Your Doctor's Voice Can Be Cloned. The Payment Rule That Stops the Fraud.

Your practice manager receives a voice note. It's from the doctor. It sounds exactly like the doctor. It says: 'I've updated the billing bureau's banking details — please use the new account for this month's payment.' The payment goes out. It was never the doctor.

AI voice cloning is no longer science fiction. A few seconds of audio — from a practice video, a podcast, a voicemail — is enough to generate a convincing clone. And South African practices are increasingly being targeted.

Why this works on practices

Medical practices have specific characteristics that make them attractive to this kind of fraud:

• Regular, predictable payments to suppliers, billing bureaux and service providers.
• A culture of urgency — the doctor said do it, so it gets done.
• Staff who are trained to follow instructions from practitioners, not to question them.
• Audio of the doctor is often publicly available — practice websites, social media, speaking engagements.

The one rule that stops it

It's not a technology solution. It's an operational one — and it takes about five minutes to implement:

That's it. One rule. If the instruction is genuine, a call-back to the known number confirms it in thirty seconds. If it's fraudulent, the call-back reveals it immediately. The fraud depends on speed and trust; the call-back removes both.

Making it stick

A rule your staff don't know about is not a control. To make this work:

• Write it down as a one-page SOP and keep it at the reception desk.
• Tell every staff member — including locums — on their first day.
• Make the call-back non-negotiable. No call-back, no payment. No exceptions for 'the doctor said it was urgent'.
• Keep a list of known, verified numbers for every supplier and billing bureau — not the number on the invoice.

Why this is an operational problem, not a tech one

No software, no firewall, no endpoint protection stops a staff member from paying a fraudulent invoice when the instruction sounds like it came from their boss. The control has to be a human process — a habit built into the practice's daily routine. That's exactly what CyberSec Resilient specialises in.