AI voice clone scams: how they work and how to protect your family

How little of my voice does a scammer need?

Very little. Microsoft researchers have shown a system called VALL-E that could imitate a speaker it had never heard before from "a 3-second enrolled recording", according to the project page. OpenAI said in March 2024 that its own Voice Engine needs "a single 15-second audio sample". Neither company had opened those tools to the public as of March 2025, The Register noted, but other companies sell voice cloning to anyone with an email address.

The idea is simpler than it sounds. A voice model is first trained on tens of thousands of hours of recorded speech (Microsoft says VALL-E used 60,000 hours of English) until it learns how human voices work in general. After that, it needs only a short sample of you to pick up your pitch, accent and rhythm. Then it can say any sentence a scammer types, in your voice.

Where does the sample come from? Usually from you. Starling Bank warned in 2024 that criminals can take a few seconds of audio "from a video posted online or on social media". A birthday video, a voicemail greeting or a short clip on TikTok is enough.

Safeguards at the companies selling these tools are thin. In a March 2025 investigation reported by The Register, Consumer Reports looked at six voice-cloning services and found that four of them (ElevenLabs, Speechify, PlayHT and Lovo) asked users only to tick a box saying they had the right to clone the voice.

What do the scams actually look like?

A cloned voice is a type of deepfake: fake audio made with generative AI. It gets used in three main ways.

The family emergency call. This is the old "grandparent scam" with a new engine. A relative's voice, crying or panicking, says they have crashed the car or been arrested and need money now. Then a second person, posing as a lawyer or police officer, takes over to arrange payment. The US Federal Trade Commission says scammers only need "a short audio clip" of your family member's voice, often taken from content posted online.

In July 2025, FOX 13 in Tampa reported that Sharon Brightwell of Dover, Florida, handed $15,000 in cash to a "courier" after a call from what sounded like her daughter, saying she had hit a pregnant woman while texting. "There was nothing that could have convinced me that that was not my daughter's voice that day," she told the station. Local investigators had not confirmed that AI was used.

The fake boss. Here the target is someone who can move company money. In early 2024, a finance employee at the engineering firm Arup in Hong Kong made 15 transfers worth about US$25 million after a video call with what appeared to be the company's chief financial officer and other colleagues, CNN reported. All of them were fakes. Arup confirmed that "fake voices and images were used."

Politicians' voices are used too. In February 2025, Reuters reported (via StratNews Global) that scammers cloned the voice of Italy's defence minister, Guido Crosetto, to call leading Italian business figures. One of them, former Inter Milan owner Massimo Moratti, is believed to have sent nearly €1 million before police froze the money in a Dutch account. In May 2025 the FBI warned that criminals had been sending AI-generated voice messages impersonating senior US officials since April that year.

Getting past the bank. Some banks let you log in by phone with your voice. In 2023, a Motherboard reporter, Joseph Cox, used a clone of his own voice, plus his date of birth, to get into his Lloyds Bank account by phone, IT Brew reported. Lloyds said voice ID is optional and is one part of a layered set of security checks. Two years later, at a Federal Reserve conference in July 2025, OpenAI's chief executive Sam Altman said it was "a crazy thing to still be doing", Fortune reported, because "AI has fully defeated that."

How common is this?

Hard numbers are patchy, because most victims don't know whether the voice was cloned. The best official figure comes from the FBI's Internet Crime Complaint Center (IC3). For 2025 it logged 22,364 complaints involving AI, with losses of nearly $893 million, according to Homeland Security Today's report on the FBI's annual figures. AARP reports that people aged 60 and over lost $352 million of that.

In the UK, a survey of 3,010 adults run for Starling Bank in August 2024 found that 28% said they had been targeted by an AI voice cloning scam in the past year, and 46% had never heard of this kind of scam. That is people's own impression, not a count of proven cases.

In Europe, Europol's 2026 threat assessment describes "AI-assisted impersonation (e.g. of bank helpdesk or law enforcement personnel)" as one way fraud networks now target people at scale, but it doesn't give a figure for voice cloning.

What does the law say?

There is no single law against cloning a voice, but several rules bite.

• United States, phone calls. On 8 February 2024, the Federal Communications Commission ruled that AI-generated voices count as "artificial" under the Telephone Consumer Protection Act, which makes robocalls using them illegal without consent, Nextgov reported. The ruling followed fake calls in the voice of President Biden before the New Hampshire primary.
• United States, impersonation. The FTC's rule against impersonating government agencies and businesses was finalised in February 2024. At the same time, the FTC proposed extending it to the impersonation of individuals, citing voice cloning, and asked whether companies that knowingly supply tools for it should also be liable.
• European Union. Under Article 50 of the EU AI Act, companies that make AI systems producing synthetic audio must mark the output in a machine-readable way so it can be detected as AI-made, and people who publish deepfakes must disclose them. According to law firm Garrigues, these duties apply from 2 August 2026, with a transition until 2 December 2026 for systems already on the market. Our guide to the EU AI Act explains the wider law.

None of this stops a criminal who doesn't care about the law. Labels and watermarks help honest platforms, but a scam call won't carry one. Detection tools are still unreliable; our guide to spotting AI-generated content covers why checking the source beats listening for glitches.

How do I protect my family?

The good news is that the defences are cheap and mostly old-fashioned. They work because they don't depend on hearing the difference.

1. Agree a safe word. The FBI recommends creating "a secret word or phrase with your family" to verify identities. Pick something that isn't on social media, agree it in person, and never share it by text or email. If a caller can't give it, treat the call as a scam. Starling suggests the same and says setting one up "would only take a few minutes".
2. Hang up and call back. The FTC's advice is "Don't trust the voice." End the call and ring the person on a number you already know. If you can't reach them, try another relative or friend. A real emergency survives a two-minute delay.
3. Watch for the payment method. Requests to wire money, send cryptocurrency or read out gift card numbers are classic warning signs, the FTC says, because the money is hard to recover. A courier coming to collect cash is another.
4. Share less of your voice. The FBI suggests limiting public content of your voice and image and making social accounts private. A voicemail greeting doesn't need to be in your own voice.
5. Check your bank settings. Ask your bank whether you are enrolled in voice ID for phone banking, and switch it off if you can in favour of another check. OpenAI itself has called for "phasing out voice based authentication" for bank accounts.
6. Set up a work rule. If you handle payments at work, agree that no transfer goes through on the strength of a call or video alone. Confirm on a second channel you already trust. Our AI at work guide has more on this.

Talk this through with older relatives in particular. They are the most common target of the family emergency call, and a safe word is far easier to agree over Sunday lunch than in the middle of a panicked call.

What if it has already happened?

Act fast, because the first hours matter for getting money back.

• Call your bank on the number on your card, not a number the caller gave you. In the UK you can dial 159, which Stop Scams UK says connects customers of more than 99% of UK current accounts to their bank and can't be spoofed.
• Report it. In the US, report to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov. In the UK, Report Fraud replaced Action Fraud in December 2025; its site is reportfraud.police.uk and the phone line is 0300 123 2040. In the EU, report it to your national police.
• Warn the person who was impersonated, so they can alert friends and family who may get the same call.
• Beware of a second scam. In July 2026 the FBI warned that fraudsters pose as IC3 staff or other officials offering to recover lost money from people who have already been scammed.

Then change the safe word if there is any chance it leaked, and tell the rest of the family what happened. Being fooled by a perfect copy of a loved one's voice is not a sign of foolishness. It is exactly what the tool was built to do.