Three seconds of your voice is enough. We checked 24 Orlando businesses.

It takes about three seconds of your recorded voice to make a convincing copy of it. Not a lab. Not a movie studio. Three seconds, pulled from a video on your own website or your Facebook page. Then someone calls your bookkeeper, sounding exactly like you, and asks them to pay an invoice today.

That is not a prediction. In 2026, roughly 40% of business email compromise attacks include AI-generated voice or video, up from under 5% in 2023. The FBI logged more than 22,000 AI-related fraud complaints in a single year, with losses above 893 million dollars.

But the voice is only the hook. The money almost always moves by email. So we went and measured the thing that actually stops it.

We checked 24 Orlando businesses. 21 can be impersonated today.

We took 24 real Orlando businesses, auto shops, plumbers, restaurants, pawn shops, barbers, and asked one question of each: if a stranger sent an email today pretending to be this company, would anything stop it?

The answer is published in public DNS records. Anyone can look it up in seconds, including whoever is targeting you.

And here is the part that stopped us. All three protected businesses are national chains. A barbershop franchise, a restaurant group, a chain with a corporate IT department. Not one independent Orlando business in our sample had it set up.

What we actually looked at

Two settings live in your domain’s public records. Neither costs money. Most businesses have never heard of either.

Look at those last two rows again. Eight businesses had DMARC. Only three had it switched on.

The other five have it set to p=none, which means “notice the forgery and deliver it anyway”. It is the smoke alarm with the battery taken out. Somebody set it up, saw it working, and never took the last step.

SPF and DMARC, without the jargon

SPF is a list of who is allowed to send email using your name. Your own mail provider, your invoicing software, your booking system. Anyone not on the list is an impostor.

DMARC is the instruction for what to do about impostors. It has three settings:

• none lets the fake through and files a report nobody reads
• quarantine sends it to spam
• reject refuses it at the door, so it never reaches anyone

Having SPF without DMARC is like having a guest list and no doorman. The list exists. Nobody is checking it.

Check your own business in two minutes

You do not need us for this, and you should not take our word for it.

1. Go to mxtoolbox.com/dmarc.aspx
2. Type your domain, the part after the @ in your email address
3. Read the result

If it says no DMARC record found, anyone can send email as you today. If it shows p=none, you have the alarm installed and switched off. If it shows quarantine or reject, you are in the small group that is actually covered.

What to fix, in order

First, the phone call rule. This one is free and it beats every technical control on this page. Any request to change bank details, or to pay something urgently, gets verified by calling the person back on the number you already had. Not the number in the email. Not the number the caller gives you. The one in your own records.

A cloned voice cannot survive a callback to a number the scammer does not control. Write the rule down, tell whoever handles your money, and make it boring and normal rather than an insult.

Second, turn on SPF and DMARC. Start DMARC at p=none for two weeks so you can see what is sending mail as you, then move it to quarantine. Skipping straight to reject can bounce your own invoices if something legitimate was never on the list.

Third, turn on two-factor authentication for email. Most invoice fraud starts with someone quietly reading a real mailbox for weeks, learning who pays what, and then stepping in at the right moment with the right invoice number.

Fourth, think about what is public. You do not need to delete your videos. Just know that the voice in them is a sample, and act accordingly when that voice calls in a hurry.

The honest summary

The technology got cheap. A convincing fake of your voice costs a scammer nothing and takes a few seconds of audio you published yourself.

What has not changed is that the money still moves through a process, and processes can be made resistant. A callback rule and a correctly configured domain turn a convincing impersonation into a failed one.

Twenty-one of the twenty-four businesses we checked are one convincing phone call away from paying the wrong bank account. Two minutes on a free checking tool tells you which group you are in.