Voice cloning and deepfake scams

Voice cloning uses AI to copy how a real person sounds, often from audio they or their family posted online.² A deepfake goes further and fakes a face, a video, or a whole meeting. Scammers use both to pose as someone you trust, such as a grandchild, a boss, or a senior official, and push you to send money or share information before you can check.³⁴

• $893 million¹

  Losses in 2025 complaints to the FBI that mentioned AI, across 22,364 complaints; the FBI counts only complaints that reference AI, so the true figure is likely higher.

  FBI Internet Crime Complaint Center (IC3), p.39 and p.61 (AI Related descriptor definition)

• $5 million+¹

  Losses people reported to the FBI in 2025 from grandparent or 'distress' scams that used voice cloning.

  FBI Internet Crime Complaint Center (IC3), p.39, Confidence/Romance Scams

• $30 million+¹

  2025 business email compromise losses in complaints that mentioned AI. The FBI tags AI only when a complaint mentions it, so this is a floor.

  FBI Internet Crime Complaint Center (IC3), p.39, BEC

• $352 million¹

  Losses reported by people 60 and older in 2025 FBI complaints that mentioned AI, across 3,143 complaints.

  FBI Internet Crime Complaint Center (IC3), p.45-46, Crime Types Reported by 60+ (AI Related descriptor)

• 58%¹

  Share of the $1.16 billion in attempted theft that the FBI's Recovery Asset Team helped freeze in 2025 through its Financial Fraud Kill Chain, about $679 million across 3,900 incidents.

  FBI Internet Crime Complaint Center (IC3), p.17, IC3 Recovery Asset Team - Financial Fraud Kill Chain in 2025

• HK$200 million⁵

  Amount (about US$25 million) an Arup employee transferred in early 2024 after video calls with deepfaked senior officers.

  The Guardian, Paragraphs 1 and 9-10

• Public audio and video: social media clips, voicemail greetings, podcasts, webinars, and company videos give scammers the voice and face samples they need.²
• Faked caller ID: the incoming number can be spoofed to look local or familiar, so the number on screen proves nothing.¹³
• Text first, then an encrypted app: in an FBI-tracked campaign impersonating senior officials, contact opened with a text, then moved to Signal, WhatsApp or Telegram, where voice notes are easy to fake.¹⁴
• Robocalls with cloned voices: the FCC ruled that AI-generated voices count as 'artificial' voices under the Telephone Consumer Protection Act (TCPA), so these calls generally need your prior consent, but scammers ignore the law.¹⁵¹³
• Video meetings: fake participants join what looks like a normal meeting, and the request borrows the authority of familiar faces.⁵
• Remote hiring and account opening: altered faces, voices, and ID documents are used to pass interviews and identity checks.⁹¹⁰
• Processes that trust a voice: any payment, bank-detail change, password reset, or code that can be approved on a call alone is an open door.
• Pressure and secrecy: urgency, fear, and 'don't tell anyone' are there to stop you from checking with someone else.⁷

• Hang up and call back on a number you already have

  If a call or message asks for money, codes, or personal details, end it and call the person or organization back using a number saved in your contacts or printed on a statement. The FTC, FBI, and FCC all give this same advice.¹⁶³¹³ If you can't reach them, check with another relative, friend, or colleague, even if the caller said to keep it secret.⁷

  • Guide: The family safe word and callback rule
  • Control: Out-of-Band Verification (Callback Rule)

• Agree on a family safe word

  Home

  Pick a private word or phrase that a real relative can give on request and a scammer can't look up. The FBI recommends a family secret word in several recent warnings, and AARP recommends a code word for grandparent scams.³¹⁴⁶ No word, no money.

  • Guide: The family safe word and callback rule

• Require two-channel verification for every payment change

  Business

  No wire, new payee, bank-detail change, or gift card purchase goes out on the strength of a call, voice note, or video meeting alone. Confirm it through a second channel you start yourself, using contact details already on file, and let anyone pause a payment without penalty. FinCEN reports criminals using AI to impersonate executives and order large transfers.⁹

  • Guide: Two-channel verification for payments
  • Control: Out-of-Band Verification (Callback Rule)

• Turn on call screening and carrier spam blocking

  iPhone and Pixel phones can screen or silence calls from numbers that aren't in your contacts, and Pixel phones in the US can warn you during a likely scam call.¹⁷¹⁸¹⁹ AT&T, Verizon, and T-Mobile each include free scam and spam call blocking on most plans.²⁰²¹²² These cut the number of scam calls that reach you, but none of them catch every call.

  • Guide: Help an older relative stay ahead of AI phone scams
  • Tools: Call screening and scam blocking

• Share less voice and video in public

  Make personal social accounts private, limit followers to people you know, and think twice before posting long clips of your own or your kids' voices. The FBI recommends limiting the images and voice recordings of you that are online.³ For businesses, a generic voicemail greeting gives away less than an executive's recorded voice.

• Use multi-factor authentication and never read a code to a caller

  Turn on multi-factor authentication (MFA), a second check beyond your password, for email, banking, and messaging apps. Never give a one-time code to someone who calls or messages you, whoever they sound like.¹⁴

  • Control: Multi-Factor Authentication (MFA)

• Verify remote hires with live checks

  Business

  Require cameras on with an unobscured background, ask candidates to wave a hand in front of their face, and save images to compare at later meetings.¹² For roles with system access, confirm identity in person or through a trusted verification step before you ship a laptop or grant accounts.¹¹

• Train the people who move money

  Business

  Walk your bookkeeper, office manager, and anyone who approves payments through a fake-executive call. Make it clear in writing that verifying a request from the owner is never insubordination. Run the drill again whenever someone new takes over payments.

  • Control: Security Awareness Training Program

• Know the tells, but don't rely on them

  Fakes can show lag, distorted hands or teeth, unnatural movement, and odd word choices.³ But the FBI warns that a cloned voice can sound nearly identical to the real person.⁴ Treat spotting a fake as a bonus; verification is the control.

• ThreatHomeBusiness

  AI-powered phishing and business email compromise

  Criminals now use AI to write fluent, personalized phishing emails and payment requests, in any language and at volume. Business email compromise (BEC), where a scammer poses as a boss, vendor or title company to redirect a payment, drew $3.05 billion in reported losses to the FBI in 2025. Typos are no longer the tell; a request to move money or change bank details is. Confirm every one on a second channel you already trust.

  Read
• ThreatHome

  AI-scaled romance and investment scams

  Organized scam operations now use AI to translate, script and run many online 'relationships' at once, usually steering people toward fake crypto investments. Investment fraud was the costliest crime reported to the FBI in 2025 at $8.6 billion, and people 60 and older reported $3.5 billion of it. Being targeted says nothing about your intelligence; these are professional operations. The rule that holds: never send money or crypto to someone you have only met online, and talk it over with someone you trust first.

  Read
• GuideHome

  The family safe word and callback rule

  Pick a private word your family uses only to prove who's really calling, and agree that any urgent request for money gets a hang-up and a callback to a number you already have. The FBI recommends the secret word, and the FTC and FCC recommend the callback. Setting it up takes one family conversation.

  Read
• GuideHome

  Help an older relative stay ahead of AI phone scams

  Older adults report losing money to fraud less often than younger adults, but when a scam works it tends to cost them more, especially when it starts with a phone call. People 60 and older reported $7.7 billion in losses to the FBI in 2025, including $352 million in complaints that mentioned AI. This guide helps you set up call screening, bank alerts, and a trusted contact together, as partners, and plan what to do if something gets through.

  Read
• GuideBusiness

  Two-channel verification for payments

  Money only moves after a second channel confirms it. Keep a list of known-good phone numbers, call back on those numbers before paying or changing bank details, require two people above a set amount, and know who to call in the first hour if money goes out. Among the controls finance teams use against business email compromise, that callback is the one most often rated very effective.

  Read