Voice Phishing With AI-Cloned Voices
AI can clone a voice from a short recording, making phone phishing more convincing than ever. How cloned-voice phishing targets businesses and families, and verification that still works.
Voice cloning has given phone phishing a powerful new tool. With a short recording from a video, podcast, conference talk or voicemail, AI can produce new speech in someone's voice. Attackers use it to impersonate executives asking for payments, and relatives asking for help.
At work
A finance employee gets a call from what sounds exactly like the CEO: "I'm finalising a confidential acquisition. I need a transfer sent today, and I can't discuss it on email." The voice is right, the tone is right, the urgency is believable. See deepfake voice call fraud.
Controls that work
- Payments and bank detail changes always confirmed through a separate, known channel.
- Two-person approval for large or unusual payments.
- A culture where staff are praised for checking, even with senior leaders.
- Code phrases or call-back procedures for urgent executive requests.
At home
A call in a child's or parent's voice, in distress, asking for money. See AI voice cloning scams targeting families.
Defences
- Hang up and call the person back on their known number.
- Use a family code word. See family code word.
Recognising a voice is no longer verification. Verify the request through a channel you control.
Signs to watch for
- Unusual urgency and secrecy.
- Requests that bypass normal process.
- Excuses for why you cannot call back.
- Slight oddities in pacing or background noise used to explain them.
Got a message following up an unusual call? Paste it into CyberWatch AI Scan for a free check.
For more, read the complete guide to phishing.
Frequently asked questions
Can a cloned voice fool people who know the speaker?
It can, especially on a short call with background noise and urgency. That is why verification should not rely on recognising a voice.
What do cloned-voice calls usually ask for?
Urgent payments, changes of bank details, sensitive data, or password and access resets.
What is the best defence for businesses?
A firm rule that payments and access changes are confirmed through a separate, known channel and approved by a second person, whoever appears to be asking.
Sources
- Scammers Use Fake Emergencies To Steal Your Money, US Federal Trade Commission
- Phone Scams, US Federal Trade Commission
- Small business guide: cyber security, UK National Cyber Security Centre
