AI Voice-Cloning Scams: How to Check a Fake Call
Do not rely on a familiar voice alone. End the call and independently contact the person or business through a known route.
BMR Digital · Source review 2026-11-06 · UK English
A familiar voice is not sufficient proof
AI voice-cloning scams exploit the instinct to trust a voice you recognise. A caller may sound like a relative, manager or supplier and claim that money is needed urgently. You do not have to determine whether the voice was made by AI to protect yourself. The practical response is the same for a convincing impersonation, a manipulated recording or an ordinary fraudulent call: pause, end the interaction and verify independently. Caller ID can also be misleading, so the displayed number is not enough. Avoid feeling obliged to solve the claimed emergency while the caller keeps you on the line. An honest person can wait while you check through a known route. Explain this approach to family members before a crisis, especially anyone who may feel embarrassed about asking questions or who is likely to respond quickly to a distressed-sounding voice.
Recognise pressure rather than looking for perfect audio clues
Old advice about robotic voices is unreliable because an impersonation may sound natural and a genuine call may have poor audio. Look instead at the request. Is the caller insisting on secrecy, immediate transfer, gift cards, cryptocurrency or a new bank account? Are they discouraging you from contacting another person? Do they claim that ordinary verification will make the situation worse? None of these signs proves that AI is involved, but they are useful reasons to stop. Do not make a checklist of small audio glitches your only defence. A scammer can adapt a script, while genuine callers can stumble over words. Focus on the action being demanded and whether you can check it safely. If a call claims someone is in immediate danger, contact emergency services through the proper independent number rather than sending money to the caller.
Call back using a number you already know
End the call and use a trusted number stored before the incident, or obtain a number from an independently verified source. Do not use a callback number supplied by the suspicious caller or a link sent during the conversation. For a family member, contact their normal mobile or another trusted person who can check on them. For a business, use the established supplier contact or your internal directory. If you cannot reach anyone, continue trying appropriate independent routes rather than treating silence as confirmation. On a landline, be aware of advice about ensuring the previous call has ended before dialling; another device can be useful. The aim is to break the attacker’s control of the conversation. This simple interruption helps whether the scam uses synthetic audio, a stolen account or someone pretending to be an official.
Family code words can support, not replace, verification
Some households agree a private phrase for unexpected urgent requests. It can be useful if everybody understands when to use it and keeps it out of public posts and AI conversations. Choose something not easily guessed from social media. Do not publish the phrase while explaining your family security routine. A code word is only one layer: it can be overheard, accidentally shared or obtained from a compromised device. If someone gives the correct phrase but asks for an unusual transfer, verify independently anyway. Make sure the system does not exclude a relative who has memory or communication difficulties. Agree an alternative route through another trusted person where appropriate. A family rule should reduce pressure, not create a test that makes someone ashamed to seek help. The essential habit remains to stop and contact a known person separately.
Businesses need payment-change controls
A convincing voice should never be enough to change supplier bank details or approve an exceptional payment. Establish a callback procedure through existing contact information and require a second authorised person for significant changes. Do not accept the number written in a new payment-change email as the independent check. Compare the request with normal purchase orders, invoices and approval limits. Staff should know they can challenge a request apparently coming from the owner without being punished for delaying it. Fraudsters often rely on hierarchy and urgency as much as technology. Write the check into the payment workflow so it applies consistently, including busy periods and holiday cover. A small business does not need elaborate software to create a useful pause. It needs a clear rule, trusted contact details and someone responsible for confirming the change before any money leaves.
If money or information has already been sent
Contact your bank or payment provider immediately using the official app or a trusted number, not one from the suspected scam. Explain what happened and follow its instructions about attempted recovery and account protection. If you shared a password, change it and any reused versions, then review login sessions and authentication. Keep useful evidence such as the time, number displayed, payment reference and relevant messages without forwarding private information unnecessarily. Follow current police or national fraud-reporting guidance for your location. In Scotland, check Police Scotland’s reporting advice rather than assuming a UK service applies identically everywhere. A victim should not be blamed for finding the impersonation convincing. Quick practical action matters more than debating whether the call was technically a deepfake. Be alert for a second scam promising to recover funds for an upfront payment.
Practise a short sentence before you need it
A prepared response helps under pressure: “I will call you back on the number I already have.” You do not need to accuse the caller or win an argument. Practise with relatives and colleagues so that the pause feels normal. Store verified contacts and review any payment-change process before a busy period. Reduce unnecessary public exposure of personal routines and contact details, but do not assume that removing one recording makes impersonation impossible. The Safety & Privacy Playbook covers personal checks alongside other AI risks; the Small Business guide is more relevant for staff and supplier-payment procedures. Use the free checklist to start a conversation with someone who is unfamiliar with AI. The goal is not to identify every fake voice perfectly. It is to stop a convincing voice from being the sole authority for handing over money, secrets or account access.
Official sources and further checks
Provider settings can change and differ by account, plan and location. Check the current official instructions for the service you actually use. This is independent educational guidance, not a safety or legal compliance guarantee.
A printable next step
Compare The AI Safety & Privacy Playbook for the stated printable guidance, or start with the free checklist. Only genuine uploaded files are offered for download.
View The AI Safety & Privacy PlaybookUseful AI safety reading
All resourcesChatGPT Privacy Settings: What Each Control Does
Training, history, memory and connected apps are separate ChatGPT controls. Review each one before sharing personal or customer information.
AI Safety for Children: A Parent's Starting Guide
Begin with age rules, private information, supervised chatbot use and calm family conversations about deepfakes and misleading answers.
AI Policy for Small Business: Simple UK Starter Guide
Set approved tools, prohibited data, human checks and incident reporting before staff use generative AI for customer work.
AI Voice-Cloning Scams: How to Check a Fake Call
Do not rely on a familiar voice alone. End the call and independently contact the person or business through a known route.
What Not to Share With AI: Practical Examples
Keep passwords, identity documents and unnecessary personal or confidential details out of AI prompts. Use fictional examples and minimise data.
Gemini Activity & Privacy Settings Explained
Review Gemini Keep Activity, deletion, connected services and account type separately; switching off activity does not mean no processing or retention.
Claude & Copilot Privacy Controls Compared
Compare account type, training preferences, history, memory and connections rather than assuming Claude or Copilot is completely private.