AI voice scams - how to tell if a call is really from someone you know

The question people ask about voice cloning is "how do I tell the difference?" It is the wrong question, and answering it honestly is the most useful thing this page can do.

Quick answer

You cannot reliably identify a cloned voice by listening to it. Modern tools produce convincing imitations from a short sample of clear speech, and the scenarios they are used in — a distressed relative, a bad connection, someone in a hurry — explain away any oddity you might have noticed.

So the answer is not better listening. It is verification through a channel the caller does not control:

1. Hang up and call back on the number already saved in your phone.
2. Ask for a code word your family agreed in advance.

Both work regardless of how good the audio is, because neither depends on judging it.

What an AI voice scam looks like

The most common version is the family emergency call. It has a fixed shape:

1. A call or voice message from a number you do not recognise.
2. A familiar voice, distressed. Crying, panicking, or clearly hurt.
3. A crisis — an accident, an arrest, a hospital, a stranded trip abroad.
4. A handover. A second voice takes over: a lawyer, a police officer, a doctor, a bail bondsman. The relative is "not able to talk right now".
5. A payment, needed immediately, in a form that cannot be reversed.
6. Secrecy. Do not tell mum. Do not call anyone. This is confidential.

Steps 4, 5 and 6 exist to remove the two things that would end it: talking properly to the person, and talking to anyone else.

Other versions use the same technique:

• A boss or colleague asking for an urgent payment or a document
• A bank's fraud team, calling about a suspicious transaction
• An official, sometimes using AI-generated video as well as audio — the FBI has warned about deepfaked senior officials being used to lend credibility to fraud, including against people who had already been scammed
• A "wrong number" call that is friendly and goes nowhere, whose purpose is to record you speaking

Why the "listen for the tells" advice has expired

You will still find lists of audio flaws to listen for: flat emotion, strange pacing, no breathing sounds, odd word emphasis. These were useful. They are not now, for three reasons:

• The tools improved. Emotion, breath and hesitation are all reproducible.
• The scenario covers the gaps. Someone sobbing on a bad line is expected to sound wrong.
• Recognition is not analysis. Hearing a familiar voice triggers recognition before any conscious assessment starts. By the time you are evaluating, you have already believed it.

The two things that do work

1. Hang up and call back

End the call. Then dial the person yourself, using the contact already in your phone — not a number the caller gave you, not a number that appeared on your screen.

This works because the attacker controls the call they made to you, and controls nothing about a call you originate. Caller ID can be spoofed to show any number; an outbound call cannot be redirected.

If they do not answer, call someone else who would know — a sibling, a partner, their workplace, the place they said they were.

When they say there is no time: there is. A real emergency survives sixty seconds. That objection is not an obstacle to verification; it is a reason for it. Urgency manipulation explains why the pressure is always the first thing to arrive.

2. Use a code word

A short phrase your family agreed in advance, that anyone claiming an emergency can be asked to say.

Setting one up:

• Pick something unguessable — not a pet's name, a street, a birthday, or anything findable on social media. A random pair of unrelated words works well.
• Share it in person or by voice, not in a group chat or a shared document.
• Include everyone who might be called about, or called by: children, parents, grandparents, partners.
• Practise it once. The reason code words fail is embarrassment — people feel rude asking. Using it once as a joke removes that permanently.
• Agree the rule: no code word, no money, no exceptions.

The request is still the strongest signal

Whatever the voice sounds like, some requests are fraudulent by construction. Treat these as automatic stops:

• Gift cards — no court, hospital, lawyer or police force takes them
• Cryptocurrency or a crypto ATM
• A wire transfer to a name you do not recognise
• Cash handed to a courier, or left somewhere
• Payment through an app to a stranger
• A two-factor code read aloud. The FBI's guidance is blunt: never provide a two-factor code to anyone over email, text or a messaging app
• Secrecy from the rest of your family

Real institutions have processes, references and letters. None of them require you to be the only person who knows.

Reduce what can be cloned

You cannot prevent this entirely, and it is not your fault if you are targeted. A few things do reduce the raw material:

• Use the default voicemail greeting rather than one in your own voice.
• Consider who can see videos where you speak clearly at length.
• Do not engage with unexpected "wrong number" calls. A polite few sentences is a usable sample. Hang up.
• Think about children's accounts, where public video is common and the emotional leverage of a cloned child's voice is highest.
• Be careful what your family shares about travel — a scam is far more credible when the caller knows someone is genuinely abroad.

If you get one of these calls

1. Say you will call back, and hang up. You do not need a reason or an apology.
2. Call the person on the number you have saved.
3. If you cannot reach them, call someone else who would know. Do not treat an unanswered phone as confirmation.
4. Ask for the code word if you are still talking to them.
5. Do not send anything until you have spoken to the real person.

If you already sent money

Move quickly, and do not spend time on self-blame — these calls are built to work on people who love someone.

1. Contact whoever moved the money immediately — bank, card issuer, wire company, gift card issuer, crypto exchange. Speed is the main variable.
2. Report it at IC3.gov and ReportFraud.ftc.gov, or your country's equivalent. How to report an online scam covers what each does.
3. Warn the family, including the person who was impersonated. The same number often calls other relatives.
4. Expect a follow-up offering to recover the money. That is the second scam.
5. Set up the code word now, while everyone is paying attention.

Key takeaways

• Cloned voices are good enough that listening is not a test.
• Verify through a channel you control — hang up and call back on a saved number.
• Agree a family code word in advance, and practise using it once.
• Urgency and secrecy are the two features every version shares.
• Gift cards, crypto, wire transfers and cash couriers are fraudulent requests regardless of who appears to be asking.

The wider category — what AI has and has not changed about fraud — is covered in AI scams, and the phone channel itself in vishing and voice phishing. For verifying people you have never met, see how to verify someone's identity online.