AI scam: cloned voice, deepfake and how to protect yourself
AI scams use cloned voices and deepfakes to request money in the name of a relative, celebrity or bank. See how they work, warning signs and how to protect your family.
NinaKalkazu.org
Listen to this article
Narrated by Thalita
The phone rings at nine at night. It's your daughter's voice, crying: she crashed the car, needs money now for the lawyer. The voice sounds exactly like hers. Except she's at home, asleep.
This is the AI scam: the machine copies the voice of someone you love and uses that voice to ask for money urgently. Sometimes it comes in video, with a fake face.
Here you'll understand how voices are cloned, the three most common scams, warning signs and what to do if the money already went out.
Quick summary: the answer in 30 seconds. With just seconds of audio, AI mimics anyone's voice, and scammers use this to impersonate relatives, celebrities or bank managers. Don't trust your ears: hang up and call back the number you already have. Agree on a code word with your family. If you already paid, notify the bank and request a return through the appropriate fraud recovery mechanism.
Index
- What are cloned voice and deepfake
- How does the AI scam that clones voices work?
- What are the most common scams with cloned voice and deepfake?
- Warning signs: how to recognize the scam before paying
- How to protect yourself from the cloned voice scam
- I fell for the scam: what to do now?
- Frequently asked questions
What are cloned voice and deepfake
A cloned voice is a synthetic voice made by AI to sound identical to a real person's. Deepfake (the "deep" comes from deep learning, the AI that learns by imitating many examples) is the general name for fake audio, photo or video that imitates someone real, to the point of fooling people who know the person.
Think of a television impersonator who only needs to hear you once to do your voice forever, without tiring and in any language.
The technology itself isn't criminal: it narrates audiobooks and dubs videos, as we covered in the article about ElevenLabs, the voice company worth $22 billion. In the wrong hands, it becomes a perfect mask.
How does the AI scam that clones voices work?
The scammer records a few seconds of your voice, puts that clip into a cloning program and types the phrase they want to hear in your voice. The program returns the audio with your timbre, your accent and even your breathing. Then they just send the audio through WhatsApp or play it on a call.
In research, VALL-E, Microsoft's experimental program, mimics a voice from just a 3-second recording of someone the system had never heard.
Commercial tools don't make it much harder either. In March 2025, Consumer Reports evaluated six voice cloning services and concluded that only two (Descript and Resemble AI) had real safeguards against use without consent. In the other four, you just had to check a box saying you had the right to clone that voice.
Where the scammer gets your voice
From anywhere you speak for a few seconds:
- videos and Reels on Instagram or TikTok;
- WhatsApp voice messages sent in large groups;
- your voicemail greeting;
- a fake "survey" call, made just to get you talking.
That's why the warning doesn't only apply to celebrities: anyone who posts videos speaking on a public profile has their voice available to anyone.
Why "paying attention to the voice" no longer works
A few years ago, the tips were to listen for strange pauses, echo or a robotic tone. Today the American security articles themselves, like this one from Wired about AI calls, say those clues are behind us: synthetic audio has gotten too good.
Add to that nervousness: when someone you love is crying on the phone, your brain wants to solve the problem, not analyze the sound.
In one sentence: AI copies voices with just seconds of audio, and your ear is no longer a reliable detector.
What are the most common scams with cloned voice and deepfake?
There are three scripts: the fake relative who urgently requests money, the fake celebrity who appears in an ad selling gambling or investment, and the fake bank manager or fake boss who orders a money transfer. The technology changes little between them; what changes is the story the scammer tells.
The fake relative requesting money scam
It's the turbocharged version of the old "mom, I changed my number." Before it was just text; now it comes with audio in your son's or mother's voice, which defeats the main suspicion.
The script repeats: new number ("my phone broke"), an emergency, urgency and a request for secrecy. The money goes to a "friend's" or "lawyer's" account, never to the person's own.
The FBI described exactly this script in the alert it published on December 3, 2024: criminals generate short clips with a relative's voice in crisis to request immediate financial help or demand ransom.
The fake celebrity in the ad
Here the deepfake is in video: a celebrity recommends a gambling app or a miraculous investment. The face and voice seem real; the words don't.
The best-known case involves a Brazilian. Meta's Oversight Board, an independent body that reviews Facebook and Instagram decisions, ordered the removal of an AI-manipulated video of Ronaldo Nazário advertising Plinko, an online gambling game. The video passed 600,000 views and was reported more than 50 times before being taken down.
In the same decision, the board said Meta likely lets many scams through on its platforms. And it's not just there: in April 2026, The Verge showed ads on TikTok with fake versions of Taylor Swift and Rihanna requesting personal data.
The fake bank manager (and the fake boss)
The third scam imitates an authority. Someone calls claiming to be from your bank's "security center," reports a suspicious purchase and asks you to transfer money to a "secure account." Sometimes the number that appears on the screen is the same as the bank's, because the scammer spoofs the caller ID.
The same FBI alert reports that criminals also use AI-generated audio to impersonate the customer themselves and access their account through phone support. Voice has ceased to be proof of identity.
In companies, the version is the fake boss. British engineering firm Arup lost about $25 million after someone on the finance team in Hong Kong made a transfer following a video call with directors who were actually deepfakes. In an interview with the World Economic Forum, the company's chief technology officer, Rob Greig, said he later managed to make a deepfake of himself, in real time, in about 45 minutes.
Warning signs: how to recognize the scam before paying
Since voice and face can be perfect, the signs are in the request, not the sound. Be suspicious of any contact that combines urgency, secrecy and money going to a third party. Two signs together already call for a pause.
| Sign | Why to be suspicious |
|---|---|
| New or unknown number | The scammer doesn't have the person's phone, only their voice |
| Urgency ("it has to be now") | The rush prevents you from checking |
| Request for secrecy ("don't tell dad") | Isolates you from who could disprove it |
| Money to someone else's account | The money goes to a "mule" account |
| Person who can't talk much | Avoids questions the AI wouldn't know how to answer |
| Celebrity selling gambling or guaranteed profit | Real celebrity doesn't request your data through ads |
| "Bank center" requesting transfer | No bank asks you to transfer money to a "secure account" |
How to protect yourself from the cloned voice scam
The strongest defense is simple: hang up and call back the number you already have saved. Then, agree on a code word with your family that only you know. These two actions work even against a perfect voice, because the scammer doesn't have the person's phone or your secret.
In practice, the plan has five steps:
- Hang up and return the call. Call the person's or bank's saved number, never the one that called you. The FBI recommends exactly this.
- Ask for the code word. If the person doesn't know it, end the conversation.
- Ask a question only they can answer. "What did we have for dinner on Sunday?", not the dog's name, which is on social media.
- Make the profile private. The FBI also advises making social networks private and limiting followers to people you know, to reduce available voice and image material.
- Confirm through another channel. Message on the old number or call another relative.
If you have children, it's worth extending the conversation to other technology risks, as we show in the guide on how to protect your child from artificial intelligence risks.
How to create the family code word
Choose something easy to remember and impossible to guess. A nonsense phrase works well: "rain pastry," "giraffe in the elevator." Agree in person, never by message, and don't use anything that appears on the internet, like pet names, street names or birth dates.
Never publish it, not even as a joke, and don't use it as a password. The rule is one: whoever asks for money without saying the word doesn't receive it, even if crying.
In a real emergency, the person might forget the word from nervousness. That's why it complements "hang up and call back," not replaces it.
| Profile | What to do first |
|---|---|
| Parents and grandparents | Code word and the "hung up, called back" rule |
| Teenage children | Private profile and caution with speaking videos |
| Those who pay bills at the company | Confirm every transfer by phone or in person |
| Those who post a lot in video | Warn family that your voice is easy to copy |
I fell for the scam: what to do now?
Act in the first minutes. Call your bank at the number on the card or app, say it was a scam and request a return through your bank's fraud recovery mechanism. Then, file a police report and warn your family, because the scammer might try again.
In Brazil, MED is the Central Bank's tool to return money from scam transactions. According to the official Central Bank page about MED, known in Brazil as the Special Return Mechanism, you have up to 80 days from the transaction date to register the request with your institution (verified on 10/27/2026).
The return isn't guaranteed: if fraud is confirmed and there's still balance in the scammer's account, you receive the amount, in full or in part. That's why speed matters.
And don't be ashamed to tell: this scam fools even trained employees of multinationals.
Frequently asked questions
How many seconds of audio does AI need to clone a voice?
Few. In research, Microsoft's VALL-E mimics a voice from 3 seconds of recording. A short social media video is enough.
Can you identify a cloned voice just by listening?
Most of the time, no. Instead of trying to hear the flaw, verify the person through another channel or ask for the code word.
Does the fake relative scam only happen by call?
No. The most common is through WhatsApp, with short audio messages from a new number. It also appears in video calls with fake faces.
What is a celebrity deepfake?
It's a video where AI makes a celebrity recommend something they never recommended. If a celebrity asks for your data or a deposit in an ad, treat it as a scam.
The AI scam has one weakness: it depends on your rush. Today, gather your family, choose the code word and agree on the rule to hang up and call back. To better understand the technology behind these scams, see the other guides in our artificial intelligence section.
