AI Voice Clone Wire Fraud: A Playbook for Loan Officers

Last reviewed: November 5, 2026. General information, not legal advice. This page is a practical playbook for loan officers and small mortgage companies. Your title or settlement agent, your lenders and your counsel may set additional steps.

In May 2026, days before closing, a Michigan couple received an email asking them to wire $66,026.92 within 24 hours. The email listed a phone number that differed from their loan officer's by the last two digits. On the call to confirm the instructions, the voice "sounded just like their loan officer," CNN reported in September 2026. They wired the money. The closing was canceled hours before signing, and the couple finished the purchase weeks later with other savings. A fraud prevention expert told CNN the scammers likely cloned the loan officer's voice from his social media posts.

The American Land Title Association described the same pattern in September 2026: fraudsters using voice cloning to impersonate property owners, lenders and other trusted parties. The FBI has warned since December 2024 that criminals use AI-generated audio to impersonate people and get payments. Loan officers are a natural target: your voice is in your videos and webinars, your borrowers expect to hear from you right before closing, and your emails carry the exact amounts and dates a scammer needs.

The one rule every borrower should hear from you

We will never change wire instructions by phone, email or text. If anyone, even someone who sounds exactly like me, asks you to send money somewhere new, stop and call us on the number you already have. A familiar voice is no longer proof of identity.

Scripts you can copy

At application (email or welcome packet)

A note about wire fraud: criminals now use AI to copy voices and send emails that look like ours. We will never change wire or payment instructions by phone, email or text. Before you send any money, call your settlement agent on a number you already have, not one in a message, and confirm the instructions. Let us agree on a code word for this loan: we will use it if we ever need to talk about moving funds.

At clear to close and with the Closing Disclosure

You are close to closing, which is when scammers strike. If you get any message, call or voicemail that changes where to send your funds, even if it sounds like me, do not send money. Hang up and call me or your settlement agent on the number you already have, and ask for our code word.

Email signature line

Wire fraud warning: we will never change wire instructions by email, phone or text. Always verify by calling a number you already have.

Voicemail greeting

You have reached my line. As a reminder, I will never ask you to change where you send closing funds by phone, email or text. Please leave a message.

Inside your shop: eight controls

1. Wire instructions never change by phone, email or text. Make it a written company rule and tell every borrower at application and again before closing. Any "new" instructions are treated as fraud until proven otherwise.
2. Verify through a number you already have. Call back on the number in your file or on your company website, never the number in the message. The FBI tells consumers to hang up and call the organization's number directly. (FBI IC3 PSA, December 3, 2024)
3. Use a shared code word for money moves. Agree on a code word with the borrower, settlement agent and your team at the start of the file. No code word, no change.
4. MFA on every mailbox. Many of these schemes start with a compromised email account that shows the scammer your deadlines and amounts. The FTC Safeguards Rule requires multi-factor authentication for anyone accessing your information systems. (16 CFR 314.4(c)(5))
5. Watch for lookalike domains and forwarding rules. Check for email addresses one or two letters off your own, and review mailbox forwarding rules after any suspicious login.
6. Treat internal "boss" requests the same way. FinCEN notes criminals impersonate an executive or trusted employee and instruct staff to transfer funds. A voice or video call from a manager asking for a payment or borrower data gets the same callback. (FinCEN Alert FIN-2024-Alert004)
7. Look twice at identity documents. FinCEN lists red flags such as a photo that looks altered or does not fit the customer's other details, identity documents that are inconsistent with each other, and a customer who declines multi-factor authentication. (FinCEN Alert FIN-2024-Alert004)
8. Train every year and keep the record. Add voice cloning, deepfake video and AI phishing to annual security training, with a sign-off for each person. (Freddie Mac 1302.2(b)(ii))

What the rules say about training and incidents

"artificial intelligence (AI)-powered tactics (e.g., deepfakes, targeted phishing content) and threats to AI systems (e.g., model inversion, data poisoning, prompt injection)"Freddie Mac Guide Section 1302.2(b)(ii), topics the annual training should incorporate

In plain English: Freddie Mac Seller/Servicers must cover deepfakes and AI phishing in annual security training. Brokers often see the same expectation in lender questionnaires.

"Providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment"16 CFR 314.4(e)(1), FTC Safeguards Rule

In plain English: Voice cloning is a known risk now, so your security training should cover it.

"business e-mail compromise (BEC)"Fannie Mae Information Security and Business Resiliency Supplement, examples in the definition of Cybersecurity Incident

In plain English: For companies subject to the Supplement, a compromised mailbox used to send fake wire instructions is a Cybersecurity Incident. The same list includes social engineering attempts that successfully compromise company credentials.

If a borrower already sent money

Speed matters. Funds are usually moved out of the receiving account quickly.

Borrower calls their bank right away. Ask the bank to contact the receiving bank and try to stop or recall the wire.
File with the FBI. The borrower files a complaint at ic3.gov. The FBI asks for the date, type of payment, amount, account numbers, the receiving bank's name and address, and how the contact happened.
Tell the settlement agent and your lender. They may need to delay closing and check their own systems.
Check your own accounts. Reset passwords, review sign-ins and mailbox forwarding rules, and keep the logs and messages as evidence. Do not delete anything.
Work through the notice clocks. If your email was compromised, follow your incident plan: Fannie Mae's Supplement requires notice no later than 36 hours after identifying a Cybersecurity Incident for companies subject to it, and the FTC Safeguards Rule requires notice within 30 days for a notification event involving 500 or more consumers. See the AI incident response playbook.
Ask about a suspicious activity report. Non-bank residential mortgage lenders and originators are "loan or finance companies" under FinCEN rules, with reporting duties for suspicious transactions of $5,000 or more conducted or attempted by, at or through the company. Ask your BSA/AML officer or counsel whether this event must be reported. FinCEN asks filers to use the key term "FIN-2024-DEEPFAKEFRAUD" for deepfake-related reports.

Want this in writing for your team? Add the wire rule and the callback rule to your AI policy with the mortgage AI policy template, and check your training topics against Freddie Mac 1302.2.

Train your team on AI fraud and track who finished

The $349 AI Policy Kit adds an incident response one-pager and an annual calendar to the AI policy, approved tools list and staff acknowledgment, and includes 3 months of Small Shop portal access to track sign-offs. The $699 AI Team Kit adds a 25-slide staff training deck with a facilitator guide and a training sign-off log.

Get the AI Policy Kit, $349 AI Policy Starter, $99 AI Team Kit, $699 Compare kits

Frequently asked questions

How do scammers clone a loan officer's voice?

They collect audio from public sources such as social media videos, podcasts and webinars and use AI voice tools to generate speech. CNN reported in September 2026 on a Michigan couple who wired $66,026.92 after a call from a voice that sounded just like their loan officer.

What should I tell borrowers about wire fraud?

Tell them at application and again before closing that you will never change wire instructions by phone, email or text, that they should verify any instructions by calling a number they already have, and agree on a code word for any conversation about moving funds.

What should a borrower do if they wired money to a scammer?

Call their bank immediately to try to stop or recall the wire, file a complaint at ic3.gov with the transaction details, and tell the loan officer and settlement agent. The company should check its own email for compromise and follow its incident plan.

Does Freddie Mac require deepfake training?

Freddie Mac Guide Section 1302.2 says annual information security awareness training should incorporate AI-powered tactics such as deepfakes and targeted phishing content, and threats to AI systems.

Is a compromised mailbox an incident under Fannie Mae's Supplement?

The Supplement lists business e-mail compromise as an example of a Cybersecurity Incident. Companies subject to it must give Fannie Mae notice no later than 36 hours after identifying a Cybersecurity Incident.

AI voice clone wire fraud: a playbook for loan officers