A caller sounds exactly like your child, grandchild or another person you trust. They say something has gone badly wrong and they need money or information immediately. But the familiar voice may have been created by artificial intelligence.
This type of fraud is often described as vishing, meaning phishing conducted through a voice call or voice message. When artificial intelligence is used to imitate a real person, it may also be called an AI voice-cloning impersonation scam.
What is AI voice cloning?
Voice-cloning technology analyses recordings of somebody speaking and creates new audio that sounds like that person. Recordings might come from videos, podcasts, voicemail greetings or material shared publicly online.
The technology itself has legitimate uses, but criminals can use it as part of a convincing false story. Ofcom has warned that generative AI voice clones could be used over the phone to impersonate loved ones.
A criminal may also know names, relationships, workplaces or travel plans collected from social media or a previous data breach. Hearing a recognisable voice alongside accurate personal details can make the call feel genuine.
What might the caller want?
The immediate request may be for money, but some calls are designed to collect information that can be used later. Be suspicious if anyone unexpectedly asks for:
- your address, date of birth or National Insurance number;
- bank or card details;
- passwords, PINs or memorable information;
- a one-time security or verification code;
- answers to account-recovery questions;
- access to your phone or computer;
- a payment, gift card purchase or transfer to a “safe account”.
A genuine bank, the police or another trusted organisation will not ask for your full password or PIN, and will not tell you to move money to a safe account.
A common family-emergency story
The caller may claim to have lost a phone, been arrested, had an accident or become stranded while travelling. They may insist that you keep the situation secret or say that somebody else will call with payment instructions.
Urgency, fear and secrecy are warning signs. They are intended to stop you checking the story with anyone else.
A familiar voice is not proof of identity
Do not rely solely on how somebody sounds, the name displayed on your phone or personal details they know. Caller ID can be spoofed so that a call appears to come from a genuine person or organisation.
If an unexpected caller asks for money, information or access to a device:
- Stop. Do not share anything or make a payment.
- End the call. A genuine person will understand why you need to check.
- Call back independently. Use a number already saved in your phone or another trusted way of contacting them.
- Check with somebody else. Contact another family member if you cannot reach the person directly.
- Contact organisations through official details. Use the number on the back of your bank card, a statement, the bank’s app or its official website.
Create a family safe phrase
Agree a private phrase or question that close family members can use during an unexpected emergency call. Choose something that is easy for your family to remember but would not be obvious from social media.
Do not use the phrase as a password for any online account. Change it if you believe somebody outside the family has learned it.
A safe phrase is an extra check, not a replacement for calling the person back independently.
If you have already shared information
- Contact your bank or card provider immediately using an official number. If your bank supports it, you can call 159 to be connected safely.
- Tell the bank exactly what information or security codes were shared.
- Change affected passwords, starting with your email account, and do not reuse passwords.
- Check accounts for unfamiliar activity and review their recovery details.
- If you gave somebody remote access to a device, disconnect it from the internet and seek trusted technical help before using it for banking.
Report the call
For a suspicious mobile call, send a text to 7726 containing the word Call followed by the caller’s number. This is free and helps your mobile provider investigate.
If money has been lost or an account has been compromised, contact your bank immediately and report the incident to Report Fraud. In Scotland, contact Police Scotland on 101.
Remember
Voices can be copied. Caller ID can be changed. Urgency can be manufactured.
Ending the call and checking independently is not rude. It is one of the most effective ways to protect yourself and your family.