The rise of AI voice cloning: A new era of phone scams begins

Imagine being woken up late one Tuesday night by a phone call from your young relative. They’ve been in a car accident and urgently need money sent to their phone, not having their wallet on them. The connection is bad but it does sound like them. Still groggy and confused, you start making the transfer.

Only it’s not them calling you, they’re asleep, safe and sound. You’re talking to a robocall, steered by a scammer and made from a spoofed number. The scammer has cloned your relative’s voice by using their TikTok videos to train a so-called AI model. They’re sitting at a keyboard, guiding the conversation, probably from a country halfway around the globe.

Let’s take a closer look at what’s happening here. There are two threads that come together in these kinds of scams: the popularity of imposter calls (even as robocalls continue to decline) and the increasing availability of voice-cloning technology.

Imposter calls holding steady

According to an Incogni study, reports of unwanted calls in general, and robocalls in particular, had generally been on the decline from 2017 to 2023. Still, robocalls accounted for 55% of all reported unwanted calls in 2023, even though the ratio of robocalls to live calls was also in decline from 2021 (3.1 robocalls to every live call) to 2023 (1.6:1).

Drilling down into the topics covered during unwanted calls, the same study found that “imposter calls” held steady as being the most common type of call from 2019 to 2023, making up around a third of all reported calls in 2022 and 2023. Imposter calls were defined as “all unwanted calls where the caller impersonated someone else, an agency, or a company.”

To impersonate someone, a scammer would need not only their number and yours, but also some basic information like the person’s name, age and sex. To make a more elaborate imposter call convincing, they’d need a whole host of additional personal data, like ethnicity, hobbies, shopping habits, online activity, criminal and court records, even sexual preferences. This is exactly the kind of data a personal information removal service like Incogni removes from circulation, online and off.

There’s a significant proportion of unwanted calls that rely on impersonation. It’s reasonable to assume that a large number of these calls are scam calls, as it’s difficult to imagine a legitimate reason for a caller pretending to be someone else. What happens when new technologies make it easier for scammers to impersonate not only celebrities and politicians, but everyday people as well?

Voice-cloning technology enters the mix

Recent advances in “AI” technology have resulted in high-quality voice-generating and voice-cloning software being readily available, often for free. These technologies make the nightmare scenario of someone cloning the voice of a loved one and impersonating them on the phone possible.

Combined with number spoofing (making Caller ID display a number different from the one they’re calling from) and the availability of vast amounts of personal information online—including, for many people, voice-samples—these technologies can make for some extremely convincing impersonations.

Here’s how a criminal could execute such a scam:

Step 1: Target selection

If they’re going to go after you, it’s going to have to be worth their while. Scammers can:

• Buy a ready-made list of people vulnerable to scams directly from a data broker,
• Browse data broker records, looking for the perfect victim (like someone who’s older and has just sold a property, for example),
• Buy or download breached or leaked data sets on the dark web,
• Come across your social media profiles and decide to target you based on what you share there.

Ultimately, anything that suggests to a scammer that you both have something worth stealing and are sufficiently gullible is enough to make you a target.

Step 2: Background research

A scammer is going to need to know at least a few key things about you if they’re going to target you with a convincing scenario. These are some of the more common data points used in impersonation scams:

• Full name,
• Contact details, like phone number, email and address,
• Employment history,
• Educational background,
• Financial situation,
• Criminal history,
• Relatives,
• Known associates.

And, of course, they’ll need a similar set of data points on each of your relatives and associates, especially if they’re going to be impersonating one or more of them. Where can they find all this data, nicely packaged into detailed profiles?

Data brokers are companies that specialize in collecting, organizing, and monetizing personal information just like this. With trial memberships available for as little as $1, basically anyone can end up with detailed profiles on you and your close ones with just a few clicks. Personal information removal services like Incogni take these profiles down and request that data brokers stop collecting your data.

Step 3: Collecting voice samples (optional)

If the scammer is planning on impersonating someone over the phone, they’ll need some recordings of that person speaking to give their “AI” software something to imitate. If you post videos of yourself on social media, have a YouTube channel or have appeared on a podcast, this won’t be a problem for them.

Step 4: Number spoofing (also optional)

Again, if the scammer is impersonating someone close to you, it’d be more convincing if the call appeared to be coming from that person’s number. There are several ways to achieve this at little-to-no cost to the scammer, although it might require some technical know-how.

They can’t spoof a number they don’t know, though, so having this kind of personal data purged from the internet can stop even these very technical attacks dead in their tracks.

Step 5: Execution

By now, the scammer now knows a lot about you, about the person they’re going to impersonate, and your shared network of friends, colleagues and relatives. They just need to choose the right time (often when you’re likely to be tired, in a rush or distracted) and make the call.

The relative simplicity of perpetrating a fraud like this goes some way to explaining why the FCC made the use of “AI-generated voices” in robocalls illegal in 2024. Of course, making something illegal only discourages law-abiding people from doing it—scammers are unlikely to take notice.

You might be feeling pretty safe at this point: maybe your loved ones don’t have any voice-recordings out there for the scammer to sample, maybe your phone or carrier has anti-spoofing measures in place, maybe you’re confident that you’d pick up on the fake voice, even if the scammer lowers the audio quality and adds background noise.

The fact is, if you’re an everyday person with not much of an online presence and not much in the way of money to lose, then it’s unlikely you’d be targeted with such an involved scam.

The more likely nightmare scenario

We started with a scenario in which a scammer clones the voice of someone close to you. But we also saw that the voice-cloning and number-spoofing steps are optional—how so? Well, if the scammer knows enough about you and your close one, they don’t need to impersonate them for the scam to work.

It’s late Tuesday night, you’re asleep when your phone wakes you up. You don’t recognize the number. You pick up. It’s a police officer, he says your young relative has been in a car accident and they’re in custody. Your relative asked the police officer to call you, they want to keep the situation under wraps until they can talk to their parents. In the meantime, they need you to bail them out.

Still groggy and confused, you start making the transfer.

In this scenario, the scammer doesn’t need to sound like anyone in particular, just a random police officer. The need for voice cloning goes away, as does the need for number spoofing. The scammer might still need to synthesize a voice, to cover up poor English skills or a suspiciously strong accent, for example, but that’s easy enough to do.

All they really need is to find your and your relative’s records on a data broker’s website.

What you can do

Staying off social media is always a good idea, but not always feasible. Also, not taking part in recorded interviews or presenting your ideas publicly just to avoid voice-cloning attacks seems like throwing the baby out with the bathwater.

Scammers can’t or at least aren’t likely to target you if they can’t find your information on data brokers’ websites in the first place. They also can’t easily figure out who your friends and family are (especially if you’ve set your social media profiles to “private”).

There’s a big difference between a “police officer” calling you to ask about your nephew Daniel Thomas Walsh, born on the 11th of March, 2006, who drives a blue Silverado and would have been on his way home from work at the pizza place, and the same “police officer” umming and ahhing as he can’t really give any details concerning Daniel other than his name.

Take scammers’ best tool away from them by having your personal information removed from data-broker databases. An automated personal information removal service like Incogni can make this an easy, set-and-forget process.

When choosing a data removal service, look for one that covers a wide range of data brokers, including marketing, recruitment, risk-mitigation, and people-search data brokers. Many services remove data only from people search sites, leaving users exposed.

Incogni covers all four of these data broker types, removing personal information from over 220 brokers in total. It also offers a family plan, so you can keep your and your nephew’s information private.