Voice Cloning AI Scams Are on the Rise

If someone calls you and says, "You've won the lottery!" you likely know what to do: Hang up because it's probably a scam. But what if the voice on the other line is your child — and they're in trouble?

That's what happened to Jennifer DeStefano, who received a call from an unknown number and heard the panicked voice of her daughter, who was in danger and needed a $1 million ransom paid to her kidnappers, according to CNN. Thankfully, Jennifer confirmed her daughter was safe and didn't part with any money, but the experience was terrifying.

As scammers find new ways to steal your money, federal officials are warning consumers to be aware of cloned voices and devising creative ways to fight back. In March 2024, the Federal Trade Commission chose winners for its "Voice Cloning Challenge." The FTC awarded $35,000 to innovative researchers offering ways to detect and prevent AI voice cloning and protect consumers.

How Does AI Voice Cloning Work?

The growth of artificial intelligence has made it easier for criminals to clone voices and create almost perfect requests that sound just like people you know.

In fact, according to FTC reports, in 2023, the U.S. lost $2.7 billion to imposter scams alone. These include scammers pretending to be the government, your bank's fraud department, a technical support expert or a distressed friend or relative.

"Scammers can pull pieces of a person's real voice and have an AI tool use those voice patterns to create synthetic conversations, copying and manipulating your voice," said Sean Murphy, a Senior Vice President and the Chief Information Security Officer at BECU.

Murphy said even a small number of recorded words from a voice recording is enough for AI tools to successfully imitate a person's voice. According to the FTC, these short audio clips can be pulled from content you post online — such as on TikTok or Instagram. The audio is added to programs, and the scammer can simply type words for the clone to repeat.

Voice artists may also have their voices "stolen" and repurposed for nefarious purposes, according to the FTC.

"Sometimes we just see feelers," Murphy said. "For example, the AI call you receive may ask you seemingly innocent questions, just getting you to say, 'Hello, who is there?' to gather voice patterns that the scammer will use later to impersonate you."

AI Scams Are More Sophisticated

Technology used to scam people extends beyond voice impersonations. Images of people who don't exist are used to create false social media profiles, and "deep fake" videos can be manipulated to show real people doing things they didn't do.

Murphy said it's all an effort to increase the efficiency and effectiveness of what digital security professionals call "social engineering." AI detects behavioral patterns that make it easier for scammers to target you and convince you to provide access to personal information.

"The most likely way many people may be at risk is someone trying to get your credentials, like your password or challenge question information," Murphy said. "They might use that information to pretend to be an account owner and try to get someone to give them account access. With the addition of AI capabilities and social engineering, attackers can be even more convincing to gain unauthorized access."

Using AI To Fight AI

Online scams might make AI sound scary, but Murphy said to remember that legitimate organizations use AI for positive voice-related purposes, too.

For example, the FTC challenge winner used AI algorithms and learning to look for subtle discrepancies that identify deep-faked voices from the real thing.  And at least one large financial firm allows customers to opt into a digitally encrypted "voice fingerprint" system to use as a security measure instead of passwords.

"AI can be both good and bad," Murphy said. "From a cybersecurity perspective, BECU is using AI to help us develop tools and techniques to protect our own systems. We find patterns and create defenses that are more predictive and proactive, rather than being reactive."

Murphy said many organizations use AI to teach their computers to detect when other computers are trying to penetrate their cybersecurity measures.

Preventing Scams

When in doubt, be cautious when any urgent requests arise, even if it sounds just like a loved one, Murphy said. The FTC recommends calling back the family or friend using a known phone number or contacting other shared friends and family.

The FTC is also seeking to actively intervene. A 2024 proposed protection would prohibit impersonating an individual, and make it unlawful for companies to knowingly release AI voice tools that can do so.

In the meantime, "you can protect yourself by maintaining the skepticism you have when there is a sense of urgency or an offer that is too good to be true. Unsolicited phone calls from unknown sources should raise your concerns," Murphy said.

"Limit the information you are willing to share," he said. "If they are claiming to be from BECU and ask for personal information that we should already know, hang up and contact us directly to be sure."

Never provide your Social Security number, full bank account number, username or password.

6 Tips To Protect Yourself From Scams

Follow these tips to protect your personal data and finances:

1. Protect Your Information

Unless you're certain you're talking with a trusted source, be skeptical about requests for your information. Never give a caller passwords, authentication codes or personal information, even if they sound familiar. It could be a voice recording trying to capture your voice pattern.

2. Be Suspicious of Urgency

Don't click on urgent-sounding links. Also, be extremely hesitant when replying to requests for money transfers or payments, cryptocurrency or bank wires.

3. Avoid Unverified Offers for Prizes

Assume that if a prize or deal is too good to be true, it probably is.

4. Take a Pause

Pause when confronted with any deal or notice of a discontinued service that requires urgent action. Most reputable companies will give plenty of time to communicate a special offer or discount and won't ask you to log in and provide your account number.

5. Contact a Trusted Source

Hang up and call the company back using the phone number you know is theirs. Look up the number on the company's website or in your own contacts. Don't call back the number that just called you or use a number in an email or text message you received from the caller.

6. Report Fraud

If you suspect fraud, the FTC wants you to report it. Learn how to help fight fraud on their website.

Basic Scams Still Rule

Although AI-driven scams are interesting and scary, Murphy said you're more likely to encounter basic attempts at fraud and theft. These include password phishing emails, text messages and spoofed websites, where scammers try to convince users to give up their login information.

"I hope people don't worry so much about highly technical, sensational attacks that they look past basic attacks that are far more common," Murphy said.

Anyone can fall prey to a scam, too. According to recent FTC data, younger adults between 20 and 29 reported losing money more often to scams. However, older adults age 70 and older lost the most money.

If people want to protect themselves most effectively, Murphy advises learning and practicing the basics of online security.

"A healthy dose of skepticism is good," he said. "Just take an extra second to look for red flags."

Related Content