When a Familiar Voice or Message Is No Longer Proof of Identity

A message arrives from someone who appears to represent one of your suppliers. The conversation looks normal. The name is familiar, the language is professional, and the request seems consistent with an existing business relationship.

Perhaps they need to confirm a change to payment details. Perhaps they are asking an employee to share a document or approve an account change.

Nothing immediately seems unusual.

But how does the employee know that the person on the other side of the conversation is actually who they claim to be?

This question is becoming increasingly important as artificial intelligence makes impersonation easier to create and more difficult to recognize.

The Problem Is Moving Beyond Email

For years, businesses have been encouraged to watch for suspicious emails, unexpected attachments, unfamiliar links and obvious spelling mistakes.

Those precautions still matter. However, business communication now takes place across multiple channels.

Employees use collaboration platforms, messaging applications, video meetings and phone calls to communicate with colleagues and external contacts. Suppliers, contractors and service providers may also interact with employees through these same channels.

This creates opportunities for attackers to exploit something businesses often take for granted: familiarity.

A message arriving through a platform employees use every day can feel more trustworthy than an unexpected email. A recognizable name or profile picture can reinforce that impression.

Artificial intelligence adds another dimension. It can help criminals produce convincing messages, imitate someone's communication style and generate synthetic audio or video that makes impersonation increasingly believable.

The challenge is no longer simply recognizing suspicious messages. It is establishing whether the person making a request is who they claim to be and has the authority to make it.

Security Protections Are Expanding Across Business Communication

The growing concern is reflected in changes to the security features of business communication platforms.

Microsoft, for example, is expanding the protections available within Teams to address different types of suspicious communication.

For external text conversations, Teams can display warnings when it detects potential spam, phishing or impersonation. Microsoft has also announced AI-powered, context-aware phishing detection designed to identify suspicious behavior in conversations, including situations where a malicious message may not contain an obvious link or attachment.

Voice calls have their own protection.

Microsoft Teams Calling includes Brand Impersonation Protection, which evaluates incoming VoIP calls from first-contact external callers for signs that someone may be impersonating a trusted organization. When a potential impersonation is detected, users can receive a warning before answering. Warnings may also appear during a call if suspicious signals persist.

These developments also illustrate why businesses need a broader approach to cybersecurity. As we explain in Why Small Business Cybersecurity Requires More Than Antivirus, protecting a business requires more than individual security tools. Identity verification, access controls and clear procedures all play an important role in reducing risk.

This is particularly relevant because impersonation does not always begin with an email or text message. An attacker may attempt to establish trust through a telephone conversation instead.

What About Teams Phone Numbers?

There is an important distinction between Teams-to-Teams calls and calls made through Teams Phone using the public telephone network.

Businesses using Microsoft Teams Phone can make and receive calls through regular telephone numbers using Calling Plans, Operator Connect or Direct Routing.

Microsoft provides spam filtering for incoming Public Switched Telephone Network (PSTN) calls. When a call is considered potentially unwanted, Teams can display a notification such as "Spam Likely."

However, this is not the same as Brand Impersonation Protection.

PSTN spam filtering identifies potentially unwanted calls based on spam-detection signals. It should not be interpreted as an equivalent system for detecting deepfake voices or determining whether someone is impersonating a particular business or individual.

In practical terms, an incoming external Teams VoIP call may receive a brand-impersonation warning, while an incoming call to a Teams Phone number from the regular telephone network may receive a spam warning.

Neither provides a guarantee that every fraudulent caller will be identified.

These distinctions matter because businesses should understand exactly what their communication security features protect against rather than assuming that all calls passing through the same application receive identical protection.

AI Makes Familiarity a Less Reliable Security Signal

The concern extends beyond written communication.

In September 2026, Gartner published findings from a survey of 297 senior cybersecurity leaders. Forty-one percent reported at least one social-engineering incident involving a deepfake during an employee audio call in the previous 12 months. Thirty-six percent reported an incident involving a video call.

These findings illustrate why businesses should reconsider how much confidence they place in recognizing someone's voice or seeing their face during a conversation.

An employee may believe they are speaking with a manager, business partner or supplier. Yet familiarity alone cannot establish identity.

The consequences can be significant when a request involves financial transfers, changes to payment instructions, access to business systems, sensitive information or account recovery.

The issue is not simply whether a message or conversation looks convincing. It is whether the business has a process for confirming the identity and authority of the person making the request.

Verification Should Not Depend on Recognizing a Fake

One of the most practical changes a business can make is to stop expecting employees to identify every possible impersonation attempt.

That is an increasingly difficult expectation when messages, voices and video can all be manipulated.

Instead, verification should be built into normal business procedures for handling requests with significant consequences.

For example:

• Payment changes should be confirmed through an independently established contact method, rather than simply by replying to the message or calling the number included in the request.
• Requests to reset accounts, change permissions or disclose sensitive information should follow established authorization procedures.
• Unexpected instructions from executives or external business partners should be verified through a separate, trusted communication channel.
• Employees should have a clear way to report suspicious requests without feeling pressured to act immediately.
  

The important distinction is between trusting the communication and verifying the request.

A familiar platform, a recognizable name or a convincing voice should never be the sole reason an employee approves a sensitive action.

Security Is Also a Business Process

Technology can help identify suspicious activity, block malicious communication and provide additional warnings. These protections are valuable, but they cannot replace appropriate business procedures.

Organizations also need to determine what happens when a request reaches an employee.

Who is authorized to approve a payment change? How should a supplier's new banking details be verified? What happens when someone requests access to an account or asks for sensitive information?

These questions need clear answers before an unexpected request arrives.

The objective is not to make everyday communication difficult or to require employees to question every conversation.

It is to introduce appropriate verification at the points where a mistake could have serious consequences.

As AI makes impersonation more convincing, businesses cannot rely exclusively on employees recognizing suspicious communication or on security warnings appearing at the right moment.

They need processes that establish identity and authority independently of the communication channel being used.

The question business owners should be asking is simple: If someone convincingly impersonates a person their employees already trust, what would prevent that request from being carried out?