# Is that really your client on the phone? Verifying payment requests and AI voices > The FBI warns that AI voice cloning makes fake calls and payment requests more believable. Here is what its alerts and an Oregon PLF program say about verifying requests through a second channel. Law + AI Daily by TacticalMS · Bring in the tech · Published 2026-11-04 Canonical: https://tacticalms.dev/blog/verify-payment-requests-ai-voice-cloning-law-firm ## The short version - The FBI's May 2025 alert describes scammers using "AI-generated voice messages" and says to independently find a number and call to confirm who is asking [1]. - The FBI's July 2026 alert says AI-generated voices "can sound nearly identical" to a real contact [2]. - The FBI's business email compromise alert names "real estate attorneys" among the targets and says to verify account changes through secondary channels [3]. - Materials from an Oregon State Bar Professional Liability Fund CLE describe calling a vendor "using the number you previously had on file" to confirm an emailed request [4]. AI voice cloning lets a scammer sound like someone the listener already knows, and the FBI says cloned voices can sound nearly identical to the real person [2]. The FBI's alerts describe the same basic defense: confirm the request through a separate, trusted channel before acting on it [1, 3]. This post collects what the FBI, and an Oregon State Bar Professional Liability Fund (PLF) program, say about verification, so a firm can compare its own payment routine against them. This is the third post this week on attacks against law firms. Monday's brief covered [CrowdStrike's 2026 report on attacks against law firms](/blog/crowdstrike-2026-legal-threat-landscape-report), and Tuesday's post explained [Oregon's data breach notice law](/blog/oregon-data-breach-notice-law-ors-646a) [3]. ## What the FBI says AI voice impersonation looks like The FBI's public service announcement of May 15, 2025 (Alert I-051525-PSA) describes a campaign of "text messages and AI-generated voice messages," which it calls smishing and vishing [1]. That alert was about people impersonating senior U.S. officials, but its tips are written for anyone who receives an unexpected call or message [1]. The FBI's July 20, 2026 alert (I-072026-PSA) says scammers "use AI-generated voices to masquerade as a known contact" [2]. It also describes AI-generated videos used in real-time video chats with supposed company executives and law enforcement, and says "AI-generated content has advanced to the point that it is often difficult to identify" [2]. ## Why payment instructions are the pressure point The FBI's June 9, 2023 alert (I-060923-PSA) defines business email compromise as a scam that targets businesses and individuals "who perform legitimate transfer-of-funds requests" [3]. The alert says the scam targets all participants in real estate transactions, including "real estate attorneys, title companies, and agents" [3]. It reports more than $50.8 billion in exposed losses reported between October 2013 and December 2022 [3]. The PLF's 2023 CLE "Understanding Your Firm's Cybersecurity Obligations and Exposures" listed "fraudulent instruction," including business email compromise and spoofed emails, as a source of loss [4]. A slide in the program materials says to "verify any new payment requests through a different mode of communication than it came through" [4]. ## The verification steps the agencies describe Each of these comes from the source cited. - **Call back on a number you already trust.** The FBI says to verify the identity of the caller or sender, then independently find a number for that person and call to confirm [1]. - **Use a second channel for account changes.** The FBI's business email compromise alert says to "use secondary channels or two-factor authentication to verify requests for changes in account information" [3]. - **Check inside the office, too.** The PLF program materials give the example of a co-worker's email asking to pay a new vendor or change a vendor's account information, and describe walking to their workspace or calling their extension to confirm [4]. - **Look closely at addresses and links.** The FBI says scammers use slight differences in email addresses, phone numbers, URLs and spelling [1, 2]. - **Listen, but don't rely on your ear alone.** The FBI says to listen to tone and word choice, while also warning that cloned voices can sound nearly identical to the real person [1, 2]. - **Protect login codes.** The FBI says never to provide a two-factor code to anyone by email, text or messaging app, and to keep multi-factor authentication turned on [1]. - **Agree on a shared check.** The FBI's May 2025 alert suggests agreeing on a secret word or phrase with family members to verify their identities [1]. ## Questions a firm can ask about its own routine These questions come from the steps above. They are a way to review a process, not a statement of what any firm is required to do. 1. Which payment requests, such as new wire instructions, changed bank details or urgent disbursements, does the firm confirm by a second channel before anyone acts [3, 4]? 2. Where are the trusted phone numbers for clients, title companies, banks and vendors kept, and are they separate from the email thread that brings the request [1, 4]? 3. Is there an agreed check, such as a callback or a shared phrase, for urgent requests that claim to come from a partner or a client [1]? 4. Do staff know what the FBI says to do first if money goes out: contact the bank to request a recall, then file at ic3.gov [3]? ## What the FBI says to do if money has already gone out The FBI's business email compromise alert says to contact the financial institution first and request a recall of the funds, and it says time is critical [3]. It says to file a complaint at www.ic3.gov as soon as possible, regardless of the dollar amount [3]. The FBI's July 2026 alert adds that IC3 "will never ask for payment to recover lost funds" and does not refer people to paid recovery companies [2]. The PLF program materials list, among the questions to answer after a cyber incident, whether clients or other entities need to be notified, and they pair those questions with an ethics or data breach lawyer [4]. How those duties apply to a particular firm depends on the facts and is a question for a licensed Oregon attorney. ## Common questions ### Can scammers really clone a person's voice with AI? The FBI says they can. Its July 2026 alert says AI-generated voices can "sound nearly identical" to a legitimate caller, and that scammers use them "to masquerade as a known contact" [2]. ### What does the FBI say to do if a call or message asks for money or account changes? The FBI's May 2025 alert says to verify the identity of the person contacting you by independently finding their number and calling them, and not to send money to people you do not know [1]. Its business email compromise alert says to use secondary channels or two-factor authentication to verify requests to change account information [3]. ### Are law firms targeted by business email compromise? The FBI's June 2023 alert says the scam targets all participants in real estate transactions, including "real estate attorneys, title companies, and agents" [3]. ### What does the FBI say to do if a wire goes to a scammer? The FBI's business email compromise alert says to contact the financial institution first to request a recall of the funds, and to file a complaint at ic3.gov as soon as possible, regardless of the amount lost [3]. ## Sources 1. [Senior US Officials Impersonated in Malicious Messaging Campaign (Alert I-051525-PSA)](https://www.ic3.gov/PSA/2025/PSA250515), FBI Internet Crime Complaint Center, May 15, 2025 2. [FBI Warns of Scammers Impersonating the IC3 (Alert I-072026-PSA)](https://www.ic3.gov/PSA/2026/PSA260720), FBI Internet Crime Complaint Center, July 20, 2026 3. [Business Email Compromise: The $50 Billion Scam (Alert I-060923-PSA)](https://www.ic3.gov/PSA/2023/PSA230609), FBI Internet Crime Complaint Center, June 9, 2023 4. [Understanding Your Firm's Cybersecurity Obligations and Exposures: CLE materials](https://assets.osbplf.org/cle_classes/program_doc/20230524%20Cybersecurity%20CLE%20materials%20for%20website%20UPDATED.pdf), Oregon State Bar Professional Liability Fund, May 31, 2023 --- Not legal advice. This post is general information about law and technology, not legal advice. It does not create an attorney-client relationship, and TacticalMS is not a law firm. Laws, rules and ethics opinions change; check the cited sources and talk with a licensed Oregon attorney about any specific situation.