AI-cloned voices in phone scams: what's real and how to defend yourself

The phone rings and you hear your child's voice, crying, begging for urgent help. The tone, the little gestures in their speech, even that catchphrase of theirs. And yet it could be fake. Today, artificial intelligence can clone a voice from very little audio, and that voice is being used in phone scams. Here we separate fact from fiction and give you a concrete plan.

What is an AI-cloned voice and why should you take it seriously?

AI voice cloning means creating a synthetic copy of a person's voice from audio samples. With that clone, a scammer can generate new sentences the person never said, in their own timbre, accent and intonation. It's not a metallic robot from ten years ago: it sounds human, hesitant, frightened. It's exactly what you'd expect from someone in trouble.

INCIBE has documented this type of fraud, which uses a relative's voice created with artificial intelligence. The pattern is always the same: the criminal obtains a snippet of someone's voice, clones it and calls pretending to be someone you trust, asking you for money right away.

What makes this scam so dangerous isn't the technology itself. It's that it attacks the one filter you trusted blindly: recognising the voices of your loved ones. For years, the golden rule against vishing has been "verify through another channel". The cloned voice exists precisely to make you let your guard down before you ever reach that verification.

How do they get your voice and set up the call?

It's worth understanding the mechanism without dramatising it. The audio of your voice isn't a well-kept secret: it's more exposed than you think.

• Social media. Videos on TikTok, Instagram, YouTube, stories, group voice notes. A few seconds talking to the camera are enough as raw material.
• Voice notes. The audio clips you send via messaging apps circulate and get forwarded far more than you'd imagine.
• Recorded calls. Sometimes the scammer calls you beforehand with some excuse just to record you talking.
• Answering machine and voicemail. Your recorded greeting is a clean sample of your voice.

With that material, the voice clone is generated using tools that are widely accessible today. Then they set up the call. And here a second layer of deception comes in, one you already know: caller ID spoofing, or spoofing, which makes a familiar number, or one with your same area code, appear on your screen. A believable voice plus a believable number: the combo is designed so you won't doubt it.

A tactical detail that shows up in real cases: they often don't want you to talk much with the "relative". In a case documented in Spain, the cloned voice of a husband said "I can't call you, send me a message at this number". Why? Because the longer the conversation, the more likely the clone is to slip up. They want to wrap it up fast and divert you to a written channel where the voice no longer gives them away.

How does this scam differ from old-school vishing?

It's important not to confuse it with other fraudulent calls. Classic vishing impersonates your bank or the tax office with an unknown voice and a high-pressure script. The cloned voice goes a step further: it doesn't impersonate an institution, it impersonates a person you love.

The key difference is in the last "emotional lever" row. Fear of a fine leaves you a few seconds to think. Panic over a child does not. And that's exactly the spot where scammers want to have you.

What's real and what's exaggeration?

As with everything surrounding AI, there's a lot of noise. Let's get specific.

It's real:

• That a voice can be cloned from short audio samples. INCIBE records this in its real cases.
• That the resulting voice sounds convincing over the phone, where audio quality is already low and masks the clone's flaws.
• That it's combined with number spoofing to reinforce the deception.
• That the goal is always an urgent, irreversible payment.

It's exaggeration or an important nuance:

• That the clone is perfect. It isn't. In long conversations, when faced with unexpected questions or complex emotions, the clone falters: odd intonations, strange pauses, answers that don't fit.
• That anyone can be a victim with no possible defence. That's not true. There's a simple move that defeats the deception almost every time, and we'll see it below.
• That you need advanced technology to protect yourself. You don't. The best defence is a family agreement and a habit.

In the Spanish case documented by the press, the woman noticed that "something sounded off", hung up and called her husband directly. It was a deepfake. That instinct, combined with verifying through another channel, is exactly what works.

How can you defend yourself? The family safe word and other habits

Here's the plan. It's not complicated and it works for the whole family.

1. Agree on a family safe word. It's the most powerful defence and the simplest. As a family, choose a secret word or phrase that only you know. Don't write it down on social media or in chats. If someone calls asking for urgent money "on behalf of" a relative, you ask them for the word. A scammer with a voice clone won't know it. Pick a word that isn't obvious (not the pet's name, not a birthdate) and that you've never written down online.

2. Hang up and verify through your usual channel. This is the golden rule against any phone fraud, and here it's decisive. Hang up and call that person yourself on their usual number. If you're told "that phone isn't working", call another relative who can reach them. Don't use the number you were called from, nor the new number you're given.

3. Ask a question a stranger couldn't answer. Something specific and personal: "where did we have lunch last Sunday?", "what's your maths teacher's name?". The clone mimics the voice, not your shared memories.

4. Slow down the urgency. Haste is the weapon. No real emergency demands a transfer in the next five minutes without your being able to check anything. If they rush you, that rush is the warning sign.

5. Be wary of a channel switch. If the "voice" wants to move you quickly to a text or WhatsApp on a new number, be suspicious. It's the manoeuvre to stop you hearing the clone and lure you into a link or payment number.

6. Reduce your voice footprint. You don't need to delete your social media, but bear in mind that public audio is raw material. Adjust the privacy of your profiles and think twice before posting long clips of yourself talking to the camera.

Golden rule: when faced with a call asking for urgent money, it doesn't matter whose voice it is. Hang up, breathe and verify through a channel you control. The voice is no longer proof of identity.

What if the victim is an elderly person?

Older people are a prime target in this scam, because they combine three factors criminals look for: less familiarity with AI, a strong emotional bond with children and grandchildren, and sometimes more savings on hand. If you have elderly relatives, the conversation is urgent.

• Explain the concept without jargon: "they can now imitate my voice over the phone with a computer".
• Agree on the safe word together and make it crystal clear to them.
• Leave a little note by the phone: "If they ask for urgent money, hang up and call [your number]".
• Insist that hanging up is never rude when money is involved.

There's a dedicated guide on how to protect elderly people from phone scams. Share it in the family group chat.

What do I do if I've received or fallen for one of these calls?

Act calmly but without delay.

If you received it but didn't pay:

1. Don't call back the number that appears.
2. Verify that your relative is fine through the usual channel.
3. Report the number on NoCall to warn the community.
4. Report it to INCIBE on 017 (also via WhatsApp on 900 116 117), their free cybersecurity helpline.

If you've already made a transfer or a Bizum:

1. Call your bank immediately to try to stop or reverse the operation. Time is critical.
2. Gather evidence: screenshots of the number, time, amount, any message received.
3. File a report with the National Police or the Guardia Civil with that evidence.
4. Inform INCIBE 017 for guidance on the next steps.

You'll find the full process, with the order of priorities, in our guide what to do about a call from an unknown international number and in the rest of the NoCall guides.

In summary

The AI-cloned voice is a real threat, not an alarmist headline. The technology exists, it's accessible and it's combined with number spoofing to seem even more believable. But it has a clear weak spot: it doesn't know your secrets or your safe word, and it can't withstand verification through another channel.

Internalise a single idea: the voice no longer proves who's calling. From there, a word agreed within the family and the habit of hanging up and checking are enough to dismantle the scam.

Have you received a suspicious call or think you've been targeted by this scam? Report it in the NoCall directory and check the number before returning any call. Every report helps protect the whole community. If you want to go further, review the phone spam trends and learn to read the risk signals of a number.