AI Voice-Cloning Scams: How to Verify a Request

To identify AI voice-cloning scams, do not consider a similar voice sufficient proof of identity. If you receive an emergency call apparently from a loved one asking for money, a password or immediate action, end the conversation immediately. Verify the caller’s identity through an independent channel and ask for the family passphrase.

Key points

• A similar voice does not prove identity: even the most natural-sounding voice messages need independent verification.
• Make the call yourself: to check a suspicious message, call the person yourself using a stored number.
• Create a passphrase: a previously agreed, nonpublic phrase can help, but does not replace an independent call; a hacked account may expose it.
• Watch for urgency: an urgent request to transfer money or keep secrets is a serious warning sign.
• Act quickly: if you have sent money, immediately contact your bank through official numbers and ask whether the transaction can be stopped or reversed; the outcome is not guaranteed.

How do AI voice-cloning scams happen?

The FTC’s official warning about impersonating family members’ voices recommends calling a number you already know, not one provided by the caller. This checks whether the request is legitimate, even if you do not know whether AI generated the voice.

Cybercriminals extract voice samples from videos or social media and imitate (clone) people’s voices with high accuracy. They invent distressing scenarios, such as an accident, arrest or lost phone, to put psychological pressure on the victim to send money. This urgency takes away the opportunity to think rationally.

Hearing a familiar voice does not establish that AI is involved; scammers also use human impersonation or hacked accounts. The defense is always the same: check the request and the identity separately.

Can you identify a fake voice message just by listening?

No. Unusual pauses, a monotonous tone or robotic pronunciation can be useful warning signs, but they are not definitive criteria. Deepfake technology is advancing rapidly, and factors such as poor call quality or background noise can also alter a real voice.

To identify a fake voice message, assess the request’s content rather than searching for audio clues:

• Is the caller pressuring you to make an immediate decision?
• Are they asking you to send money to an unfamiliar account?
• Are they insisting that you hide the matter from law enforcement?
• Are they preventing you from hanging up?

The combination of a familiar voice, urgency, secrecy and a financial request is sufficient reason to end the conversation.

How should you verify the sender’s identity when a suspicious message arrives?

Do not reply to the suspicious message. Contact the person through an “independent channel.” This means a trusted way of communicating that you already know, not a number or link supplied by the message’s sender.

Take these practical steps:

1. Do not send money or click any links.
2. End the conversation immediately.
3. Call a number already in your contacts (the number displayed on screen can be spoofed).
4. If the person does not answer, contact other family members.
5. Ask a completely private question or request the family passphrase.

A family passphrase: a barrier against impersonating relatives’ voices

A “family passphrase” is a confidential, previously agreed phrase used to verify identity in suspicious situations. It is an additional layer; it must not be used as a definitive identity test or as a substitute for independent verification.

To create and maintain a secure passphrase:

• Choose a phrase that cannot be derived from social media or public information.
• Preferably agree on it beforehand in a trusted conversation; do not supply the phrase yourself to a caller asking for money.
• Do not publish it. If an attacker has taken control of an account containing the phrase, do not treat a correct answer as sufficient proof of authenticity.
• Change the passphrase immediately if it may have been exposed.

What should you do after sending money or disclosing information?

Time is critical. If you have sent money, immediately contact your bank or payment provider’s support team. Use official numbers printed on the back of your bank card. Whether a payment can be stopped or recovered depends on the payment method and how quickly you act; nobody should promise guaranteed recovery in exchange for an upfront fee.

Keep messages, receipts and transaction IDs as evidence. If you disclosed a password, quickly change your passwords from a secure device, close active sessions and enable two-factor authentication (2FA). Report the incident to the police.

How can you prepare your family against audio-deepfake scams?

Effective prevention requires a simple family agreement before a crisis happens. To counter audio-deepfake scams, establish these family rules:

1. No urgent financial request is approved solely on the basis of hearing a voice.
2. Every sensitive request must be verified with an outgoing call.
3. The family has a passphrase and a previously trusted contact channel.
4. If the person cannot be reached, payment remains on hold.

Frequently asked questions

Can online tools definitively detect an audio deepfake?

No. Detection results are only an additional clue. File compression, background noise and advances in AI tools reduce these programs’ accuracy. For financial decisions, rely only on independent verification.

Is there still a risk of fraud if the call comes from a familiar number?

Yes. Attackers can spoof phone numbers. A familiar number on the display does not guarantee identity; hang up and call the person yourself at a number you already know. Do not rely on an alternative number included in the suspicious message.

Does an encrypted messenger prevent this scam?

No. E2EE can protect the transmission path, but it does not guarantee the sender’s honesty or human identity. A genuine account that has been taken over can also send a fraudulent request. Independent verification of the request is still necessary.

Should you forward a suspicious voice message to other people?

Do not publish it unnecessarily or upload it to an unknown tool for testing. Keep the original file and related information for reporting or review with a trusted person, and share only what is necessary with a trustworthy recipient.