AI Voice-Cloning Scams: How They Work, How to Stop Them

AI voice-cloning scams use a short recording of someone’s voice to fake a call from them, usually a relative in trouble or a boss asking for an urgent payment. The defense is simple: hang up and call the person back on a number you already know, agree on a family safe word in advance, and never send money by wire, gift card, crypto or cash courier because a caller pressured you. If it happens, report it at ReportFraud.ftc.gov.

The voice can sound exactly right. That’s why your check has to be about the situation, not the sound.

How voice-cloning scams work

Commercial and open-source AI tools can now imitate a voice from a short sample. Scammers get that sample from public videos on social media, voicemail greetings, podcasts or even a brief “wrong number” call where they record you saying a few words.

The typical script:

The hook. You get a call that sounds like your child, grandchild or partner, often crying or panicked: they’ve been in a car crash, arrested, kidnapped or stranded abroad.
The handoff. A second person takes over, posing as a lawyer, police officer, doctor or “kidnapper,” so the cloned voice only has to say a few lines.
The pressure. You’re told to act right now and not tell anyone, sometimes with a “gag order” story or threats.
The payment. They ask for money in ways that are hard to reverse: wire transfer, payment app, cryptocurrency, gift card numbers, or cash handed to a “courier” who comes to your door.

Caller ID doesn’t help. Scammers can spoof the number so it shows your relative’s name or a real police department.

The workplace version: fake boss calls

Businesses face the same trick. An employee gets a voice message, call or even a video meeting with someone who looks and sounds like an executive, asking for an urgent wire transfer, gift cards for clients, a change to a supplier’s bank details or login codes.

In May 2025, the FBI warned that criminals were using AI-generated voice messages to impersonate senior US officials and gain access to the accounts of their contacts. The same techniques are used against companies of every size.

Defenses for work:

Require a second approval for any payment or bank-detail change, whatever the request’s urgency or seniority.
Verify through a different channel: call the executive on their known number or message them on the company chat.
Never read out a multi-factor code or approve a sign-in prompt because someone asked you to by phone.

Warning signs

What you hear	Why it’s a red flag
“Don’t tell Mom and Dad”	Isolating you stops you from checking the story
“You have to pay in the next hour”	Urgency is designed to stop you thinking
“Buy gift cards and read me the numbers”	No real court, hospital or police department takes gift cards
“Send it in Bitcoin” or “a courier will pick up the cash”	Payments that are nearly impossible to recover
The voice won’t answer simple questions	A clone can say scripted lines but struggles with personal details
Bad connection, crying, short sentences	Hides the imperfections of a cloned voice

What to do during a suspicious call

Slow down. Say you’ll call back. A real emergency will still be real in five minutes.
Hang up and call the person directly on the number saved in your phone, not one the caller gives you.
If you can’t reach them, call another family member, their partner, roommate, school or workplace.
Ask for the safe word or a question only the real person would know, like the name of a childhood pet. Avoid anything posted on social media.
Call the agency yourself if the caller claims to be police, a hospital or a court. Look up the number independently.
Don’t pay until you’ve confirmed the story with the actual person.

The Federal Trade Commission gives the same core advice on its family emergency scams page: don’t trust the voice; verify through a number you know is theirs.

Set up a family safe word

A safe word takes two minutes and beats even a perfect voice clone.

Pick a word or short phrase that’s easy to remember but not guessable, and that has never appeared online.
Share it in person or by phone with close family, including older relatives and teens.
Agree on the rule: no safe word, no money, no matter how convincing the call.
Don’t store it in a shared note or text thread that could be hacked. Change it if you think it has leaked.

Reduce how easily your voice can be copied

You can’t make yourself clone-proof, but you can make it harder:

Set personal social media accounts to private, and think twice about public videos of children talking.
Use your carrier’s or phone’s default voicemail greeting instead of a recorded one.
Don’t chat with unknown callers. Turn on your phone’s spam call filtering; our guide on how to block spam calls shows how on iPhone and Android.
Protect your accounts with two-factor authentication so a scammer can’t take over the profiles your family trusts; see how to set up two-factor authentication.

If you already paid

Act fast; the sooner you report it, the better the chance of stopping the money.

Bank or card transfer: call your bank’s fraud line (the number on the back of your card) and ask them to stop or recall the payment.
Payment app: report the transaction in the app and to your linked bank.
Gift cards: contact the card’s issuer with the card numbers and receipts. Unspent balances can sometimes be frozen.
Crypto: contact the exchange or ATM operator you used immediately.
Report it at ReportFraud.ftc.gov and, for internet-enabled fraud, at IC3.gov (the FBI’s Internet Crime Complaint Center). Call local police too, especially if someone came to your home.

Expect follow-up scams: “recovery” services that promise to get your money back for a fee are often run by the same criminals.

Bottom line

A cloned voice can be indistinguishable from the real thing, so don’t try to judge it by ear. Hang up, call back on a number you trust, use a family safe word, and treat any demand for gift cards, crypto, wire transfers or a cash courier as a scam until proven otherwise.

FAQ

How much audio does a scammer need to clone a voice?

Often just a short clip, such as a few seconds to a minute from a public video or voicemail. The more audio available, the more convincing the clone.

Are AI voices in robocalls legal?

In February 2024 the FCC ruled that AI-generated voices count as “artificial” voices under the Telephone Consumer Protection Act, so robocalls using them face the same restrictions as other prerecorded calls.

Can I tell a cloned voice by listening carefully?

Not reliably. Short, emotional calls with a bad line are designed to hide flaws. Verifying by callback works far better.

Should I stop posting videos online?

You don’t have to, but limit who can see them, especially videos of kids, and make sure your family knows the safe word rule.