AI voice cloning scam: the proof is a call you place yourself

She was negotiating a pickup while her daughter was in bed

Jennifer DeStefano, of Scottsdale, told the Senate Judiciary subcommittee on 13 June 2023 what a Friday in April had sounded like. She had answered an unknown number. The voice was her daughter, then 15, sobbing. A man came on the line, threatened the girl, and demanded $1 million, then $50,000 in cash. DeStefano asked for wiring instructions. He refused, she testified, because a wire could be traced, and told her she would be picked up. The hearing listed her as a victim of an AI deepfake kidnapping scam. What kept the cash in the house was not an expert ear.

I didn't believe this was a scam. It wasn't just Brie's voice, it was her cries, it was her sobs that were unique to her.

Another parent in the room called 911 and was told the pattern was known: a program could copy a voice, including the inflection. DeStefano kept negotiating. A different parent reached her husband. He found their daughter safe in bed, with no idea the call was happening. The subcommittee heard her account. The people standing next to her called the father. She was still negotiating a pickup, and she already believed the sobs.

The Federal Trade Commission's version of the same family emergency, published 20 March 2023, is the grandson who wrecked the car and landed in jail. The commission's instruction is blunt: do not trust the voice. Call the person on a number you know is theirs. If you cannot reach them, call another relative or a friend. Its longer note on fake emergencies adds the line the caller will use against that plan: keep this secret. Secrecy is how the call stays the only source. DeStefano's room ignored it. That is the whole success.

A short public clip is enough, and you will not get it all back

The FTC's account of the raw material is a short audio clip of the person, taken from something they posted, plus a program that clones a voice. When the scammer calls, the commission says, the caller sounds like the relative. Some of these calls are one recording played down the line. CNN reported on 29 May 2026 a further step, described by Henry Ajder: a live conversation in which the caller's voice is reshaped while they talk, so they can answer what you ask. The pause can be a person thinking. The sound can still be the relative's, laid over someone else.

A matching voice is evidence that someone has heard the person, the way a copied signature is evidence that someone has seen the name. It is not evidence the person is on this call. The person is wherever their own phone is.

The FBI's 3 December 2024 warning tells you to limit what you post of your face and your voice, to keep accounts private, and to agree a secret word with your family. Do the private-account part for the next clip. It does not pull a recital video out of a cousin's phone, or a voicemail greeting that already says the full name. A public clip is an indicator, in the OPSEC sense: an ordinary trace that points at someone a caller can imitate. The step that matches this caller is the callback, agreed before anyone is scared. An app that claims to hear the fake has no answer for a parent who will not wait to run it. Cloning on this page is a voice or a face. A cloned onion address is a different check.

Familiar faces on the video call were why the money moved

Arup, the engineering firm, told reporters it had notified Hong Kong police at the start of 2024 about a fraud in its Hong Kong office. The company confirmed that fake voices and images were used, and said its financial stability, its operations, and its internal systems were not affected. The network was fine. A person authorized the payments.

Police described a finance employee who, in mid-January, received a message that appeared to come from the firm's UK-based chief financial officer about a secret transaction. Senior superintendent Baron Chan told local media the employee was then on a video conference with many participants. Because those participants looked like the real people, Chan said, the employee transferred HK$200 million to five local accounts, in 15 transactions. On 17 May 2024 police said no arrests had been made, and that they were treating the case as obtaining property by deception. More faces on the call made the request look safer. The faces were fake.

WPP, the advertising group, stopped a similar attempt before any payment. In an email the Guardian obtained, chief executive Mark Read said attackers had opened a WhatsApp account with a public photo of him, then a Microsoft Teams meeting that appeared to include him and another senior executive. On the call, a voice clone and YouTube footage stood in for that other executive. Read was impersonated off-camera, in the chat, and an agency leader was asked to set up a new business so the attackers could take money and personal details. His line in the email: "Just because the account has my photo doesn't mean it's me." He told colleagues to refuse any "secret acquisition, transaction or payment that no one else knows about," and any request for a passport or a transfer. A spokesperson said the executive who received it stopped the attempt. The profile picture was a real photograph of the real chief executive.

Bloomberg reported on 26 July 2024, from people familiar with the episode, that a Ferrari executive got WhatsApp messages purporting to be from chief executive Benedetto Vigna, on a number that was not his, under a profile picture that was. The follow-up call pressed a confidential currency trade in a voice the executive heard as Vigna's, southern Italian accent included. He asked for the title of a book Vigna had recommended days earlier, Alberto Felice De Toni's Decalogue of Complexity. The call ended. Ferrari declined to comment, so the title comes from Bloomberg's sources. A question works when the answer was said between two people and is not in an interview, a caption, or a people-search site. A maiden name, the dog in the profile picture, and the street you grew up on are already published. A correct answer to those only shows that the caller can read.

The FBI's December 2024 warning still tells you to listen for tone and word choice, and to look for distorted hands, bad teeth, and lag in a video. The Arup employee was looking at colleagues. CNN reported on 29 May 2026 that the old audible tells, a strange pause or a fluctuation, may no longer be there, and pointed to Hany Farid's questions instead: a deadline, a demand for secrecy, and an unusual way of moving a large amount of money. Ajder told the same paper it is not fair to expect an ordinary person to spot the fake. Grading a voice while someone who sounds like your child is crying is the wrong job.

American businesses reported $30,256,592 lost in 2025 across 135 business-email complaints the report counts as involving AI, a category that includes a cloned voice asking for a wire. Arup's loss was in Hong Kong, so it sits outside that American total.

The celebrity video is where the reported money is

The FBI report says investment complaints with an AI nexus surpassed $632 million in 2025, while investment fraud overall exceeded $8 billion, which it reads as a sign that many victims never realize a synthetic video or a generated script was involved.

On 29 August 2024 the New York attorney general warned that AI-manipulated videos were putting Elon Musk, Jeff Bezos, and Warren Buffett in front of fraudulent investments, often cryptocurrency, in ads and in fake livestreams. The mouth moves. The voice matches the picture. The alert's sequence after you show interest is a move off the public feed into WhatsApp or Signal, a site that shows the balance rising, a refusal when you try to withdraw, and a fee or a "tax" that has to be paid before any payout. Then the account goes quiet. Later, someone offers to recover the funds and asks for another payment. An encrypted chat hides the messages from the platform. It does not identify the face that told you to open the chat. Which messenger is actually fit for a conversation with a person you know is a separate decision, made before anyone is pitching a coin.

The same tools get aimed at a photograph of an ordinary person. On 5 June 2023 the FBI warned that people were taking benign photos and videos, including images posted on social media, and producing explicit fakes, of adults and of children. As of April 2023 the demands it was seeing were payment, gift cards among the examples, under a threat to send the images to family or friends, or a demand that the victim send real sexual images. The December 2024 fraud warning repeats the extortion use: a pornographic photo of the victim, then a demand for money. Do not pay, and do not send a real image to prove the first one is fake. The message exists to collect one of those two things. Nothing in it deletes the file. File the report at ic3.gov. If the person in the image is a minor, the conversation with the sender is over, and the report goes to the FBI. Limiting who can see the next photo is worth doing. It will not collect the photos already saved on other people's phones. The refusal, when the threat arrives, is the part still in your hands.

Use the number that was in the phone yesterday

Call the number saved before today. If it does not answer, call a third person who would know where they are.

1. End the call. If hanging up feels impossible, say you will call back, and then do that on the saved number. A caller who forbids the callback, because the phone is "tapped" or the case is sealed, is describing the scam. Police and a real relative can survive ten minutes.
2. If the saved number does not answer, call a third person who would know where they are: the other parent, a sibling, the office. The FTC says to do this even when you were told to keep it secret, and especially when you cannot reach the person who is supposed to be in trouble.
3. A code word only helps if they are the one who says it. Agree it in person. Never type it, never pick the dog's name or a maiden name, and never say it yourself on a call you did not place. "I can't, they're listening" means you hang up. If they know the word, you still call the saved number before any money moves. A word leaks. Knowing it means the conversation can continue. It does not approve a payment.
4. How they want the money identifies the call. The FTC names wire transfers, cryptocurrency, and gift cards whose numbers and PINs you read aloud. Cash handed to a courier, or a pickup of you, belongs with those. So does a brand-new payee at work, justified as confidential. A genuine emergency can use an ordinary channel once you have talked to the person on their own phone.
5. The name on the screen is a label the caller supplied. Caller ID shows what the call claims to be. In January 2024, robocalls that used a generated voice in Joe Biden's cadence put a real New Hampshire political operative's number on the display. A familiar number can be the lie.
6. If the voice's solution is a program you install, or a command you paste into a system window, stop. A caller that diagnoses the computer and prescribes a command is the infostealer pattern. Helping your child does not require the Run box.

At a company, write the money rule down before anyone is in a meeting: a new account, or a transfer nobody else is supposed to know about, needs a second person, reached on a number from the directory. Arup's employee had a message and then a room full of familiar faces. The faces were not the second person. The FBI's version for a bank, or any office that calls you, is the same motion: hang up, look up the organization's number yourself, and call that. A code they text you while you are still on the first call is a code you are handing over.

She reached her daughter immediately, after the transfer

CNN reported on 29 May 2026 that Deborah Del Mastro, a mother in California, had sent thousands of dollars that month after a call she believed was her daughter in distress. She called her daughter only after the money moved. The daughter answered right away and was at work. Del Mastro suspects the voice was generated. The suspicion is hers. She paid, and only then called her daughter's own phone. In Jennifer DeStefano's account, other adults reached the father while she was still negotiating, and no cash left the house. Del Mastro's household made that call after the transfer. The daughter answered at work.

If the money has already left, use a number you did not get from the caller. The bank's number is on the card or on the bank's own site. A wire company and a gift-card issuer can sometimes stop a payment that has not been picked up, and they cannot do that from a story you tell the person who just coached you. The FBI asks you to file at ic3.gov with the date, the amount, the account or the wallet that received it, and how the contact started. The FTC takes the same report at ReportFraud.ftc.gov. Bring the gift-card numbers. A crypto transfer you sent is usually gone. The New York attorney general's alert says the transactions are almost always irreversible, and that a later offer to retrieve the funds is how a second payment gets taken. The recovery caller is the same trade, asking again.

A robocall rule does not answer the handset

On 2 February 2024 the Federal Communications Commission adopted a ruling, released on 8 February, that AI technologies which generate a human voice count as an "artificial or prerecorded voice" under the Telephone Consumer Protection Act. Those robocalls need the called person's prior consent, unless an emergency exception or an existing exemption applies. Skipping the consent makes the robocall illegal under that statute. The ruling reaches callers who can still be fined. It does not sit on the phone and refuse a voice.

The New Hampshire calls went out before that ruling. Two days before the 23 January 2024 presidential primary, a campaign the FCC later counted at 9,581 robocalls carried a generated voice in the cadence of Joe Biden, telling people to save their vote for November. The message used his "malarkey" line, and it told recipients their votes mattered in November, not that Tuesday. The caller ID showed a real local political operative's number. Steven Kramer admitted he had arranged the calls. He testified he paid a New Orleans magician $150 to make the recording, and that he meant the calls as a warning about AI. On 13 June 2025 a New Hampshire jury acquitted him of 11 felony voter-suppression counts and 11 candidate-impersonation counts. The acquittal is of those state charges. It does not make the voice Biden's, and it does not erase a separate federal penalty.

The FCC's forfeiture order, adopted 26 September 2024, imposed $6 million for spoofed caller ID used with intent to defraud or cause harm. The order computes that penalty on 3,000 of the 9,581 calls, the subset the Enforcement Bureau said it verified. Lingo Telecom, which transmitted the calls, agreed to a $1 million civil penalty. Kramer told the Associated Press he would not pay the FCC fine. On 25 November 2025 the AP reported he also would not pay $22,500 to three voters under a default judgment in a suit by the League of Women Voters. The district judge's order approving the magistrate's recommendation is dated 20 November 2025. Lingo paid its penalty, Kramer said he would not pay his, and the recording had already reached people's phones.

None of those outcomes filters a handset. The rule that does is short enough to say at dinner, before anyone is scared: we do not move money because of a call, a video, or a voice note. We call the number we already had, and if that fails we call someone else. Ajder's comparison, to CNN, put a parent laughing at you for asking on one side, and a run to an ATM on the other. The laugh is the cheaper one.