Voice fraud is the channel's problem, but MSPs can solve It

Voice remains one of the most effective channels for customer relationships. For customers, having access to a human on the other end of the line, especially in times of confusion or crisis, is increasingly important in an era driven by automation and AI adoption.

This is exactly why so many Managed Service Providers (MSPs) are involved in running or supporting contact center infrastructure on behalf of their customers. However, despite the rewards, it naturally doesn’t come without some risks.

In April 2026, the UK government published the findings of its 2025/26 Cyber Security Breaches Survey, which highlighted some sobering statistics. According to the data, nearly half of all UK businesses (43%) experienced a cyber security breach or attack in the past year.

Phishing remained the dominant attack vector, cited by 38% of businesses, and rated as the most disruptive incident type by 69% of those affected. However, of those phishing incidents, a growing share is no longer delivered by email. Rather, they’re arriving by phone call, and thanks to AI, they are increasingly convincing.

The evolving threat

Voice phishing, or “vishing”, is not a new phenomenon. Bad actors and criminals have been spoofing voices and using fraudulent calls since the popularization of the telephone. What is new are the features that make voice phishing more convincing.

The proliferation of AI-generated voice deepfaking, caller ID spoofing tools, and lack of traceability have contributed to a new wave of fraudulent calls that appear more real than ever before.

Many organizations have spent significant resources securing their email environments, including spam filters, user training, and sandboxing. While this is a sensible investment, fraudsters have noticed and are adapting, which may explain why voice phishing has become an increasingly favored tactic for some bad actors.

Why voice is being targeted

The basic mechanics of voice phishing have always relied on social engineering. Impersonating a trusted person and creating a sense of urgency help to manipulate victims into taking a malicious action, whether that be authorizing a payment, sharing credentials, or granting undue access to a system. While traditionally a mismatched voice was a potential giveaway to fraud, AI deepfakes have made this process much more convincing.

Voice cloning tools that once required real technical knowledge can now be replicated by most people with a commercial PC. It’s now easier than ever to create a convincing replica of a known voice from a short audio sample, for example, from a CEO's recorded video message, a support call that was unknowingly captured, or a social media clip.

If a cloned voice calls a finance team member and asks them to process an urgent payment, citing relevant details such as a live deal, a regulatory deadline, or a supplier relationship, very few red flags are present for the human on the receiving end of the call.

Number spoofing compounds the issue. Fraudsters may be able to secure the capability to present any caller ID they choose, making a call appear to originate from a trusted source. The result of mixing emerging tech with good due diligence is a call that looks and sounds real.

MSPs can carry disproportionate risk

MSPs that support or run contact center infrastructure are in the middle of communications flows for multiple organizations and partners simultaneously. Critically, this also makes them the first port of call for customers when something technical goes wrong, which can offer an easy alibi for fraudsters looking to exploit them.

There are two distinct risks for MSPs: one operational, one reputational. The operational risk is straightforward: IT help desks control credentials, systems, and sensitive customer data, making them a target for malicious actors. The reputational risk, however, has a wider-reaching impact. If a customer is defrauded through infrastructure managed by an MSP, customers may find the MSP liable. Even if the MSP bears no technical responsibility, they are the supplier in the middle.

There is also a less visible third risk: the channel as a route of compromise. Fraudsters who have already gained access, whether through an earlier breach, open-source intelligence, or a compromised supplier, will probe the path that offers the least resistance. If an MSP's call handling has not been safeguarded with fraud in mind, that becomes the path of least resistance.

Practical steps to take right now

The tools to address this problem exist today, but gaps remain in general adoption and awareness. Firstly, MSPs should be implementing proper caller authentication where it is available. For example, in some markets, protocols exist to authenticate calls before they’re answered, such as the “STIR/SHAKEN” protocols used in the USA. These act as a digital "passport" for telephone calls, ensuring the number a call handler sees on their caller ID is legitimate and matches the actual person or business calling. These act as a strong defense against number spoofing.

Next, establish comprehensive verification workflows. Agents should never rely on voice recognition alone. Callbacks to verified numbers, challenge questions, and two-factor authentication must be embedded as standard security procedures. Call handlers must verify who is requesting sensitive information and challenge even those who appear familiar.

Additionally, staff should be trained to recognize the specific warning signs of voice phishing. Most security training currently focuses on email. Staff need scenario-based training covering AI-generated voice hallmarks, such as unnatural pauses and scripted rigidity, alongside classic social engineering tactics: creating a sense of urgency and requesting to bypass usual processes.

Finally, participate in industry data-sharing. No single provider sees the full picture. In the UK, mechanisms like the Home Office's Telecoms Fraud Sector Charter seek to improve cross-sector visibility of active campaigns. MSPs engaged in these networks get earlier warnings to ensure they’re not operating with only a partial view.

Voice is a channel worth championing

Voice is a communication channel with many strengths, and the human touch can be the differentiator between satisfied and dissatisfied customers. For so many reasons, it’s a critical channel that’s worth championing, and worth safeguarding.

Voice fraud is the channel's problem. But the channel is very well placed to address it.

Steps such as appropriate due diligence through the supply chain, monitoring for suspicious traffic patterns, and validating caller IDs used by customers are all effective. It’s also crucial that MSPs and contact centers take the appropriate steps now to ensure that criminals can’t get in and customers remain confident.