previous conversation, not the one texted to her moments before.

He does not answer immediately, because he is genuinely in a meeting and did not call her at all. She sends a WhatsApp message on their existing thread: "Got a call asking for an urgent payment to a new account, can you confirm?" Fifteen minutes later, he replies: "No, that wasn't me. Do not send anything." The cost of the rule: fifteen minutes and a slightly awkward pause before "before 4pm." The cost of skipping it: KES 400,000 gone, likely for good.

What you have after this

A week in, your finance team and reception have the call-back rule written down somewhere everyone can see it, and they know the safe word.

A month in, dual approval above your chosen threshold is simply how payments work, not an exception anyone questions.

Six months in, the rule has probably stopped at least one real attempt, whether or not you ever hear about it, because the scammer moved on the moment the call-back request came. Voice cloning will keep getting better. Your defence does not need to. It just needs to stop depending on your ear.