Three years ago cloning someone's voice required hours of recordings and a studio. Today 30 seconds of audio from a LinkedIn Live or a trade podcast is enough. Cost — a few euros for a monthly subscription with one of the offshore vendors. Attackers know this and have started using it against Polish SMEs at a scale that didn't exist a year ago.
The text-based "CEO scam" — an email asking for an urgent transfer signed with the boss's name — has been around for years and most teams have learned to spot it. The voice variant is different. The boss's voice in the handset, the familiar accent, the same nervous intonation as always when something is on fire. The person in accounting hears what they've heard hundreds of times. Only today it isn't the boss.
We've talked with over a dozen clients about this in recent months. In one case — a 15-person packaging manufacturer near Poznań — the assistant got a WhatsApp call "from the CEO": urgent transfer to a new Czech supplier, 47,000 PLN, "or we'll lose the Lidl contract". The voice was perfect. One detail didn't fit: at that moment the CEO was on a flight to Vienna. The transfer went through. They recovered about a third of it.
What the attack looks like today
The pattern is almost always the same and it's worth knowing in this order, because in this order it will play out at your company too.
First, reconnaissance. They check who's the CEO, who's the CFO, who signs the transfers. All of it is in public registries, on the company website, on LinkedIn. Then they look for a voice recording — a trade conference on YouTube, an interview with local TV, a video from a trade fair. 30–60 seconds of clean audio is enough.
Then the timing. They almost always pick a moment when the boss is unreachable: Friday afternoon, the last day before holidays, the day of a trade fair. They check this on Facebook, on the company Instagram, or on the meeting calendar that the "Contact" page proudly displays.
Then the call itself. Usually to the accountant's mobile, over WhatsApp or Signal — not the landline. Time pressure, an unusual but not astronomical amount (so it slips past a second-signature threshold), a new account number "because the bank changed", and the threat of consequences "if you don't make it by 3 PM". The whole scenario lasts 45 seconds to 2 minutes. The victim has no time to think.
The more advanced version adds caller-ID spoofing and a follow-up email from a lookalike domain — firma-sp-zoo.pl instead of firma.pl. That gives the impression of confirmation.
Why SMEs are the target
Big corporates have dual-signoff procedures, security teams and training on "what BEC looks like". All of that costs money and most 30-person companies don't even have it on the plan. They do have what the attacker wants: flexible processes, a "boss asks, we do it" culture and an accountant who doesn't want to ask twice for fear of looking incompetent.
There's one more thing. In an SME, everyone knows everyone. The boss's voice is so familiar that questioning it feels rude. "What, am I supposed to check whether it's really Mr Krzysztof? I've worked here eight years." That rudeness is exactly what the scammer is buying.
The amounts we've seen in attacks on Polish SMEs this year range from 15,000 to 120,000 PLN. Big enough to hurt. Small enough to slip past the two-person authorisation process that most companies don't have anyway.
5 defences that actually work
None of these defences require spending a fortune or a company revolution. They do require someone writing them down, communicating them and applying them consistently.
- Out-of-band verification. Every request for a transfer above an agreed threshold — say 5,000 PLN — to a previously unknown recipient is verified by phone on the boss's known, previously saved number. Not the number the request came from. Not WhatsApp. The mobile the accountant has had saved for six months. If the boss doesn't pick up — we wait.
- Family password for transfers. Agree with key people on a code word (not a "password" — something non-obvious, e.g. the name of a favourite restaurant from a 2019 holiday) that the boss will always give when they're really calling about an urgent transfer. A deepfake doesn't know this. One question is enough: "as always — what do we eat in Sopot?".
- Two-person authorisation above a threshold. Every transfer above an agreed amount (for a 20-person firm a sensible threshold is 10,000–20,000 PLN) requires approval by a second person in online banking. This is a built-in feature in mBank, ING and Santander — you just need to switch it on.
- New supplier = 24 hours. A new supplier bank account is never executed the same day. Always a 24-hour pause and a verification call to the number from the supplier's official website (not from the email footer — that can be forged). This one rule catches most "account number change" attacks.
- Public-recording hygiene. Consciously manage how much of the CEO's and CFO's voice is publicly available. It's not about silence in the media — it's about awareness that every podcast, every conference recording, is training material. "Knowing it works this way" is enough to make people more careful.
What to do in the first hour after the transfer
If it's already happened — speed matters. The bank has a very short window in which it can reverse an Elixir (Polish clearing) transfer (a few minutes on standard sessions) and a longer window to freeze funds at the recipient's bank.
- Within 15 minutes: call the corporate bank's hotline and demand the transfer be stopped, quoting the reference number. Not email, not chat — a phone call.
- Within an hour: report to CERT Polska (
incydent.cert.pl), which can help with communication with the recipient's bank. - Same day: file a police report. Without one, the recipient's bank won't freeze the funds for more than a few days.
- Warn the team. The attacker usually comes back for a second try at the same company, counting on the chaos. The same 15-person packaging firm caught two more attempts in the six months after the first — both blocked by the code word they introduced a week after the first incident.
What next
Voice deepfakes are no longer a movie scenario. They are a tool that costs less than lunch, is ready in five minutes and aims directly at the place where SMEs have no cover — trust between people who know each other.
Technology alone won't fix this. But three simple rules do close 95% of the surface in practice: out-of-band verification, a code word, and two-person authorisation above a threshold. The rest is training the team so nobody is afraid to ask an awkward question.
If you want to run through this at your company in an hour — no slides, on your real processes — book a call. The first meeting is free.
A deepfake doesn't buy technology. It buys the rudeness of an accountant who's afraid to ask twice.