How to Spot a Voice Deepfake and Protect Yourself from Scammers
Sergio Bertoni, Leading Analyst at SearchInform
Scammers no longer need acting skills or expensive equipment to speak in someone else’s voice. Generative AI can reproduce a person’s tone, pauses and speaking style from short publicly available recordings in minutes. More importantly, the technology is now cheap and accessible to people without specialist skills. Apps run on ordinary smartphones, while fraudsters tailor calls using information collected in advance about a target’s family and work.
Here is why voice deepfakes have become a serious threat, how to recognize an attack and what to do if you have already sent money.
A threat on a much larger scale
Voice deepfakes are not new. For years, however, they were expensive and technically demanding. Producing convincing audio required powerful equipment and sound-processing specialists.
That barrier has fallen. Publicly reported cases and industry research indicate that deepfake-enabled fraud is growing. In 2025, 62% of organizations experienced a deepfake attack involving social engineering or exploiting automated processes (Gartner).
The main reason is lower cost. Changing a voice, even in real time, no longer requires powerful hardware or specialist expertise. Low-cost tools can produce convincing results with a few clicks, and instructions for training models are openly available.
A fraudster may need only about 30 seconds of clean speech to clone a voice. The model can imitate not just timbre but also characteristic pauses, filler words, pace and intonation.
Case study
A manager at the Hong Kong branch of a Japanese company authorized transfers totaling USD 35 million after speaking with someone whose voice sounded like the company director’s. The caller referred to an acquisition and said a lawyer would coordinate the payments. Confirmatory emails then arrived from the supposed director and lawyer. UAE investigators said at least 17 people were involved and the funds passed through accounts in multiple countries.
UAE authorities later sought US assistance in tracing some of the money sent to American banks. The case became public through UAE court documents.
Is that voice genuine?
An attack usually starts with gathering publicly available information about the target. Fraudsters obtain a manager’s or relative’s voice from speeches, social media stories, recorded work video calls or short voice messages forwarded to others.
The target then receives a call or voice message demanding an urgent payment, transfer or disclosure of information. The scammer typically invokes an emergency to pressure the person into acting immediately.
Modern deepfakes are increasingly hard to distinguish by ear. Models can imitate a raspy voice and speaking pace, as well as trembling, rapid breathing, crying and background noise. If a target knows a relative is at a shopping mall, the call may include crowd sounds. The context feels right, and suspicion fades.
Case study
Sharon Brightwell of Dover, Florida, received a call from her supposed daughter. Crying, the caller said she had been in a car crash, lost her unborn baby and faced criminal charges. A supposed lawyer then asked for legal fees. Brightwell handed USD 15,000 in cash to a courier. Only after speaking with her real daughter did she realize the voice had been cloned with AI.
How to recognize an attack on a company
Such attacks succeed less because of perfect technology than because of effective social engineering. Fraudsters exploit executive authority, create artificial urgency and persuade employees to act before consulting colleagues.
Any unusual financial instruction received via a messenger, video call or personal phone number should trigger verification. Be especially cautious when the caller:
- demands that the conversation remain confidential;
- insists that funds be transferred immediately;
- asks for payment to unfamiliar bank details;
- requests a transfer to a private individual.
Other warning signs include a newly created account, an unusual communication style, a misspelled contact name or technical artifacts during a video call.
Case study
Capillary Technologies, a Bengaluru-based SaaS provider of loyalty software, disclosed that a recently acquired overseas step-down subsidiary had fallen victim to cyber-enabled banking fraud.
Attackers impersonated senior executives using voice cloning, forged signatures and social engineering. Employees were persuaded to authorize transfers of approximately EUR 3 million to third-party accounts. The incident occurred just before a weekend. The company immediately recovered EUR 450,000 and had other accounts frozen. The subsidiary held cybercrime and crime insurance.
The audit committee engaged KPMG to conduct a forensic review of the transactions and internal financial controls.
Rules for staying safe
There is no universal defense against deepfakes. A few straightforward rules can help, but only if they are followed consistently.
- Hang up and call back. If someone claiming to be a relative or executive makes an unusual request – to transfer money, disclose a one-time SMS code or share card details – end the call and use a number already saved in your contacts.
- Resist pressure. “It has to be now,” “my battery is dying” and “I cannot talk, I will call later” are common tactics. Taking time to verify is safer than trying to recover a rushed transfer.
- Protect voice recordings. Avoid forwarding voice messages from executives and relatives into group chats. The fewer clean voice samples available publicly, the harder it is to produce a convincing clone.
- End suspicious calls. Even short speech samples can help train a voice model, so continuing a suspicious conversation may give a scammer more material.
If a payment has already been made, take these steps:
- Contact your bank using its official number and ask whether the transfer can be recalled. If it has not been completed, the bank may be able to stop it and begin recovery procedures.
- If you shared SMS verification codes, change passwords for email, messaging and other relevant accounts, and enable multi-factor authentication wherever available.
- Preserve incident evidence, including the phone number, call recording and screenshots of messages. These may support technical analysis.
- Report the incident to the appropriate police or cybercrime authority.
The bottom line
A familiar voice is no longer reliable proof of identity. In business, every financial instruction received by voice should be confirmed through a second, independent channel, just as a password alone is no longer sufficient for secure sign-in. Verification takes a minute and costs nothing. Making it a formal internal procedure also removes the burden of deciding under pressure from individual employees.
ABOUT SEARCHINFORM
SearchInform is an information security and risk management product vendor as well as an MSS provider. The company's clients are more than 4000 companies in 20+ countries. Today, the team has products and services for comprehensive protection against insider threats at all levels of corporate information systems: FileAuditor (the DCAP class solution); DLP system with extended functionality; Risk Monitor (advanced platform for internal threat mitigation); SIEM system, Information Security outsourcing service.
