Short answer: Voice cloning tools can now reproduce someone’s voice convincingly from a few seconds of audio taken from social media. Scammers use it to call relatives in fake emergencies, to impersonate executives authorising payments, and to talk victims into reading out verification codes. Your 2FA does not help, because the attack targets the human, not the login. The defence is a family code word and a single unbreakable habit: hang up and call back.
What changed
Voice synthesis used to need hours of clean recordings and technical skill. It now needs seconds of audio and a consumer tool, and the results are good enough to fool a worried parent on a bad phone line.
The source material is already public. A TikTok video, an Instagram story, a podcast appearance, a voicemail greeting, a wedding speech uploaded by someone else. Nobody needs to hack anything to get it.
Combine that with breach data — names, relationships, employers, phone numbers — and a scammer can call you as your own daughter, from a spoofed number, knowing your address.
The three scripts in circulation
1. The family emergency
A call from a relative’s voice: an accident, an arrest, a hospital, a stranded trip abroad. They are distressed, the connection is poor, and they need money urgently — or they hand over to a “lawyer” or “officer” who takes it from there.
The emotional pressure is the mechanism. It is designed to stop you thinking, and it works on people who would spot a phishing email instantly.
2. The executive payment request
A finance employee receives a call from the CEO’s voice, often following an email, authorising an urgent transfer. The voice removes the last piece of doubt that a written request alone would leave.
This has moved real money in real companies. It is the most expensive form of the attack.
3. The verification code request
The one closest to home for this site. A voice you recognise — a colleague, a family member, someone from “your bank” — asks you to read out a code that has just arrived, or to approve a prompt on your phone.
The code is real, because the attacker triggered a genuine login. Your 2FA is working perfectly. It is being handed over by a person who was convinced. See OTP scams and smishing and vishing.
Why security tooling does not cover this
Every layer of authentication assumes the attacker is trying to bypass a control. Here, the legitimate user is operating the control on the attacker’s behalf.
- 2FA codes — read out willingly.
- Push approvals — approved willingly.
- Passkeys and security keys — these do resist phishing pages, and they are still the best defence for account login. But they cannot stop you making a bank transfer yourself, which is what the family-emergency script asks for. See phishing-resistant MFA.
- Caller ID — trivially spoofed, and proves nothing.
The gap is not technical. It is that a convincing voice is treated by our brains as identity verification, and it never was.
The defences that actually work
1. A family code word
Agree a word or phrase with your immediate family and anyone who might plausibly call you in an emergency. If someone calls claiming a crisis, ask for it.
Simple, free, and it defeats voice cloning outright, because the attacker has the voice and not the word. Choose something not guessable from social media — not a pet’s name or a street you have posted about.
2. Hang up and call back
The universal rule. End the call and dial the person on the number you already have for them. If it is a bank or company, use the number on your card or the official website you navigated to yourself.
A genuine caller will not object. A scammer will apply pressure not to — and that pressure is your confirmation.
3. Ask something only they would know
Not a fact that could be researched. Something shared and specific: what we ate at that restaurant, what your brother called the dog when he was five. Cloned voices carry no memories.
4. Verify money requests out of band
For businesses: any payment or bank-detail change must be confirmed through a second channel, using known contact details, with dual authorisation above a threshold. Write this into your process so nobody has to make a judgement call under pressure.
5. Never read a code aloud
No exceptions, whatever the voice sounds like. This is worth saying to family members explicitly — see helping parents and grandparents set up 2FA, where the one-sentence version is the whole lesson.
6. Reduce your voice footprint, a little
Realistically you cannot remove your voice from the internet, and it is not worth becoming anxious about. But limiting public video, and not using a personal voicemail greeting recorded in your own voice, marginally raises the cost.
Signs you are on one of these calls
- Urgency, with a reason you cannot verify immediately.
- Secrecy — “don’t tell Mum”, “this is confidential until it’s announced”.
- Unusual payment methods: transfers to a new account, gift cards, crypto.
- Resistance to being called back.
- Slightly odd phrasing or timing in the speech, though do not rely on catching this.
- Any request for a verification code, ever.
Frequently asked questions
Can I tell a cloned voice from a real one?
Sometimes, from unnatural pacing or flat emotion — but increasingly not, especially over a poor line. Do not build your defence on detection. Build it on verification.
How much audio do they need?
Consumer tools can work from seconds. Assume anyone who has posted a video has enough public material.
Does this affect voice authentication at my bank?
It is a real concern, and banks using voice biometrics have been adding liveness detection in response. Treat voice as a convenience factor, not a strong one — and see is biometrics really 2FA?
What if I already sent money?
Contact your bank immediately — speed determines whether a transfer can be recalled. Then report it to your national fraud service. If a code was shared, change that password, sign out all sessions, and re-enrol 2FA.
Should I stop posting videos?
Not necessarily. The code word costs nothing and protects you regardless of what is public. Restricting your whole life is a disproportionate response.
Is there technology that will fix this?
Call authentication standards and detection tools are improving, and phishing-resistant login methods remove some of the payoff. But the family-emergency variant asks you to send money yourself, and no authentication standard addresses that.
The bottom line
Voice used to be reasonable evidence of identity. It is not any more, and the tooling to fake it is cheap and widely available. Your accounts are best protected by passkeys and an authenticator app — but this particular attack walks around all of it. Agree a code word this week, and make “hang up and call back” the reflex in your household and your finance team.
Also worth reading: what is account takeover, for how these calls fit into the wider pattern.