A client calls to move £180,000 from their ISA into cash. The voice sounds right. They know the account number. They pass the security questions. The instruction goes through. Three days later, the real client rings to ask why their portfolio has changed.
That example is made up, but the pattern isn’t. According to Pindrop’s 2025 Voice Intelligence and Security Report, deepfake voice fraud attempts grew 300% year on year, going from roughly one a month to seven a day across 2024. Software that clones a voice from a few minutes of audio is freely available, so trying this kind of fraud costs almost nothing.
The FCA and Bank of England have jointly named frontier AI as a material operational risk. If your firm hasn’t reviewed how client instructions are authorised over the phone, that review is overdue.
Where phone verification breaks down
The weak point in most firms is the workflow, not the lack of detection software. The instinct is to buy a fix, such as a deepfake detection tool or a biometrics layer, and some of these have value. The bigger gap is what happens after a member of staff has a doubt.
Most firms rely on one person’s judgement under pressure. A client services associate takes the call and runs through the security questions. The voice sounds a little different, but the answers are right and the client seems impatient. The system says proceed, so they proceed.
Fraudsters don’t need to fool your whole compliance framework. They need to fool one person, once, at a moment of reasonable doubt. Pindrop’s data supports this: attackers deliberately exploit a helpful service culture, using partly correct information and social pressure to get past hesitation quickly. The weakness is the gap between “something feels slightly off” and “here is a set reason to escalate”.
Your staff probably can’t detect a good deepfake. What matters is whether your workflow gives them somewhere to go when they aren’t sure.
What a redesigned verification workflow looks like
A safer verification workflow puts a second check on a short list of high-risk actions, and it works without any AI detection software.
Step one: map the high-risk actions. Not every client interaction carries the same risk. Changing bank details, selling a holding above a set threshold, updating an address just before a withdrawal, adding a power of attorney: these are the actions that need a second gate. Write the list down and keep it short.
Step two: require a second gate for high-risk actions. A second gate means a second person or a second channel, not another question from the same person on the same call. It could be a callback to a number already on file, a confirmation to a verified email address that needs a reply, or a short hold while a colleague reviews the instruction. No single person, in a single live conversation, should be able to authorise a high-risk action alone.
Step three: give staff a low-friction escalation path. “I’ll need to verify this through our standard process for instructions like this” is a complete sentence. Staff shouldn’t have to accuse a caller of fraud to trigger extra checks. They need a script and a policy that make escalation the default for certain actions, rather than something that takes personal courage.
Step four: give one person ownership. Pindrop treats this as a shared ownership question. Security sets the risk thresholds, operations designs the workflow, and client services measures the friction. If those conversations happen separately, the workflow ends up either too loose (operations optimising for speed) or too heavy (compliance optimising for coverage without operations on board). Someone in the firm has to own the whole thing.
How Consumer Duty affects verification
Consumer Duty pulls both ways. Firms have to deliver good outcomes, which includes protecting vulnerable clients from fraud. Adding friction to genuine instructions causes its own harm, especially for clients who struggle with several verification steps.
The answer is proportion. A low-value, routine instruction through a familiar channel doesn’t need a second gate. A high-value, unusual instruction from an unfamiliar number does. The firm’s job is to draw that line in advance, not to decide it case by case on a live call.
The FCA’s recent consultations point towards outcomes rather than prescriptive rules. That gives firms more discretion, and less cover if something goes wrong and the workflow wasn’t good enough. Write down the decisions and why the thresholds sit where they do. If a fraud attempt comes and the workflow holds, you want a paper trail showing the design was deliberate.
Where to start this week
If you don’t have a written list of high-risk instruction types and a second-gate process for each, build that first. No software needed: an afternoon with your head of operations and a compliance lead, a short policy, a staff briefing and a review date.
The firms that handle this well won’t necessarily have the best voice authentication technology. They’ll have the clearest agreement about what happens when something feels off.