Prevent This: Voice Cloning Scams
One in four Americans has already received a deepfake voice call. The FBI's top defense costs nothing and takes 30 seconds.
Welcome to Prevent This, our weekly community newsletter covering cybersecurity for everyone. If you found us through Intruvent Edge, our bi-weekly technical deep dive, welcome. Both live on the same Substack. Feel free to share either one. We’re glad you’re here.
Three seconds of audio. That is all it takes to clone a human voice with enough accuracy to fool the person who raised it.
The Call That Sounded Exactly Like Her Daughter
Deborah Del Mastro was at home when her phone rang. A man on the other end said he had kidnapped her daughter and wanted $20,000 for her release. Before Deborah could respond, she heard her daughter’s voice. Crying. Pleading. Begging for help.
It sounded exactly like her.
Deborah sent $5,000 before she was able to confirm that her daughter was safe, sitting at her own kitchen table in another city, completely unaware that anything had happened.
In Florida, another woman heard what she believed was her daughter sobbing after a serious car accident. She sent $15,000. Her daughter had not been in any accident.
In Hong Kong, a finance worker joined what appeared to be a routine video call with colleagues. Every face on the screen was familiar. Every voice matched. He followed instructions from his CFO to transfer funds across several accounts. By the time anyone realized the entire call had been fabricated, $25 million was gone.
None of these people were careless. None of them ignored warning signs. They heard a voice they trusted, and they responded the way any of us would.
The voice was fake. The emotion it triggered was real. And that gap between what you hear and what is actually happening is where the money goes.
How Three Seconds Becomes a Perfect Copy
Voice cloning technology has existed in research labs for years. What changed in 2025 and 2026 is that it became fast, cheap, and available to anyone with an internet connection.
Here is how it works in practice:
Step 1: Harvest. The scammer needs a sample of the target’s voice. A birthday video on Instagram. A work presentation posted to LinkedIn. A voicemail greeting. A TikTok. A podcast appearance. Three seconds of clear audio is enough for modern cloning tools to build a working voice model. Longer samples produce better results, but the minimum threshold is startlingly low.
Step 2: Clone. The audio sample is fed into a voice synthesis tool. Some of these tools are commercial products marketed for legitimate uses (audiobook narration, accessibility, content creation). Others are open-source models that anyone can download and run on a laptop. The tool analyzes the pitch, cadence, rhythm, and tonal characteristics of the voice and builds a model that can say anything typed into a text box.
Step 3: Call. The scammer places a phone call using the cloned voice. Some run the voice model in real time, typing responses and having the AI speak them aloud during the conversation. Others pre-record a few panicked phrases (“Mom, help me,” “Please, I’m scared,” “They won’t let me go”) and play them in the background while a human handler runs the negotiation.
The phone number on caller ID can be spoofed to show the victim’s real number. The voice sounds right. The area code matches. The emotional context (an accident, an arrest, a kidnapping) is designed to shut down the part of your brain that would normally pause and verify.
The entire setup costs less than a restaurant dinner. Some voice cloning tools are free.
The Numbers
The FBI’s Internet Crime Complaint Center reported $893 million in losses to AI-powered scams in 2025, including voice cloning, AI-generated phishing, and deepfake fraud. That figure sits inside a record $20.9 billion in total reported cybercrime losses for the year, up 26% from the year before.
One in four Americans has received an AI-generated deepfake voice call in the past year. Not one in a hundred. Not one in ten. One in four. If you are reading this in a room with three other people, statistically one of you has already gotten the call.
The FCC classified AI-generated voices in robocalls as illegal under the Telephone Consumer Protection Act earlier this year, giving state attorneys general the authority to prosecute. But enforcement lags behind the technology. The tools are getting cheaper and more convincing faster than regulators can respond.
The people most frequently targeted are older adults. The FBI’s warning specifically highlights seniors worried about children and grandchildren as the primary audience for these scams. But the Hong Kong case proves this is not a “grandparent problem.” A trained finance professional on a video call with familiar faces still got fooled. The technology works on anyone whose first instinct is to help someone they love.
Why Your Brain Falls for It
Voice is one of the most trusted signals we have. You learned your mother’s voice before you learned her face. A crying child, a panicked spouse, a frightened parent: these sounds bypass rational thought and go straight to action. Scammers have understood this for decades. What AI gave them is the ability to put any voice they want on the other end of the phone.
The old version of this scam, sometimes called the “grandparent scam,” relied on a vague impersonation. The caller would say “Grandma, it’s me” and let the victim fill in the name. It worked often enough to be profitable, but it also failed often enough that alert targets could catch it.
The AI version does not rely on vagueness. The voice is specific. It sounds like one person and only that person. When the scammer says “Mom, I’m in trouble,” it sounds like your kid. Not a kid. Your kid.
That specificity is what makes the scam so effective, and it is also what makes the defense so simple.
The Fix: One Text Message, Right Now
The FBI’s top recommendation for defending against voice cloning scams is free, takes 30 seconds, and does not require any technology:
Set a family safe word.
Send a text message to every person you would call in an emergency: your parents, your kids, your spouse, your siblings, your closest friends. Pick a word or phrase that has no connection to anything public. Not your pet’s name (it’s on Instagram). Not your street (it’s on your driver’s license). Not your high school mascot (it’s on Facebook).
Pick something random and private. “Purple stapler.” “Taco emergency.” “Foghorn.” Anything that an AI cannot guess because it was never posted, spoken, or written anywhere online.
The rule is simple: if someone calls asking for money, help, or urgent action, you ask for the safe word first. If they cannot give it, you hang up and call the person directly at a number you already have saved.
An AI can clone a voice. It cannot clone a secret.
What Else You Can Do
1. Hang up. Call back.
If you get a call from someone claiming to be a family member in distress, hang up and dial them directly. Use the number saved in your contacts, not a number the caller gives you. If the person is truly in danger, they will still be in danger 60 seconds from now when you call back. If they are not, you just saved yourself thousands of dollars.
This single step defeats the entire scam. Voice cloning only works if the call continues without interruption. The moment you break the connection and initiate your own, the illusion ends.
2. Lock down your voice online.
Scammers build voice clones from public audio. The less of your voice that exists online, the harder you are to clone.
Set social media to private. Instagram Reels, TikTok videos, Facebook Stories, and YouTube clips are the primary sources. You do not have to stop posting. You just need to control who can access your content.
Change your voicemail greeting. A default carrier greeting (“The person you are calling is not available”) gives a cloner nothing to work with. A personalized greeting with your name and voice gives them everything they need.
Think before you share voice notes. WhatsApp and iMessage voice notes are convenient. They are also perfect voice samples. In group chats with people you do not know well, consider typing instead.
3. Watch for the red flags.
Even a convincing voice clone leaves clues if you know what to listen for:
Unusual pauses or flat spots. Real-time voice cloning introduces tiny delays. If the “person” on the other end takes a beat too long to respond, or their voice lacks the natural ums and hesitations of real speech, something may be off.
Emotional pressure to act immediately. “Don’t hang up.” “Don’t call anyone.” “They said they’ll hurt me if you tell anyone.” Every version of this scam depends on urgency. The moment someone tells you not to verify, that is exactly when you should verify.
Unusual payment methods. Wire transfers, Venmo, gift cards, cryptocurrency, Zelle. Legitimate emergencies (bail, hospital bills, accident costs) are never resolved with gift cards from CVS.
4. Have the conversation with your parents.
If you have parents or grandparents who are not technically inclined, this is the article to share with them. The scam is specifically designed to exploit the people who love you most. A parent who hears their child screaming for help will act first and think second. That instinct is human nature, and the safe word gives them a pause button.
Offer to set it up with them. Send the text. Pick the word together. Make sure they know: if anyone calls asking for money using your voice, ask for the word. If they do not have it, hang up and call back.
We wrote in April about scammers targeting people during their worst moments. Voice cloning is the tool that makes those scams work. The defense is the same: slow down, verify, and never let urgency override judgment.
The Bottom Line
Three seconds of audio from a birthday video. That is all it takes to build a voice that can make your mother send $5,000 to a stranger.
The technology is cheap, accessible, and improving every month. The FBI logged nearly $900 million in AI scam losses last year, and one in four Americans has already received a deepfake call. The FCC has made AI-generated robocalls illegal, but the law cannot move faster than a laptop with a free voice cloning tool and a spoofed phone number.
The fix does not require technology. It requires a conversation.
Send a text to your family today. Pick a word nobody else could guess. Agree that no matter how real a voice sounds, no matter how scared the caller seems, the word comes first. If they cannot say it, hang up and call back.
An AI can sound exactly like the person you love most. It cannot know what you agreed on over breakfast.
If you or someone you know has been targeted by a voice cloning scam:
FBI IC3: ic3.gov
FTC: reportfraud.ftc.gov or 877-382-4357
Local law enforcement: File a police report, especially if money was sent
Your bank: If funds were transferred, contact your bank’s fraud department immediately; some wire transfers can be recalled within 24 hours
Sources
FBI PSA I-062626-PSA: Russian Intelligence Targeting Signal Backup Keys (June 2026)
FBI warns of AI voice cloning scam mimicking loved ones (Click2Houston, June 2026)
AI voice cloning scams are on the rise (CNN, May 2026)
FBI: AI voice cloning scams drained nearly $900 million (MoneyWise, 2026)
FBI warning: deepfake kidnappings target seniors (SavingAdvice, May 2026)
1 in 4 people have encountered AI voice cloning scams (SavingAdvice, May 2026)
AI voice cloning scams 2026: how to protect your family (LumiChats)
AI scams stole $21 billion: how to protect yourself (Financial Freedom Tracker, 2026)
FTC: How to spot scams that start on social media (April 2026)
Prevent This is a weekly cybersecurity newsletter from Intruvent Technologies. Each week, we break down one cyber threat in plain language and give you the tools to protect yourself and the people you care about. For our bi-weekly technical deep dive, check out Intruvent Edge.