Skip to content

Don’t pay the fake bossDeepfake and AI scam protection for businesses and individuals

We help businesses and individuals stop deepfake calls, cloned voices and AI-written phishing before money moves: simple verification rules, training that sticks, and email settings that make impersonation harder.

Get a quote for this
A bookkeeper on the phone with a doubtful look, one hand paused beside an invoice and her laptop

WHAT IT DOESLOG

  • “It’s me, pay this today”

    → Call-back rule kicks in

  • Supplier’s new bank details

    → Checked on a known number

  • Flawless phishing email

    → Spotted, reported, blocked

  • Video call from “head office”

    → Code phrase checked

“The call sounds exactly like your director: rushed, apologetic, needing a supplier paid before five. The voice is perfect. It isn’t them.”

SOUND FAMILIAR?

What is deepfake and AI scam protection?

It’s preparing your business, and the people in it, for scams that use AI to impersonate someone you trust. Criminals can now clone a voice from a short clip, fake a face on a video call and write flawless, personal phishing emails in any language. The defence is less about spotting the fake, which keeps getting harder, and more about rules that make the fake harmless: no payment or bank-detail change is ever approved on the strength of a call, email or video alone.

The FBI’s Internet Crime Complaint Center received more than 22,000 complaints involving AI in 2025, with reported losses of over $893 million. Tamkoz sets up practical protection for businesses and individuals: verification rules your team will actually follow, training built on current examples, and the email and account settings that make impersonating you harder. We work in plain English, and we’re honest that nothing stops every scam.

THE JOBS IT TAKES ON

DEEPFAKE & AI SCAM PROTECTION

  • “It’s me, pay this today”

    → Call-back rule kicks in

  • Supplier’s new bank details

    → Checked on a known number

  • Flawless phishing email

    → Spotted, reported, blocked

  • Video call from “head office”

    → Code phrase checked

  • Lookalike domain

    → Flagged before staff see it

How AI scams reach a business

The tricks are old: urgency, authority and secrecy. AI just makes them far more convincing.

  • A cloned voice of the boss asking for an urgent payment

    → A call-back rule: payments are confirmed on a number you already hold, never the one that called.

  • A deepfake video call with “senior colleagues”

    → Code phrases and a second approver for anything unusual, however real the faces look.

  • Phishing emails with no spelling mistakes left to spot

    → Training built on today’s AI-written examples, plus a one-click way to report.

  • A supplier’s “new bank details” letter

    → Any change of bank details verified by phone on the number on file, then confirmed by a second person.

  • Lookalike domains and spoofed email

    → SPF, DKIM and DMARC set up properly, and alerts for domains that imitate yours.

  • Accounts taken over, then used to scam your contacts

    → Multi-factor authentication everywhere, and one-time codes never shared.

The fake boss calls at 16:40

A cloned voice asks for an urgent payment. One simple rule makes it harmless.

  1. STEP 1

    The call

    16:40. “It’s Mark. I’m between meetings and need the Hadley invoice paid today, to the new account. I’ll explain later.” It sounds exactly like him.

  2. STEP 2

    The rule

    No payment on a call alone. “Of course. I’ll ring you back on your mobile to confirm.”

  3. STEP 3

    The call-back

    Mark’s usual number. He’s at his daughter’s football match and hasn’t called anyone.

  4. STEP 4

    Stopped

    Nothing paid. The number, the time and what was said are written down.

  5. STEP 5

    Reported

    Bank and team told, report filed, and the rule gets a mention at Monday’s meeting.

SAMPLE · A FICTIONAL ACCOUNTS TEAM

Who needs protection from AI scams?

Anyone who can move money, change payment details or speak for the business.

  • Businesses with a bookkeeper or finance assistant

    The person who pays the invoices is the main target, often while the owner is away.

  • Owners with a public voice

    If you’re on podcasts, video or social media, your voice and face are easy to copy.

  • Accountants, solicitors and property firms

    Client money and completion payments make you a high-value target.

  • Shops and wholesalers

    Supplier payments and refunds that one convincing email could redirect.

  • Charities and clubs

    Volunteers and treasurers targeted with fake requests from trustees.

  • Families and individuals

    Code words and a call-back habit against the cloned-voice “I’m in trouble, send money” call.

A GOOD FIT IF…

  • Your team can move money or change bank details
  • Your voice or face is public on video or podcasts
  • Invoices and payment requests arrive by email
  • You’ve had a near miss, or heard of one nearby

What we set up

  • A verification playbook

    Short written rules for payments, bank-detail changes and urgent requests: who approves, how to call back, which code phrases to use.

  • Team training

    A practical session with current examples of AI phishing and voice cloning, and a drill so the rules become habit.

  • Email protection

    SPF, DKIM and DMARC set up and monitored, external-sender warnings on, and alerts for lookalike domains.

  • Account security

    Multi-factor authentication on email, banking and finance tools, with recovery details checked.

  • A footprint review

    How much of your voice, face and organisation chart is public, and what’s worth tightening.

  • An incident plan

    Who to call and what to do in the first hour if money moves: your bank, the police and the right reporting service for your country.

  • A refresher

    A short check-in and drill every six or twelve months, because the tricks change.

How we protect your business

Find where money can move, write the rules, train the people, harden the email.

  1. ORDER 001START

    1×Map the money

    We find every way money or payment details can change hands in your business, and who can make it happen.

  2. ORDER 002BUILD

    1×Write the rules

    Simple verification steps for each one, agreed with you, so the fake call gets nowhere however good it sounds.

  3. ORDER 003CHECK

    1×Train and drill

    We walk your team through today’s AI scams, then practise the rules with a realistic test, with everyone’s agreement.

  4. ORDER 004GO LIVE

    1×Harden and review

    Email authentication, multi-factor sign-in and alerts set up, then a refresher on a schedule you choose.

Where we work

Protection lives in your inbox, your bank’s settings and your team’s habits.

EMAIL
Google WorkspaceMicrosoft 365SPFDKIMDMARC
SIGN-IN
Multi-factor authenticationPasskeysPassword managers
MONEY
Online banking approvalsXeroQuickBooksPayment platforms
CALLS AND MEETINGS
PhoneWhatsAppMicrosoft TeamsZoomGoogle Meet
REPORTING
Your bank’s fraud teamFBI IC3 and FTC (US)Your national fraud reporting service
TRAINING FORMATS
Team sessionCall-back drillsSimulated phishingOne-page rules by the desk

We don’t sell detection software. If a deepfake-detection or email-security product is worth paying for in your case, we’ll explain why and help you choose one.

How much does AI scam protection cost?

Most of the protection is rules and settings, not software, so the cost is mainly our time: quoted in writing as a one-off set-up, with optional refreshers.

WHAT AFFECTS THE PRICE

  • Team size

    Training five people is a different job from training fifty.

  • How money moves

    One bank account and one bookkeeper is simpler than several companies, approvers and payment platforms.

  • Email set-up

    Some domains need small changes. Others have years of unknown senders to sort out before DMARC can be enforced.

  • Practice tests

    Optional simulated phishing emails or calls, run only with your agreement.

  • Refreshers

    Optional, every six or twelve months.

WHAT THE FBI, THE FTC AND REAL CASES SHOW

  • The FBI’s 2025 Internet Crime Report records 22,364 complaints involving AI, with losses of $893,346,472, and more than $30 million of business email compromise losses involving AI. Business email compromise as a whole cost $3,046,598,558 in reported losses. Source: FBI IC3.
  • The FBI warns that criminals use AI-cloned voices and live video calls posing as executives, and advises agreeing a secret word or phrase and hanging up to call back on a number you look up yourself. Source: FBI IC3.
  • The FTC advises checking any urgent request by calling the person on a phone number you know is theirs. Source: FTC Consumer Advice.
  • In 2024 the engineering firm Arup confirmed that an employee in Hong Kong sent HK$200m (about US$25m) after a video call in which the chief financial officer and other colleagues were deepfakes. Source: Construction Management.
  • In the UK, phishing was the most common type of breach or attack in 2025/2026, experienced by 38% of businesses. Source: DSIT.

CHECKED 23 OCTOBER 2026. SCAM TACTICS CHANGE FAST, SO WE UPDATE THE TRAINING EXAMPLES BEFORE EVERY SESSION.

YOUR QUOTE · FIXED AND IN WRITING

We quote the set-up and any refreshers in writing, in your currency, before anything starts.

Get a quote

How long does it take?

The most important protection, a call-back rule for payments, can be in place within days. The rest follows over a few weeks.

DMARC is moved to full enforcement in stages so no genuine email is lost; on a busy domain that can take a few weeks.

TYPICAL TIMELINE

YOUR QUOTE HAS THE REAL DATES

  1. 01 MAP AND RULESFIRST WEEK

    Payment routes mapped, verification rules agreed.

  2. 02 EMAIL AND ACCOUNTSWEEKS ONE TO THREE

    Authentication, multi-factor sign-in and alerts set up.

  3. 03 TRAINING AND DRILLONE SESSION

    Your team trained on current examples, then a practice run.

  4. 04 REFRESHEREVERY 6 TO 12 MONTHS

    Rules reviewed, new tricks covered.

AI scam and deepfake questions

Something else? Ask in the chat. A person answers.

What is a deepfake scam?

A scam that uses AI-generated audio, video or images to impersonate someone you trust, such as your boss, a supplier or a family member, usually to get money moved or details shared. The FBI has warned that criminals use cloned voices and live deepfake video calls posing as executives.

How can I protect my business from deepfake fraud?

Make the fake harmless rather than relying on spotting it. No payment or bank-detail change is approved on a call, video or email alone; you call back on a number you already hold; urgent requests need a code phrase; and anything unusual needs a second approver.

How do I protect against AI voice cloning scams?

Agree a secret word or phrase with colleagues and family, hang up and call back on a known number whenever a call asks for money or secrets, and treat urgency and secrecy as warning signs. Both the FBI and the FTC give this advice.

Can you tell if a voice is AI-generated?

Sometimes, from odd pauses, flat emotion or strange word choices, but the best clones are very hard to tell apart and they keep improving. That’s why we build verification habits rather than teaching people to play detective.

How do I protect my business from AI phishing?

Train with current, AI-written examples rather than old ones full of spelling mistakes, make reporting a suspicious email one click, set up SPF, DKIM and DMARC on your domain, and turn on multi-factor authentication everywhere so a stolen password isn’t enough.

What should I do if we’ve already paid a scammer?

Call your bank’s fraud team straight away, because speed matters when recalling a payment. Then report it: in the US to the FBI at ic3.gov, in the UK through the national fraud reporting service, and elsewhere to your local police. Keep every email, number and message.

Are deepfakes illegal?

Using one to trick someone out of money is fraud wherever we work. Laws on making and sharing deepfakes differ by country and state and are changing fast, so take local legal advice for anything beyond fraud.

Do we need deepfake detection software?

Most small businesses don’t, at least not first. Detection tools miss some fakes, while a call-back rule stops the scam whether or not anyone spots it. If your risk justifies a tool, we’ll explain why and help you choose one.

Will training make my team paranoid?

Good training does the opposite: it gives people one simple rule to follow, so they don’t have to judge every call. “I’ll call you back on your usual number” is polite, quick and works every time.

Do you help individuals and families too?

Yes. A family code word, tighter privacy settings on social media and a call-back habit protect against the “I’m in trouble, send money” call. We can set that up with you in one session.

Further reading

GOES WELL WITH

SOURCES · CHECKED 23 OCTOBER 2026

Make the fake call harmless.

Tell us how money moves in your business. We’ll find the weak spots and quote in writing to close them.

Get a quoteBook a call