Your phone rings. It’s your daughter, and she’s crying. She says she’s been in an accident, she’s scared, and she needs money right now. It sounds exactly like her. The little catch in her voice, the way she says “Mom,” all of it.
Except it isn’t her. It’s software, trained on a short clip of her voice pulled from a public video, and the person controlling it is a stranger who wants your money.
This is no longer a far-fetched scenario. Voice cloning and deepfake video have become cheap, fast, and easy enough that ordinary criminals now use them, not just well-funded ones. The good news is that these scams still have weaknesses. They depend on panic, secrecy, and speed, and you can break all three with a few habits. This guide covers how the scams work, what to look and listen for, and the specific steps that stop them, whether you’re protecting yourself, your parents, or a company.
What AI voice cloning and deepfakes actually are
A voice clone is a synthetic copy of someone’s voice, generated by software that has learned the patterns of how they speak. Modern tools can produce a convincing imitation from a short sample, sometimes only a few seconds of clear audio. A deepfake is the visual version: AI-generated or AI-altered video or images that make a person appear to say or do something they never did. Some scams use only a cloned voice, some use only fake video, and the more sophisticated ones combine both on a live video call.
None of this technology is inherently criminal. Voice cloning is used for accessibility tools, audiobook narration, and film production. The problem is that the same tools are available to anyone, and scammers have figured out that a familiar voice or face bypasses the skepticism most of us apply to a random email or text.
That’s the real shift. For years, the standard advice was “don’t trust unknown callers.” Now the caller can sound like someone you know and love.
Why these scams work so well
Understanding the psychology matters more than understanding the technology, because the technology keeps changing and the psychology doesn’t.
Scammers aren’t relying on the clone being flawless. They’re relying on you not having time to notice flaws. A cloned voice on a crackly phone line, delivered in the middle of what sounds like an emergency, doesn’t need to be perfect. Fear narrows attention. When you think someone you love is in danger, your brain isn’t running a forensic audio analysis. It’s trying to help.
Scammers also build in pressure on purpose. Nearly every one of these scams includes some version of “act now,” “don’t tell anyone,” or “there’s no time to explain.” Those aren’t incidental details. They exist to stop you from doing the one thing that would expose the fraud: pausing to verify.
A few real cases show how far this has gone. In 2019, criminals reportedly used an AI-generated voice imitating a parent company’s chief executive to convince the head of a UK energy firm to transfer roughly €220,000. In early 2024, police in Hong Kong said an employee at the engineering firm Arup was tricked into sending around US$25 million after joining a video call where the “colleagues” and the “chief financial officer” were all deepfakes. And in 2023, a mother in Arizona testified to the U.S. Senate about receiving a call in which she believed she heard her teenage daughter sobbing and a man demanding ransom. Her daughter was safe the whole time.
Targets of attempts have also included high-profile executives and government officials, which tells you something: if a scam is worth trying on people who have security teams, it’s certainly being tried on everyone else.
The most common AI voice-clone and deepfake scams
Knowing the common scripts helps, because most attacks follow a few well-worn patterns.
The family emergency call
This is the one that gets the most attention, and for good reason. A parent or grandparent gets a call from a “child” or “grandchild” who’s in trouble. They’ve been arrested, hurt in a crash, or kidnapped. Sometimes the cloned voice only says a few panicked words before a second person takes over, posing as a lawyer, police officer, or kidnapper, and tells you how to send money. The payment method is almost always something hard to reverse: wire transfer, cryptocurrency, gift cards, or a courier who comes to your door to collect cash.
The clone often speaks briefly and emotionally because short, distressed audio hides imperfections. The “handoff” to another person is also deliberate. It keeps the fake voice from having to hold up under real conversation.
The boss or executive request
In a workplace version, an employee, often in finance or accounts payable, gets a call, voice message, or video meeting from someone who sounds like a senior leader. The request is urgent and confidential: pay this vendor today, buy these gift cards, change this bank account, don’t loop in anyone else. This is a more advanced take on what security teams call business email compromise, and the voice or face is meant to override the instinct to follow normal approval procedures.
The fake video call
The Arup case shows where this is heading. Instead of a single cloned voice, the scammers stage an entire meeting with several fake participants. The target sees familiar faces, hears familiar voices, and feels reassured by the crowd. Seeing multiple “colleagues” agree makes the request feel legitimate.
The romance or investment deepfake
Fraudsters running romance scams and fake investment schemes now use AI-generated faces, face-swapping software, and cloned voices to get through the “let’s do a video call” test that used to expose them. A person who has spent weeks chatting with someone online may finally get a video call and feel their doubts dissolve, even though the face on screen is being manipulated in real time. Deepfaked celebrity endorsements are also common, with fake videos of well-known public figures promoting crypto platforms or “guaranteed return” investments.
The bank or account-recovery call
Some scammers clone a voice to get past voice-based verification at a bank or call center, or to impersonate a customer who’s “locked out.” Others do the reverse and impersonate the bank’s fraud department, calling you in a calm, professional tone and walking you through “securing” your account, which really means moving your money to theirs.
The impersonation of officials
Cloned voices and messages mimicking government officials have been used to contact other officials, diplomats, and businesspeople. For ordinary people, the more relevant version is the fake call from “the IRS,” “your local sheriff’s office,” or a court clerk, now with a more convincing voice behind the same old threats.
How to spot a cloned voice
There’s no single giveaway, and anyone who tells you there is would be overselling it. Voice cloning improves constantly, and the flaws that were obvious a couple of years ago are fading. Still, you can often catch signs, especially when you know what to listen for.
Unnatural rhythm and pacing. Real people speed up, trail off, stumble, and restart sentences. Cloned speech can sound a bit too smooth or oddly even, with pauses in strange places. It may also lack the small, wandering filler a person produces when they’re thinking.
Flat or mismatched emotion. Pay attention to whether the feeling in the voice matches the words. A “terrified” voice that stays oddly steady, or crying that sounds repetitive and loops, can be a sign. Some clones handle one emotional register well and fall apart when the emotion needs to shift.
Odd breathing, or none at all. People inhale between phrases, and those breaths are part of how we recognize a living speaker. Missing, repeated, or mistimed breaths can be a clue.
Strange pronunciation or accent drift. A clone might mispronounce a name you’d expect them to know, slip into a slightly different accent, or stress words the way the real person never would.
Background noise that doesn’t fit. Some scammers add siren sounds, crowd noise, or static to disguise artifacts and make a scene feel real. If the background seems generic, looped, or conveniently loud, take note.
Delays and awkward turn-taking. Real-time voice conversion can create small lags between your question and the answer. If the person responds a beat late, or talks over you in a way that feels off, pay attention.
Refusal to go off script. This is one of the most reliable tells, and it’s behavioral rather than acoustic. A clone-driven call tends to fall apart when you ask something unexpected. More on that in the verification section below.
One honest caveat: a clean-sounding call proves nothing. Don’t treat the absence of these glitches as proof that a voice is real. Your ears are a weak defense compared to process, which is why the later sections focus on what to do rather than what to hear.
How to spot a deepfake video
Video deepfakes leave visual traces, though live, real-time ones are harder to catch than pre-recorded fakes because the software has to work fast. If you’re on a video call or watching a clip and something feels off, look closely at these areas.
The face edges and hairline. Face-swap tools often struggle where the face meets hair, ears, and neck. Look for blurring, shimmering, or a faint boundary that shifts when the person moves.
Eyes and blinking. Early deepfakes blinked too little or oddly. Current ones are better, but gaze can still look slightly unfocused, or the eyes might not track naturally when the head turns.
Lip sync. Watch whether mouth movements match the sounds, especially on hard consonants like “b,” “p,” and “m.” Subtle mismatches, or a mouth that moves a little too loosely, can give it away.
Lighting and shadows. Check whether the light on the face matches the room. A face lit from the left while the background suggests a window on the right is a red flag. Shadows under the nose or chin that don’t shift properly when the head moves are worth noticing too.
Teeth, tongue, and inside the mouth. AI often renders the inside of the mouth poorly. Teeth may look blurry or blend together, and the tongue can appear oddly shaped.
Hands and accessories. If the person’s hand passes in front of their face, or they adjust glasses, touch their hair, or hold up an object, the effect can glitch or break. Glasses frames that warp or disappear, and earrings that flicker, are common artifacts.
Skin texture. Fake faces can look unusually smooth or waxy, or the texture may differ between the face and neck.
If you suspect a live video call is fake, you can ask the person to do something the software may not handle well. Ask them to turn their head fully to the side, wave a hand slowly in front of their face, or pick up a nearby object and hold it close to the camera. Real-time face-swap tools often glitch under those conditions. It isn’t foolproof, and a good fake may pass, but a visible breakdown is a strong warning.
Don’t rely on this alone, though. The Hong Kong employee reportedly saw nothing that triggered suspicion. If the request is high-stakes, verify through a separate channel regardless of how real the video looks.
The behavioral red flags that matter most
Because the technical tells keep shrinking, the most dependable signs are in what the person asks you to do. Treat any of these as a stop sign, however real they sound or look.
Urgency with a deadline. “I need it in the next 30 minutes.” “The offer disappears today.” “They’ll hold me until you pay.” Genuine emergencies are real, but real emergencies can survive a two-minute verification.
Secrecy. “Don’t tell Mom.” “Keep this between us.” “Don’t call the bank, they’ll freeze everything.” Scammers isolate you because other people are the ones who’d spot the fraud.
Unusual payment methods. Gift cards, cryptocurrency, wire transfers to unfamiliar accounts, peer-to-peer payment apps, or cash handed to a courier. Legitimate courts, police, banks, and employers don’t demand these.
A request that breaks normal procedure. If your boss suddenly asks you to skip approvals, use a new bank account, or send funds outside the usual process, that deviation is the warning, no matter how authentic the voice.
A new number or channel. “I lost my phone, this is my new number.” “I’m calling from a friend’s phone.” “Message me on this other app.” Contact from an unfamiliar number claiming to be someone you know deserves extra caution.
Emotional manipulation. Crying, threats, guilt, flattery, or romantic pressure. Scammers want your feelings running faster than your judgment.
Reluctance to be verified. If someone gets angry, evasive, or tries to rush you off the line when you suggest calling them back, that reaction tells you a lot.
What to do the moment you get a suspicious call
Here’s the part that matters most. These steps work even if the clone is perfect, because they don’t depend on detecting anything.
1. Slow down on purpose
Say it out loud if you have to: “I’m going to hang up and call you right back.” You’re allowed to do that. A real person in real trouble will understand. A scammer will push back, because the whole operation depends on keeping you on the line.
2. Hang up and call back on a number you already trust
Don’t use the number that just called, and don’t use a number the caller gives you. Call the person directly using the contact saved in your phone, or reach them through another family member or friend. For a company or bank, use the number printed on your card, your statement, or the official website you typed in yourself. Caller ID can be spoofed, so a familiar name or number on the screen proves nothing.
3. Ask a question only the real person could answer
Skip anything that could be found online, like a pet’s name or a hometown, since scammers can scrape social media. Ask about something private and specific: what you ate at a particular dinner, a joke only the two of you share, the name of a childhood stuffed animal. Reportedly, an executive at Ferrari foiled a deepfake attempt in 2024 by asking the “caller” the title of a book he’d recently recommended. The impersonator couldn’t answer and hung up. That’s exactly the kind of question that works.
4. Use a family safe word
This is the simplest and most effective defense, and it costs nothing. Agree on a word or phrase with your close family, something random and not guessable from social media. It should be a real surprise word, not a birthday or a pet’s name. Tell everyone that if anyone ever calls in distress asking for money, they must say the safe word, and if they can’t, you hang up and verify another way. Remind older relatives especially, and practice it once so it doesn’t feel awkward when it matters.
The same idea works at work. Some teams set a verbal passphrase for approving sensitive payments or password resets, so a voice alone is never enough.
5. Contact someone else while the caller is “on hold”
If the scenario involves a family member in trouble, try reaching them directly on another line, or text someone nearby. If a stranger claims your child is in custody, call the police department yourself using a number you look up independently. Ask a second person to help while you keep the caller waiting.
6. Refuse to pay in the ways scammers prefer
If anyone demands gift cards, crypto, wire transfers, or cash through a courier, treat it as fraud. There are very few legitimate situations where that’s how a real institution gets paid.
7. Trust discomfort over politeness
Many victims say afterward that something felt wrong but they didn’t want to be rude or risk being wrong about a loved one in need. A few minutes of verification costs you almost nothing if it’s real, and saves you everything if it isn’t.
How to protect yourself before anyone calls
You can’t erase your voice from the internet, but you can make yourself a harder and less attractive target.
Be thoughtful about public audio and video. Scammers often get voice samples from social media videos, podcasts, voicemail greetings, and conference recordings. You don’t need to disappear online, but consider tightening privacy settings on personal accounts, limiting who can see videos of you and your kids, and avoiding posting long clips of your voice when it isn’t necessary.
Use a generic voicemail greeting. A default automated greeting gives scammers nothing to work with, while your own recorded voice does.
Don’t engage with unknown callers more than needed. Some experts advise against saying “yes” or going through long conversations with robocalls and unknown numbers. It’s unclear how often a brief recording is enough to build a usable clone, but there’s no benefit to feeding the system extra audio.
Lock down account recovery. Turn on multi-factor authentication for email, banking, and social accounts, and where possible use an authenticator app or hardware key rather than SMS codes. If your bank offers voice authentication, ask whether you can disable it or add another layer, since voice alone is no longer a dependable proof of identity.
Set up alerts and limits. Many banks let you set transfer limits, require extra confirmation for new payees, or get instant alerts on large transactions. A delay built into the system can give you the time a scammer is trying to steal.
Talk about it at home. Walk older relatives through the scenario in plain language. Many grandparents who would never fall for an email scam will react to a grandchild’s voice. Telling them that a voice can now be faked, and giving them one simple rule to follow, may be the most protective thing you do all year. Be gentle about it. People who’ve been scammed often feel ashamed, and shame keeps them from asking for help.
Be skeptical of too-good-to-be-true videos. A celebrity promoting a guaranteed-return investment, a public figure saying something wildly out of character, or a video designed to make you angry or afraid deserves a second look. Check whether reputable news outlets are reporting the same thing, and look for the original source rather than a clip shared in a feed.
What businesses and teams should do
If you run a company or manage a team, a convincing voice or face can’t be the only thing standing between a request and a transfer of funds. A few controls make a big difference.
Require out-of-band verification for sensitive requests. Any request involving money movement, banking detail changes, credential resets, or sensitive data should be confirmed through a separate, pre-agreed channel. If the request came by phone, confirm through a known internal number or secure messaging platform.
Use dual approval for large payments. No single employee should be able to authorize a major transfer on the strength of one call or meeting. The Arup case is a reminder that even a video call with multiple apparent colleagues can be staged.
Create an internal passphrase system for high-risk approvals. It doesn’t need to be complicated. It just needs to be something an impersonator wouldn’t know.
Train people with realistic scenarios. Include voice and video impersonation in security awareness training, and make clear that employees will never be punished for pausing to verify a request, even one that appears to come from the CEO. Culture matters here. People comply with urgent-sounding bosses because they fear the consequences of delay, so leadership needs to say plainly that verification is expected.
Limit what executives share publicly. Leaders with extensive public video and audio are easier to clone. That doesn’t mean they should go silent, but it does mean their teams should assume a convincing impersonation is possible.
Have an incident plan. Know in advance who to contact at your bank, your IT or security team, and law enforcement if a fraudulent transfer happens. Speed matters a great deal when trying to recall funds.
What to do if you think you’ve been scammed
If you’ve already sent money or shared information, act quickly and don’t let embarrassment slow you down. These scams are sophisticated, and victims include smart, careful people.
- Contact your bank or payment provider immediately. Ask them to stop or recall the transfer, flag the account, and tell you what else you should do. The sooner you call, the better your chances of recovering funds, especially with wire transfers.
- Secure your accounts. If you shared passwords, codes, or personal details, change your passwords, enable multi-factor authentication, and watch for suspicious activity. Consider placing a fraud alert or credit freeze if identity details were exposed.
- Keep evidence. Save phone numbers, call logs, messages, screenshots, payment receipts, wallet addresses, and anything else related to the incident.
- Report it. In the United States, you can report fraud to the FTC at ReportFraud.ftc.gov and to the FBI’s Internet Crime Complaint Center at ic3.gov. If you’re elsewhere, contact your national consumer protection or cybercrime agency and local police. Reports help investigators spot patterns, and in some cases they help recover money.
- Warn the people involved. If the scammer impersonated a relative or coworker, let that person know so they can secure their accounts and warn others. If your own voice might have been cloned, tell the people close to you.
- Get support if you need it. Being deceived by a voice you trusted can feel deeply unsettling. Talk to someone you trust, and don’t let the experience convince you it was your fault. The whole point of these tools is to defeat ordinary good judgment.
Frequently asked questions
How much audio does a scammer need to clone a voice?
It depends on the tool, but some current systems can produce a recognizable imitation from a very short sample. Longer and cleaner recordings generally give better results. That’s why public videos, podcasts, and voicemail greetings are common sources.
Can I tell a cloned voice just by listening?
Sometimes, but not reliably. Unnatural pacing, flat emotion, odd breathing, and a refusal to answer unexpected questions can be clues, but good clones can pass casual listening, especially over a poor phone connection. Verification beats detection.
Are there tools that detect deepfakes automatically?
Detection tools exist, and some platforms and security vendors are building them into their products. But they aren’t perfect, and the technology keeps shifting. Treat any detector as one input rather than a final verdict, and don’t skip verification because a tool says something looks fine.
Is a video call proof that someone is real?
No. Real-time face-swapping and AI-generated participants have already been used in major frauds. For anything involving money or sensitive information, verify through a separate trusted channel no matter what you see on screen.
What if the caller knows personal details about me?
That doesn’t prove they’re real. Scammers gather names, relationships, travel plans, and workplace details from social media, data breaches, and public records. Knowing facts about you is not the same as being who they claim to be.
What’s the single best thing I can do today?
Set up a family safe word, and make a habit of hanging up and calling back on a number you already trust. Those two steps defeat most voice-clone scams, even convincing ones.
Conclusion
AI voice cloning and deepfakes have changed what “I recognized their voice” is worth. It used to be strong evidence. Now it’s just a feeling, and scammers are betting you’ll act on it before you stop to think.
You don’t have to become an audio analyst or a deepfake expert. You need a few habits that hold up no matter how good the technology gets: pause when someone pushes urgency, verify through a channel you control, ask a question only the real person could answer, agree on a safe word with the people you love, and refuse unusual payment demands, no matter whose voice is asking.
Share this with your parents, your kids, and the person at your company who approves invoices. A five-minute conversation now is far easier than a phone call you’ll regret later.
One thought on “How to Spot AI Voice-Clone and Deepfake Scams – Before They Cost You Money”