How AI Voice Scams Work

The call sounds like your daughter. She is upset, there has been an accident, she needs money now and asks you not to tell anyone.

The useful thing to know is not that this happens. It is that your ear cannot settle it, and that a check which takes thirty seconds can.

This article covers how voice cloning works, what the measured evidence says about human detection, what to do during a call like this, what to do afterward, and which verification methods hold up. Lathic's article on deepfakes covers synthetic video and imagery; this one stays on voice. It does not include anything that would help someone run this scam.

How voice cloning works

A voice-cloning system has three conceptual parts.

The first listens to a sample of someone's speech and reduces it to a compact set of numbers describing how that voice sounds. The second converts written text into a sound-shape. The third turns that sound-shape into audio you can hear.

The part that surprises people is the first one. In the canonical research, published at NeurIPS in 2018, the component that captures a voice was trained on a completely different task, telling voices apart, using "noisy speech from thousands of speakers without transcripts." It never heard the person being cloned. It learned what makes voices differ from one another, which is enough.

That is why cloning does not require retraining on a target. The system is given a reference sample at the moment it generates, and produces speech in that voice. The US Federal Trade Commission describes the input requirement in its own consumer material as "a short audio clip or snippet of someone's voice."

Synthetic speech is also produced in more than one way. NIST's guidance on synthetic content describes text-to-speech, speech-to-speech, and imitation-based systems that keep the original words but change who appears to be saying them.

Why you cannot hear the difference

This is the part worth taking seriously, because the instinct is to listen harder and it does not work.

A 2025 study published in Scientific Reports ran two experiments with 604 listeners between them. In the first, judging whether a voice was real or synthetic, 300 participants correctly identified real voices 67.4% of the time and AI-generated voices 60.8% of the time, and 21% performed at or below chance on the AI clips.

The second experiment, with 304 participants, matches what a scam actually asks of you. When listeners compared a real recording of a speaker with an AI clone of the same speaker, they judged the two to be the same person around 80% of the time. That is not a question about whether audio sounds synthetic. It is the question "is this the person I know," and people got it wrong four times in five.

An earlier controlled study of 529 listeners, published in PLOS ONE in 2023, found people classified clips correctly 70.35% of the time when judging them one at a time, which is the condition a phone call puts you in. Given a real and a fake version of the same sentence side by side, accuracy rose to 85.59%. You never get the side-by-side. Two of its results matter more than the headline. Showing participants examples of deepfakes beforehand improved accuracy by only about 3.84 percentage points. Playing the clip more times did not help. The authors concluded that "attempting to improve human detection capabilities is unreliable."

There is a useful counterweight. A separate 2025 UK study found that voice clones were labeled as human 58% to 70% of the time depending on the experiment, statistically comparable to real human voices at 62% to 72%. Clones are about as convincing as real people, not more so. The problem is not that synthetic audio has become uncanny. It is that ordinary voices were never a reliable identifier in the first place, and now anyone can produce one.

Automated detection does not rescue this either. Writing in November 2024, NIST reported that accuracy in the research literature "ranges from 50% to well above 90%, depending on the method and evaluation dataset," and degrades on audio from generators the detector was not trained on, or with background noise.

What these scams actually look like

The FBI's Internet Crime Complaint Center describes two uses of cloned voices in its December 2024 alert on generative AI and financial fraud, and they run in opposite directions.

The first is the one people picture. Criminals "generate short audio clips containing a loved one's voice to impersonate a close relative in a crisis situation, asking for immediate financial assistance or demanding a ransom."

The second is the reverse: criminals use AI-generated audio of you to get into your accounts, obtaining "access to bank accounts using AI-generated audio clips of individuals and impersonating them." Voice authentication is the target, not your relative's ear.

A third pattern shows up in a separate September 2026 alert, where the FBI warned about scammers impersonating law enforcement and government officials, noting that they "often spoof authentic phone numbers, email addresses, employee names, and credentials." A correct-looking number is not evidence of anything.

A fourth is slower and aimed at individuals with access worth having. In 2025 the FBI recorded a campaign in which AI-generated voice messages claiming to come from senior US officials targeted current and former officials and their contacts, building rapport before seeking account access. The goal was not an immediate wire transfer.

The one number worth keeping in proportion: in its 2025 Internet Crime Report the FBI states that victims claimed losses over $5 million to distress scams, the category that includes grandparent scams using voice cloning to mimic a loved one. The same report records 22,364 complaints with an AI nexus and $893 million in adjusted losses, but over $632 million of that is investment fraud. Reports of family-emergency voice scams are a small share of the total, and it is worth saying so rather than borrowing the larger figure.

All of these are reported losses, from complaints people chose to file. The FBI says its own data "is variable and can evolve" and is "an assessment taken at a point in time."

Warning signs

Four things show up across the FTC and FBI guidance.

Urgency. The situation cannot wait and there is no time to check. Manufactured time pressure is the mechanism, because checking is what defeats this.

Secrecy. You are told not to tell anyone else in the family. The FTC's guidance addresses this directly and tells people to call someone else "even if the caller said to keep it a secret."

An unusual payment method. Wire transfer, cryptocurrency, gift cards where you read out the numbers and PIN, or a payment app. The FBI adds that legitimate government and law enforcement agencies never demand payment by prepaid card, cryptocurrency or courier.

A plausible caller ID. Spoofing is routine and is illegal under the Truth in Caller ID Act when done with intent "to defraud, cause harm, or wrongfully obtain anything of value," which tells you it happens. It is not a check.

What to do during the call

The FTC's instruction is short: "Don't trust the voice. Call the person who supposedly contacted you and verify the story. Use a phone number you know is theirs."

That is the whole method. Everything else is a variation on it.

The FTC's own four steps, from its guidance on fake emergencies: resist the pressure to send money immediately; hang up, or say you will call back; call someone else in your family or circle of friends even if told to keep it secret; and ask a question only the real person would know.

Do the callback even when the call turns out to be genuine. It costs a minute, and the cost of being wrong in the other direction is the point of the article.

Why caller ID does not help

Phone networks in North America use a framework called STIR/SHAKEN, in which the company originating a call digitally signs the caller ID number and the delivering company checks the signature. There are three attestation levels; the highest is asserted only when the originating provider knows the customer and has verified their right to use that number.

It authenticates the number, not the caller. The FCC's December 2025 report to Congress quotes the Commission's own earlier finding that STIR/SHAKEN information "does not provide consumers with robust information about who is calling," and that a top-level attestation indicator "alone does not give consumers enough information to decide whether a call is worth answering." In its own body text the report describes the framework as designed "not as a panacea for combatting all illegal robocalls," notes exemptions for legacy non-IP networks, and records that authentication data is stripped when a call crosses older infrastructure.

There is a concrete illustration. In 2024 the carrier that transmitted deepfaked robocalls of President Biden's voice before the New Hampshire primary agreed to a $1 million civil penalty and a compliance plan requiring it to apply the highest attestation level only to calls where it supplied the number itself. A call can carry the strongest trust marking and still be fraudulent.

Where the law has moved

Two US actions are worth knowing, and one common belief about a third is wrong.

In February 2024 the FCC adopted a unanimous declaratory ruling holding that AI-generated voices are "artificial" under the Telephone Consumer Protection Act, effective immediately. The effect, in the FCC's words, is that this "makes the act of using AI to generate the voice in these robocalls itself illegal." Callers must have prior express consent, and prior express written consent for telemarketing.

In September 2024 the FCC adopted a $6 million fine against the political consultant who directed the New Hampshire robocalls. State criminal proceedings followed; their outcome is outside what this article covers.

The FTC's Government and Business Impersonation Rule took effect on 1 April 2024. It covers impersonation of government entities and of businesses. It does not cover impersonation of private individuals. The FTC proposed extending it to individuals in February 2024, citing voice cloning, and as of September 2026 that extension remains a proposed rule. Coverage of this often implies otherwise.

None of this is a defense at the moment your phone rings. It matters for what happens afterward.

What to do afterward

Move on the money first. The FBI says "time is of the essence": contact your financial institution immediately and ask for a recall of the funds.

Then report it. In the US that means ReportFraud.ftc.gov, ic3.gov regardless of the amount, and your state attorney general. Reporting is worth doing even when recovery is unlikely, because these agencies act on volume.

Recovery depends heavily on how you paid. The FTC states that federal law protects you from unauthorized use of a credit or debit card, and that cryptocurrency payments "don't have the same legal protections as credit and debit cards do, so it can be hard to get your money back."

There is one real recovery figure and it needs its context. In 2025 the FBI's Recovery Asset Team initiated 3,900 financial fraud kill chain incidents covering $1.16 billion in attempted theft and froze $679 million, a 58% success rate. That is 58% of the funds in the 3,900 cases where the process was triggered, out of more than a million complaints. It is not the chance that any given victim gets their money back.

The thing to actually change

The same habit protects you elsewhere. Lathic's guide to using AI safely covers what not to hand over in the first place.

Agree a code word with the people who might call you in an emergency. Write down, for each of them, a number you know is theirs. Then treat any distressing call as unverified until you have called back on that number.

Four agencies recommend the code word, including the FTC, the FBI and state attorneys general in California and Michigan. None has published an evaluation of how well it works, so treat it as recommended practice rather than proven. It is free, and it replaces a judgment your ear cannot make with one it can.