AI voice cloning scams: what to do when the voice sounds real

It's your daughter, or your son, or your mother. The connection is poor and they're crying. There's been an accident, or an arrest, or a hospital. They need money now, or a code from your phone now, and please don't tell anyone else yet.

Everything about that call is built to stop you thinking. It exploits a normal impulse: helping someone you love quickly when they appear to be in danger.

Voice cloning software copies how a specific person sounds from a recording of them speaking, then reads whatever the operator types in that voice. The FTC's guidance on family emergency schemes says a scammer needs a short audio clip of your relative, which can come from content posted online.

That source audio may come from a public video, a social post, or another recording posted online. This does not mean everybody with audio online is about to be impersonated. It means a familiar voice is no longer enough to authenticate a caller.

This is the part worth remembering. It is deliberately short, because a procedure you can't recall while your hands are shaking is decoration.

The FBI's December 2024 advisory on criminal use of generative AI tells people plainly to create a secret word or phrase with their family to verify identity. It's good advice and it takes one conversation.

A useful phrase is easy for your household to remember and not easily guessed from public information. Keep it private. Do not reuse a banking password, a PIN, or information from a security answer. Do not put it on a visible refrigerator card or print it on the Household Action Card. A written household plan can say to ask for the family verification phrase without recording the phrase itself.

And treat it as one check rather than the whole system. A frightened person forgets to ask. Hanging up and calling back does not depend on your memory working correctly at the worst moment of your week, which is the only reason it's the rule and the phrase is the extra.

FTC and FBI guidance describe the same handful of behaviours over and over. They're signs to slow down, not a test of whether audio is synthetic. A genuinely distressed relative will also sound urgent, may also want money, and will be fine with you calling them back.

You'll be told to listen for robotic pauses, odd breathing, strange word choice, audio glitches, a flat tone. The FBI's own advice does mention listening to tone and word choice, and early clones were often clumsy.

The trouble is the direction of the error. Hearing a glitch might tell you something is wrong. Hearing no glitch tells you nothing at all, and that's the half people rely on. If your safety procedure depends on noticing that the voice is fake, it stops working the week the software gets better, and the software has been getting better the whole time you've been reading this.

So don't grade the audio. Authenticate the person. That's a task you can still do reliably with a phone and a number you already had.

They often do. A name, a school, where someone works, who they're dating, that the family is travelling this week. The FTC notes that scammers may already know quite a lot about you, from social media, from a hacked account, or from guessing well.

Knowing true things about your family is not identification. It never was; it just used to be rarer. Nothing in the paragraph above changes the procedure, which is the useful property of having a procedure.

Move quickly and don't spend the first hour on embarrassment. Contact the bank, card issuer, payment app, wire service, gift-card issuer, or cryptocurrency provider you used immediately. Tell them it was a fraudulent transaction and ask whether it can be stopped, reversed, or refunded. For gift cards, have the card numbers and receipt ready. If you gave out a password or authentication code, secure the affected account immediately: change the password, then check its active sessions and recovery details.

Then report it. Consumer fraud goes to the FTC at reportfraud.ftc.gov; the FBI takes internet crime complaints at ic3.gov, and its guidance asks for names, numbers, addresses, and the transaction details. Reporting is worth doing even when recovery isn't likely — and it often isn't. Money sent by wire, gift card, or cryptocurrency is frequently gone. Nobody should promise you otherwise.

Everything above collapses into one short conversation with the people you live with, and with whichever relative is most likely to get the call. Agree that an urgent request for money gets verified independently, every time, with no offence taken. Agree which number each person calls back on. Agree who to try if that person doesn't answer. Pick a phrase if you want one, and don't write it anywhere obvious.

That's it. One decision made while nothing is happening, which is the only time anybody makes a decision well.

A familiar voice has become a single point of failure that few households had listed. Most households have several others: one phone that holds every number, one payment method, one person who knows the plan.