AI Voice Scams Are Calling Burnaby: A Payment Playbook

The call sounds right, and that's the problem

A controller in Burnaby picks up the phone. It's the owner's voice. Same cadence, same slightly clipped way they say the company name. A deal is closing today, a deposit has to move in the next twenty minutes, and the banking details are different from the ones on file. Everything about the call feels normal except the ask.

The defence isn't sharper ears. It's a written payment rule that doesn't care how convincing a voice sounds.

What the 2025 numbers actually show

In Canada, the Canadian Anti-Fraud Centre logged over 112,000 fraud reports and more than $704 million in reported losses for 2025. Spear phishing, the category that holds most payment redirection fraud aimed at businesses, came second by dollar loss at $67.9 million, behind investment fraud at $351 million (Canadian Anti-Fraud Centre).

The American data is larger and broken out in more detail. The FBI's Internet Crime Complaint Center recorded 1,008,597 complaints and $20.877 billion in reported losses for 2025, a 26 percent increase in losses over 2024. Business email compromise accounted for $3,046,598,558 of that total. IC3 also counted 22,364 complaints with an AI element, worth $893,346,472 in adjusted losses, and says plainly that "in 2025, businesses reported losses over $30 million to BEC scams involving AI" (FBI IC3 2025 Annual Report).

Read that $30 million two ways. It's small next to $3 billion of total BEC losses, so synthetic voice is not yet the main channel. It's also self reported, and it only gets counted when a victim figures out the voice was fake, which most never will. Treat it as a floor, not a measurement.

Why the phone became the soft spot

Email fraud trained everyone to be suspicious of email. So the call became the trusted channel, the thing you do to check the email. That's exactly the assumption AI voice cloning breaks.

The Canadian Centre for Cyber Security describes voice cloning as using "AI models to replicate a person's voice using small audio samples," and is blunt about the consequence: audio or video alone should not confirm identity for sensitive requests (ITSAP.00.166, July 2026). Its advice for business email compromise is to confirm through "securely verified and out-of-band (alternate) channels."

The US Treasury's financial intelligence unit saw the same pattern in bank filings. Its 2024 alert describes criminals using AI tools "by impersonating an executive or other trusted employee and then instructing victims to transfer large sums or make payments to accounts ultimately under the scammer's control" (FinCEN FIN-2024-Alert004). Two of its red flags translate straight to your front desk: someone who tries to switch communication methods partway through a verification, and someone who declines to use multifactor authentication.

The payment-verification playbook

None of this requires new software. It requires one page of policy that your team can't quietly skip.

• Call back on a number you already have. The CAFC's own advice is to "look up the person's email or phone number in your work's directory and verify with them if they sent the message." Never the number in the request, and never a number read out on the call itself.
• Put a hold on banking changes. Any change to vendor, payroll or landlord banking details triggers a mandatory callback on a known number plus a waiting period before the first payment goes out. The RCMP is direct about this: "Do not rely on email alone."
• Require two people on wires. The RCMP recommends a dual signature system with dual authentication, using a security token, so at least two authorized signatures are needed for a wire transfer.
• Agree on a spoken pass phrase. Set it in person with anyone who can authorize money, rotate it, and never send it by email or text. A cloned voice can imitate your CFO. It can't know a phrase that was never written down.
• Make urgency a stop signal, not an override. Write it down that nobody, including the owner, can skip verification because something is urgent. Urgency is the lever every one of these calls pulls.
• Log every attempt, including the ones that failed. A single odd call is noise. Three in a month means your firm is on a list.

Where AI genuinely helps here

The useful AI in this story is boring, and it isn't a deepfake detector. It's the automation layer that makes the rule hard to bypass when the office is busy.

Concretely, that looks like an assistant watching the accounts payable inbox and flagging any message that contains new banking details, routing it into a verification queue before a payables clerk ever sees it. It looks like a workflow that opens the callback task automatically, pre-fills the phone number from your vendor master record rather than from the email, and refuses to release the payment until someone marks the call as completed. It looks like a monthly reconciliation of every bank detail change against the verification log, so a change nobody verified surfaces within thirty days instead of at year end.

That's ordinary process automation with a language model doing the reading and routing. It works for the unglamorous reason that it removes the moment where a tired human decides to skip a step.

Where this doesn't apply

Deepfake detection software is not a control you should lean on. In a peer reviewed Interspeech 2022 study, Müller and colleagues found that detectors trained on the standard ASVspoof benchmark degraded by "up to one thousand percent" when tested on audio collected in the wild. Detection has improved since, but generalizing to voice generators the model has never seen is still the open research problem. FinCEN treats a detection software flag as one red flag among many, never as a decision.

Voice biometrics aren't a free upgrade either. The Office of the Privacy Commissioner of Canada's August 2025 biometrics guidance requires express consent for collecting biometric information and sets a four part test: legitimate need, effectiveness, minimal intrusiveness, and proportionality. A generic "this call may be recorded" notice does not amount to valid consent for a voiceprint. For a twelve person firm in New Westminster, a voiceprint program is almost certainly disproportionate. A pass phrase and a callback cost nothing and pass the same test.

Also worth saying: if your business almost never changes vendor banking details and one person approves every payment, don't automate anything. Write the rule on a card by the phone. Automation earns its keep once the volume of payment requests is high enough that somebody will eventually be rushed.

One caveat on sources. FinCEN and IC3 describe American reporting obligations, not Canadian ones. The typologies carry over. The filing requirements don't.

If the money already left

Move in minutes, not days. The RCMP says to contact your financial institution immediately with the amount, the destination account and the details of the request, ask about recalling the transfer, and make sure your bank contacts the recipient bank. Then report to local police, to the Canadian Anti-Fraud Centre at 1-888-495-8501, and to [email protected].

Fast reporting genuinely recovers money. In 2025 the FBI's Financial Fraud Kill Chain froze $507,042,623 across 3,574 domestic incidents, which the report puts at a 58 percent success rate. The recoveries happen in the hours after the wire, not the weeks.

Sources

• Canadian Anti-Fraud Centre (RCMP). "Top 10 frauds in 2025." Modified 2026-02-25. Link
• Canadian Anti-Fraud Centre (RCMP). "Spear phishing." Modified 2026-01-16. Link
• Federal Bureau of Investigation, Internet Crime Complaint Center. "2025 IC3 Annual Report." 2026. Link
• Canadian Centre for Cyber Security. "Social engineering (ITSAP.00.166)." July 2026. Link
• Royal Canadian Mounted Police. "Business Email Compromise." 2025-11-06. Link
• Financial Crimes Enforcement Network. "FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions," FIN-2024-Alert004. November 13, 2024. Link
• Office of the Privacy Commissioner of Canada. "Guidance for processing biometrics for organizations." August 11, 2025. Link
• Müller, N., Czempin, P., Dieckmann, F., Froghyar, A., Böttinger, K. "Does Audio Deepfake Detection Generalize?" Interspeech 2022. Link

If you run a business in Burnaby, New Westminster or anywhere in Metro Vancouver and your payment approvals still depend on somebody recognizing a voice, that's a gap worth closing this quarter. Autana Solutions builds the AI workflows that sit behind rules like these, so the verification step happens every time without adding a person to your payroll. Book a free call and we'll map your current payment path and where a fake voice could slip through.