A deepfake voice scam is a phone call in which the caller sounds exactly like someone you trust — a child, a grandchild, a boss — because the voice was cloned from audio scraped online, then scripted around a crisis that demands money or information immediately. The technology requires only seconds of clean audio and widely available tools, and the FBI has warned since 2023 that criminal use of cloned voices in extortion and emergency scams is growing. The two-part defense is nearly free: agree on a family codeword now, and adopt the rule that any emergency call gets ended and returned on the real person's own number.
How do these scams work?
The classic shape is the grandparent scam upgraded by AI: the phone rings, there is noise, a crying or panicked voice that sounds like your grandson says he has been in an accident or arrested, and a second voice — the "authorities" — explains the bail or lawyer fee and the wire instructions. Variants include the boss asking an employee to buy gift cards for clients, the CFO authorizing a wire in the executive's familiar voice, and romantic or friendship follow-ups building toward fraud. Cloning the voice is the cheap part: commercial voice-AI tools reproduce a voice from brief samples, and most families have published minutes of a loved one's voice across voicemail greetings, social video, and podcasts. The panic does the rest — callers who would spot a text scam suspend judgment when the voice is right.
Why does the voice trick people so effectively?
Voice is one of the strongest identity signals humans have, and we have had no evolutionary need to doubt it until now. A 2023 multinational survey by the security firm McAfee found that a substantial share of people had been targeted by AI voice scams or knew someone who had, and that most could not reliably distinguish a cloned voice from the real one — the experiment matched general perception research: humans distinguish familiar voices by nuances current models mostly reproduce. Add a plausible scenario, caller-ID spoofing of a local number, and a countdown — the plane is boarding, the courthouse closes at five — and the scam compresses a decision into minutes.
What are the signs?
The markers recur regardless of the voice's quality:
- Urgency that forbids verification — do not tell Mom, stay on the line, the lawyer says no calls.
- Unusual payment rails — gift cards, wire transfers, crypto ATMs, payment apps to new recipients. Legitimate emergencies accept a call back and a bank.
- Story holes under calm questioning — which precinct, which hospital, whose phone is this. Scammers improvise poorly when the script bends.
- Audio artifacts — odd pacing, flat emotion, background noise that cuts in, or the caller refusing to say things only the real person would know.
How do you protect a family?
- Set a family verification word now. One word known only to the household; anyone claiming to be family on a crisis call must say it. It costs five minutes at dinner and defeats the entire voice vector.
- Adopt the call-back rule. Any urgent request ends the call: hang up and dial the person's own number. If they do not answer, call a family member who would know where they are. No real emergency fails this test — hospitals and jails exist even if the story were true.
- Question a request that came by voice alone. A boss wanting gift cards, a relative with wire details: verify through a second channel, every time.
- Shrink the source material. Tighten who can hear your family's voices online — private social accounts, a custom voicemail greeting with your name only — and mention to older relatives why their public videos matter.
- Brief the likely targets kindly. Grandparents and teens are the prime audiences; frame it as a game ("our secret word") rather than a lecture.
What if it already worked on someone?
Speed decides recoverability. For wire transfers, contact the sending bank immediately and ask for a recall; for payment apps and cards, report the transaction as fraud within the app or card issuer — gift cards are effectively unrecoverable, which is why scammers love them. Then file with the FBI's IC3 (ic3.gov), which tracks voice-clone fraud, and local police for the report number banks often require. Preserve the number, the time, and any voicemail — and treat the family codeword conversation as the follow-up, because a household that got burned once is on the call list for the next variation.
For more context, read Vishing and business email compromise: when the call is from 'IT' and the invoice is real-looking.
For more context, read what is a botnet.
For more context, read infostealer malware.