Artificial intelligence can be used to create a realistic copy of a person's voice. This technology, commonly called voice cloning, can imitate the sound, tone and speaking characteristics of another person.

Voice-cloning technology has legitimate uses, but criminals can also use it to make impersonation scams more convincing. A caller may sound like your child, grandchild, spouse, employer, coworker or another person you trust.

A familiar voice is no longer enough to prove who is calling. If an unexpected call involves money, sensitive information or urgent action, independently verify the person before doing anything.

How AI Voice Scams Work

A criminal may obtain recordings of someone's voice from videos, social media, podcasts or other sources and use artificial intelligence to imitate that person's voice.

Voice cloning can then be combined with information about the victim, family members, employees or businesses to create a convincing story.

The scammer may pretend to be:

• A child, grandchild, spouse or other family member.
• A friend.
• A company executive or coworker.
• A bank or credit union representative.
• A government official or law enforcement officer.
• A doctor, attorney or other authority figure.
• A customer, vendor or business partner.

Family Emergency Scams

One of the most concerning uses of voice cloning involves emergency impostor scams.

A caller who sounds like someone you know may claim that they:

• Were involved in an accident.
• Have been arrested.
• Are in the hospital.
• Lost a wallet or phone.
• Are stranded while traveling.
• Need money for bail, legal fees or medical expenses.
• Need financial help immediately.

Another person may join the call pretending to be an attorney, police officer, doctor or other authority figure who supposedly confirms the story.

Do not send money based solely on the voice you hear.

Verify a Family Emergency Yourself

If someone who sounds like a family member calls asking for emergency financial assistance:

• Stop before sending money. Do not let urgency prevent you from checking the story.
• Hang up and call the person yourself. Use a telephone number you already know.
• Contact another family member or trusted person. They may be able to confirm where the person is and whether an emergency actually occurred.
• Be suspicious of demands for secrecy. Scammers may specifically tell you not to contact parents, spouses, financial institutions or other family members.
• Do not rely on caller ID. Telephone numbers can be spoofed.

Consider a Family Verification Phrase

Families may consider establishing a private word, phrase or verification process for unexpected emergency requests.

Choose something that cannot easily be discovered through social media or public information. Avoid birthdays, pet names, schools, hometowns or other information that a criminal might find online.

A verification phrase can provide an additional layer of protection, but significant or unusual financial requests should still be independently confirmed.

Business and Executive Impersonation

Voice cloning can also make business impersonation and Business Email Compromise schemes more convincing.

An employee might receive a call or voice message that appears to come from the CEO, business owner, manager or another executive requesting:

• An urgent wire transfer.
• Payment of an invoice.
• A change to vendor payment instructions.
• Purchase of gift cards.
• Payroll changes.
• Sensitive employee or customer information.
• Account credentials or authentication information.

The fact that a request sounds like an executive should never override established payment or security procedures.

Verify Business Requests Through Another Channel

Businesses should independently verify unusual financial or information requests using an established communication method.

For example:

• Call the executive using a number in the company directory.
• Call a vendor using contact information already on file.
• Require established approval procedures for significant payments.
• Independently verify changes to vendor banking information.
• Confirm payroll or direct-deposit changes according to established procedures.

Do not use contact information supplied in the communication you are trying to verify.

Bank and Credit Union Impersonation

A criminal may use a convincing voice while pretending to work for your bank or credit union.

The caller may claim:

• Fraud has been detected on your account.
• Your online banking account has been compromised.
• A transfer needs to be canceled.
• Your identity needs to be verified.
• Your money must be moved to protect it.

The scammer may ask for account information, passwords, authentication codes or other sensitive information.

If you receive an unexpected call concerning your financial account, end the call and contact your bank or credit union independently using a telephone number or communication method you already trust.

Never Move Money to "Protect" It

Be extremely suspicious if someone unexpectedly tells you that your money is at risk and must be moved immediately.

A scammer may instruct you to:

• Transfer money to a "safe" or "secure" account.
• Send a wire transfer.
• Use a payment app.
• Purchase cryptocurrency.
• Buy gift cards.
• Withdraw cash.

Do not move money based on instructions from an unexpected caller, even if the voice sounds familiar or the caller claims to be protecting you from fraud.

Protect Passwords and Authentication Codes

Voice impersonation can also be used to steal information needed to access your accounts.

Never provide the following to someone who unexpectedly contacts you:

• Online banking passwords.
• PINs.
• One-time authentication or verification codes.
• Answers to security questions.
• Full account credentials.

Do not approve an unexpected login or authentication request simply because someone on the telephone tells you to approve it.

Government and Authority Impersonation

Voice-cloning technology can also make government and law-enforcement impersonation scams more convincing.

A caller may appear to be a police officer, federal agent, government official, attorney or another authority figure and claim that:

• You are under investigation.
• You owe money.
• Your identity has been stolen.
• Your Social Security number is connected to criminal activity.
• Your bank accounts are at risk.
• You need to cooperate with an investigation.

Do not send money or disclose sensitive information simply because someone's voice sounds convincing. Independently contact the agency or organization using official contact information.

Romance and Relationship Scams

Voice cloning can make online relationships appear more authentic. A scammer using a fake dating or social media profile may use synthetic or altered audio during telephone calls or voice messages.

A voice conversation does not prove that an online romantic interest is the person shown in their profile.

Be particularly cautious when an online relationship begins to involve money, investments, cryptocurrency, packages or financial emergencies.

Investment Scams

AI-generated voices may also be used to impersonate financial professionals, business executives, celebrities or other trusted people while promoting fraudulent investments.

Do not invest because a telephone call, recording, online video or voice message sounds like someone you recognize.

Research the investment and the person or company involved independently before sending money.

Tech Support and Customer-Service Impersonation

A scammer may pretend to work for a technology company, financial institution or other service provider.

The caller may claim that there is a problem with your device, account or subscription and ask you to:

• Provide account information.
• Visit a website.
• Install software.
• Allow remote access to your computer.
• Make a payment.

Do not allow someone who contacted you unexpectedly to remotely access your computer or mobile device. Independently contact the company if you believe there may be a legitimate issue.

Don't Try to Outsmart the Voice

You may encounter advice suggesting that you can identify an AI-generated voice by asking unusual questions, listening for pauses, checking background noise or trying to make the caller say or do something unexpected.

These characteristics may occasionally make a suspicious call seem unusual, but they should not be relied upon to determine whether a caller is legitimate.

You do not need to determine whether a voice is real or artificially generated. You only need to verify whether the person actually made the request.

Don't Depend on Voice Recognition Alone

Someone sounding exactly like a person you know is no longer sufficient verification for an important financial request.

The safer approach is:

• End the unexpected communication.
• Contact the person yourself.
• Use a telephone number or communication method you already know.
• Confirm the situation through another trusted person or channel when appropriate.

Protect What You Share Online

Publicly available recordings, videos and personal information can potentially give criminals more material to use when creating convincing impersonation scams.

• Review social media privacy settings. Consider who can see your videos, photographs and personal information.
• Think about what you share publicly. Family relationships, travel information, workplaces and other personal details can help a scammer create a convincing story.
• Be cautious about unnecessary requests for voice recordings. Understand who is collecting the recording and why.
• Protect your important accounts. Use strong, unique passwords and multifactor authentication when available.

You do not need to stop posting photographs, videos or speaking online altogether. The goal is to make thoughtful decisions about what information is publicly available and who can access it.

Warning Signs of an AI Voice Impersonation Scam

Focus on the circumstances surrounding the call rather than trying to analyze the voice itself.

Warning signs include:

• An unexpected request for money.
• An emergency that requires immediate payment.
• A demand for secrecy.
• Pressure to act before contacting anyone else.
• A request for a password or authentication code.
• A request to transfer money to protect it.
• An unexpected change to payment instructions.
• A request involving gift cards or cryptocurrency.
• An unusual request supposedly coming from an executive or coworker.
• A caller who discourages you from hanging up and verifying the situation.

Use Multifactor Authentication

Enable multifactor authentication on important email, financial and other online accounts when available.

MFA provides an additional security layer if a criminal obtains or guesses a password. However, never approve an authentication request that you did not initiate and never give an authentication code to an unexpected caller.

For Businesses: Build Verification Into Your Procedures

• Require independent verification of unusual payment requests.
• Verify changes to vendor payment instructions using established contact information.
• Use appropriate dual approvals for significant or unusual transactions.
• Protect email, financial, payroll and administrative accounts with multifactor authentication.
• Train employees that a familiar voice is not sufficient verification.
• Encourage employees to stop and verify. Staff should not be criticized for delaying a transaction long enough to follow established fraud-prevention procedures.
• Maintain an incident-response process. Employees should know whom to contact when they suspect impersonation, compromised credentials or fraudulent payment instructions.

What About AI Voice-Detection Software?

Technology may help identify some synthetic or manipulated audio, but detection should not be treated as guaranteed proof that a voice is authentic or artificial.

For consumers and employees, independent verification is generally more practical: confirm the identity and request using a trusted communication method rather than relying solely on software or the sound of the voice.

If You Sent Money or Shared Information

• Contact your bank or credit union immediately if you sent money, disclosed financial information or believe an account may be at risk.
• Ask whether a payment can be stopped, recalled or otherwise recovered. Available options depend on the payment method, timing and circumstances, and recovery cannot be guaranteed.
• Contact the payment provider promptly if a payment app, wire service, cryptocurrency platform, card or another provider was involved.
• Change affected passwords using a trusted device.
• Enable multifactor authentication if available.
• Review accounts for unauthorized activity.
• Preserve evidence. Save telephone numbers, voicemail messages, recordings, text messages, emails, payment instructions and transaction records.
• Report suspected fraud to the Federal Trade Commission at ReportFraud.ftc.gov.
• Report internet-enabled fraud to the FBI's Internet Crime Complaint Center at IC3.gov.
• Visit IdentityTheft.gov if your identity or personal information was stolen or misused.

Remember: Verify the Request, Not the Voice

AI voice technology means hearing a familiar voice is no longer enough to establish someone's identity.

If a caller asks for money, credentials, sensitive information or an unusual action, stop and independently contact the person or organization using a communication method you already trust.