Passkeys have gone mainstream — should you switch?
Microsoft has been switching passkeys on by default, Google reports over 800 million accounts using them, and most large firms have deployed them. Here is the honest state of play.
AI voice-cloning scams: the family code word that beats them
A few seconds of audio is now enough to clone a voice convincingly. The defence is not clever technology — it is one agreed word and a habit of hanging up.
What has actually changed
Voice cloning is not new. What changed is that it got cheap, fast and good enough to work down a phone line, where the audio quality is poor anyway and your brain fills in the gaps.
A few seconds of someone speaking is enough, and most people have supplied that without thinking — a voice note, a video on social media, an answerphone greeting, a work webinar. The reported growth is steep: deepfake-enabled voice phishing rose by over 1,600% in a single quarter in 2025 by one measure, and voice cloning is now widely described as the leading AI fraud method.
The two scripts
For families, it is the distress call. A grandchild or a son has been arrested, or crashed the car, or is in hospital, and needs money immediately. It comes from an unfamiliar number, which is explained away — a broken phone, a police station, a borrowed mobile. The voice is right, the panic is real, and the whole thing is designed so you act before you think.
For businesses, it is the finance call. Someone who sounds exactly like the director or the finance lead rings, often backed by a spoofed email, asking for an urgent payment. A UK engineering firm lost around £25 million to a single deepfake call in 2024. That is an outlier in size, not in method.
Both scripts run on the same fuel: urgency plus authority plus a reason you cannot verify it the normal way.
The defence is embarrassingly low-tech
Agree a code word with your family. One word, not written down anywhere, that anyone can ask for on a call that feels wrong. A cloned voice will not know it. A real relative will not mind being asked, and if they do mind, that is a conversation worth having anyway.
Then build the hang-up habit. End the call and ring back on the number you already have saved. Not a number they gave you, not a number in the email — the one in your own phone. Every version of this scam collapses at that point, which is exactly why the caller will push hard to keep you on the line.
Even a thirty second pause does most of the work. These calls are engineered to stop you thinking, so any delay you can insert is a defence.
For businesses, make it a rule rather than an instinct
Do not rely on staff being sceptical, because the whole attack is designed to defeat scepticism in the moment, and it targets the person least able to challenge a director.
Write it down instead: any change to bank details, and any payment over an agreed threshold, requires verification through a second channel by a person other than the requester. Callbacks go to the number in your own records. Nobody is ever criticised for slowing down a payment. Say that part out loud and mean it, because the reason these attacks work is that people are afraid of looking difficult in front of a boss.
Sources
Where the facts in this article came from. If any of it goes out of date, tell us and we will correct it.
How We Can Help
If you would rather we just handled it
Keep Reading
Related articles
Ransomware and UK SMEs: the honest picture
The NCSC recorded 204 nationally significant incidents in a year, up 130%. Attackers are automating with AI, and small firms are targeted precisely because they are somebody's supplier.
Is a Copilot+ PC actually worth it in 2026?
Copilot+ machines need a 40+ TOPS neural processor, 16GB RAM and 256GB storage. The AI features are real, but the reason to buy one is probably the battery.
Want a straight answer about your setup?
Tell us what you are running and we will tell you honestly whether this affects you, what it would cost to put right, and how quickly we can do it. No hard sell.
Open 9am–9pm, 7 days a week