AI voice-cloning now lets scammers convincingly imitate real companies, banks, and even people you know on a phone call. Check off anything that happened on a call you're unsure about:
No real company or bank will ever ask for your one-time passcode over the phone — ever. If in doubt, hang up and call the number on the back of your card or the company's official website yourself.
Modern voice-cloning AI needs only a few seconds of audio — from a social media video, a voicemail, a podcast — to produce a convincing copy of someone’s voice. Scammers use this to impersonate family members in “emergency” calls: a grandchild in jail, a child stranded abroad, a boss who needs an urgent transfer. The voice is real enough to override suspicion. That is the entire scam.
Never act on a voice alone. Hang up and call the person back on the number you already have for them — not the number that called you. If it is genuinely your family member, they will answer and confirm. If the caller pressures you not to hang up, insists on secrecy, or demands gift cards, crypto, or a wire transfer, it is a scam regardless of how the voice sounds.
Set up a family check-word (see our Family Check-Word Generator) so anyone can prove their identity in seconds, even under pressure.
Recreating somebody's voice convincingly used to need a studio and hours of recordings. It now needs a short clip of ordinary speech and a few minutes of processing. The samples come from wherever people post their voices: social media videos, podcasts, voicemail greetings, company introductions, livestreams.
Two kinds of fraud follow. The family emergency call, where a cloned voice claims to be a relative in trouble and needs money immediately. And the business version, where a cloned executive instructs staff to make an urgent payment, sometimes on a video call with a synthetic face.
The attack does not rely on the clone being flawless. It relies on shock. A call at 11pm from your child's voice, crying, saying there has been an accident, triggers a physical response that suppresses careful thinking. The script then adds pressure and secrecy: do not tell Mum yet, the lawyer says not to discuss it, we only have an hour.
Small imperfections are absorbed by the situation. A voice sounding strange is explained by distress, a bad line, or a borrowed phone. That explanation is usually built into the script from the first sentence — "I'm calling from someone else's phone" arrives early precisely because it covers both the unfamiliar number and any oddness in the voice.
Treat all of this as secondary. Clones improve constantly, and the whole approach of listening for flaws is a losing race. The defence below does not depend on detection at all.
End the call and dial the person on the number already in your phone. If they answer, the call was fake. If they do not, call another family member. This single step defeats the attack completely, because the fraudster controls only the incoming call, not your address book.
Expect resistance. The script will tell you there is no time, that their phone is taken, that calling back will make things worse. That resistance is confirmation. A real relative in real trouble will still be in trouble in two minutes.
Choose a word or phrase now, with the people closest to you, that would be used to verify any urgent request. Make it something unguessable — not a pet's name or a birthplace, since those appear on social media. Do not store it in a message thread. Our family check word tool helps you pick one and explains how to introduce it to older relatives without alarming them.
Lock down social media so voice and video content is not public. Replace a personalised voicemail greeting with the standard automated one. Be conscious that any public speaking, podcast appearance or video you post is a usable sample. This does not make you safe on its own, but it raises the effort required.
Most importantly, have the conversation before it is needed. Tell your parents and your children that this exists, that you will never call asking for urgent money without the code word, and that hanging up to call back is always the right response — even if it turns out to be you.
Often less than a minute of ordinary speech. Social media videos, voicemail greetings and podcast appearances are all usable sources, which is why reducing public voice content is worth doing.
Not dependably, and it is getting harder. That is why the advice is to verify by calling back on a number you already have rather than trying to judge the audio.
Something unguessable and unconnected to anything public — not a pet, a street, a school or a birthday. Agree it in person, never store it in a message thread, and make sure everyone including older relatives knows to ask for it.
It means it is a scam. Instructions not to verify, not to call back, and not to tell family exist only to prevent you checking. No legitimate emergency requires secrecy from your own family.
Then you call them back thirty seconds later and they understand completely. The cost of being wrong in that direction is a brief awkward moment. The cost of being wrong in the other direction can be thousands.