Voices can be cloned in seconds; check before you trust

Your phone rings, and you immediately hear a familiar, frightened voice. Perhaps your kid, your partner, or somebody else close to you. They say there’s been an accident or some urgent problem and you need to act now.

That’s the unsettling reality of voice cloning. A short recording, whether posted publicly, shared in a video, or captured from a call, can be enough for modern software to produce speech that resembles a real person.

These tools have legitimate uses in accessibility, localization, and creative work. Yet they also remove a barrier that once protected people from impersonation scams: the ability to sound convincing.

The same technology also underpins countless scams that copy the voices of famous people, which is an entirely different branch of scams that rely on the same cloning shtick.

Key takeaways

• A familiar voice is no longer reliable proof of a caller’s identity
• Publicly available projects can clone or convert voices, including across languages, without a recording studio
• Criminals use cloned voices to add pressure and credibility to family-emergency, payment and account-takeover scams
• Verify any urgent request through a phone number or channel you already know is genuine
• A family verification phrase and strong account security can turn a convincing call into a failed scam

Voice cloning has become far more accessible

Voice cloning is not a single product or a trick reserved for tech-savvy users. It’s actually a broad category of software, some that use AI, that can either generate new speech in the original speaker’s voice or transform the voice so it resembles another. 

Quality varies, and a cloned voice won’t always fool a careful listener, but that doesn’t really matter. Criminals don’t need to meet a quality standard; they just need to be convincing enough. It may be a voice on the phone or the voice of a popular influencer on social media tricking you into buying a nonexistent product.

They just need to sound plausible long enough to create panic and push someone into an irreversible decision.

Software available in public repositories already shows why this threat is no longer theoretical, and it’s been like this for many years.

They are not evidence that their creators intend wrongdoing; open source projects can support research and legitimate speech technology. However, they do show how widely the underlying capability is available.

In fact, audio deepfakes have advanced much more quickly than video deepfakes—it’s much easier to trick the ear than to trick the eyes.

For example:

• VoxCPM is a 2-billion-parameter AI model that promises a host of very interesting features, including one called Ultimate Cloning. Upload a sample, and the model does the rest.
• Voicebox promises to clone voices from a few seconds of audio and generate speech in 23 languages.

A simple GitHub search returns dozens of results, many promising the ability to clone a voice with just a few seconds of audio.

It’s important to note that the two examples above are provided solely for educational purposes to illustrate publicly available technology. This article does not endorse or recommend their use. Scammers may use these or entirely different tools; the examples demonstrate how far voice synthesis technology has advanced.

Criminals might choose commercial software that promises much of the same efficiency. Like many other tools, its effectiveness depends largely on how people choose to use it, whether with good or bad intentions.

Why a copied voice adds new danger to an old scam

Most scams don’t work simply because the cybercriminals have flawless technology. They succeed because they create urgency, fear or authority, and a cloned voice can increase this pressure.

The US Federal Trade Commission has already issued warnings about how scammers can obtain a short clip of a relative’s voice from material posted online, then use a cloning program to make a family-emergency call sound real.

The FTC’s advice is straightforward: don't trust the voice alone. Call the person back through a number you already have and verify the story independently.

This alone changes the familiar “grandparent scam,” which was already a major problem in many parts of the world.

Now, instead of an anonymous caller claiming to be a relative, the victim could hear what sounds like their grandchild crying, asking them not to tell anyone, and creating an urgent scenario that forces the victim to act quickly. The message can be tailored using details from social media posts, public records, or a previous data breach.

Unfortunately, the risk extends well beyond family emergencies.

Fake executive approval

An employee gets a call that seems to be from a manager or some other higher-up in the company. The familiar voice asks them to rush through a wire transfer, buy gift cards, share a one-time code, or move the conversation to a private messaging app.

Account takeover disguised as support

Someone posing as a bank, mobile carrier or company help desk calls with a believable voice and a plausible reason for urgency. The attacker’s real goal could be a password-reset link, a multi-factor authentication code or enough personal information to bypass support checks. No legitimate representative needs the code sent to you to sign in to your account.

Reputation attacks and fabricated evidence

A manipulated audio clip may be used to falsely suggest that a teacher, public official, business owner or private individual said something damaging. Even when the clip is later disproved, it can spread quickly and cause real harm.

These are just a few examples, but numerous other scenarios allow cloned voices to be used in malicious or illegal ways.

The threat is already reaching high-value targets

Voice cloning is not limited to calls asking grandparents for money. In May 2025, the FBI warned of an ongoing campaign in which malicious actors impersonated senior U.S. officials using text messages and AI-generated voice messages.

The goal of that campaign was to build rapport and lure targets to a malicious link or another messaging platform, where their accounts could be compromised.

The FBI cautioned that AI-generated content can be hard to identify and advised people to independently verify new contact information, even when a message appears to come from someone they know.

How to protect yourself and your family from voice-cloning scams

You don’t need to identify synthetic speech by ear. As cloning technology advances, human detection will likely fail. Build a verification habit that still works even when the call sounds perfect.

1. Pause when a caller creates a sense of urgency. An accident, arrest, medical crisis, or payment deadline may be real, but urgency is also a scammer’s favorite tool.

2. Call back using trusted contact information. Hang up and use a saved number, a company website, or a known messaging thread.

3. Agree on a family phrase. Choose a phrase that is not posted online and is easy for family members to remember.

4. Treat one-time codes like passwords. Never read them aloud, forward them or enter them into a site reached through an unexpected message.

5. Reduce unnecessary public audio. Review public videos, livestream clips and voice notes, especially for children.

6. Use multi-factor authentication. Prefer an authenticator app or security key where available. It will not stop every social-engineering attempt, but it makes account takeover harder.

7. Tell people around you. A quick conversation with parents, grandparents, children and colleagues can prevent the first moment of panic from becoming a loss.

Check for AI manipulation

If a suspicious video or audio-led scam reaches you through social media, use tools that provide context rather than relying on instinct alone. Bitdefender RealCheck analyzes videos and associated audio for signs of manipulation and deceptive intent. It’s not a replacement for independent verification, but it can help users identify suspicious content before trusting, sharing, or acting on it.

If you’ve sent money, disclosed a code or clicked a link, act quickly: contact the relevant bank, service provider, or employer through its official channel, change any compromised passwords, and report the incident to the appropriate local authority.

FAQ

Can someone clone my voice from a social-media video?

Public videos, interviews, livestreams and voice notes can provide audio that a cloning system may use. The amount and quality of audio needed varies by tool, but many software tools need only seconds to create a relatively convincing replica.

Can I recognize a cloned voice by listening carefully?

Sometimes, but you should not rely on it. AI-generated voices can sound close enough to exploit fear and urgency.

Is a family safe word enough to stop a voice-cloning scam?

It is a useful extra check, not a guarantee.

What should I do if a caller who sounds like a relative asks for money?

Hang up. Contact the relative or another trusted family member independently. Do not use the caller’s number and do not send money, gift-card numbers, cryptocurrency or verification codes.

Can RealCheck tell me whether a suspicious video is a deepfake?

RealCheck evaluates video and associated audio for signs of manipulation and deceptive intent.

This article is published for informational and educational purposes only. References to Bitdefender products are provided in the context of this educational material. The information presented is based on technical research conducted by Bitdefender Labs and publicly available sources. Bitdefender does not make any legal determination regarding the activities described herein. The mention of any company, brand, domain, or individual does not constitute an accusation of illegal activity. Readers should exercise their own judgment and consult appropriate authorities or legal counsel if they believe they have been affected by any of the activities described. Domain names and URLs listed in this article are provided solely to help consumers and security professionals identify potentially harmful infrastructure. Bitdefender disclaims any liability for actions taken based on the information in this article.