Verify the request.
By Tyler Mayberry · Cirlet. Checked October 22, 2026. Examples are fictional; they are not accounts of agency victims.
A familiar voice is a reason to recognize someone. It is not enough to authorize a sensitive change.
The FBI has documented AI-generated voice impersonation in campaigns targeting people connected to senior US officials. That is evidence of the technique, not a claim that this campaign targeted insurance agencies.
Use a trusted route.
- Pause a request involving payment, credentials, sensitive records or unusual urgency.
- Use the client/carrier contact already in your approved records. Do not use a new number supplied in the message.
- Confirm the specific requested change and follow your established approval procedure.
- If the request cannot be verified, escalate to your designated owner. Preserve the original message through your approved reporting process.
A fictional example
A caller sounds like a familiar client and asks a CSR to send a policy document to a new address immediately. The CSR pauses, calls the number already recorded for the client, and verifies the request before sharing anything. The example illustrates a process, not detection of a particular AI model.
Prepare before the call.
- Record a trusted callback route for sensitive requests.
- Name the backup approver when the usual person is unavailable.
- Practice one fictional urgent request with the team.
- Review how messages are reported without forwarding sensitive content widely.
Source: FBI IC3, May 15, 2025: impersonation using text and AI-generated voice messages. The callback checklist is Cirlet’s practical adaptation. For a suspected active incident, use your established response provider and reporting procedures.