Voice Cloning and Deepfakes: Risks and Protection

A voice clone is a synthetic copy of a real person's voice, generated by a speech model that has learned that voice from recordings. Research systems can now build one from a few seconds of speech ¹, so any recording of you that is public or stored somewhere can supply the raw material. A familiar voice on the phone is no longer proof of who is speaking. The defenses that work happen outside the call: hang up, call the person on a number you already have, and agree a safe phrase with family members before anything goes wrong.

A few seconds of audio is enough for a recognizable voice clone

A clone needs very little audio. In 2023 Microsoft researchers reported that their VALL-E model could produce personalized speech from a 3-second recording of a speaker it had never heard before ¹. A research model is not a consumer product, but the bank Starling says criminals can now clone a person's voice from as little as three seconds of audio ².

One commercial tool recommends more audio than that, and its guidance shows what a good clone needs:

The gap between these numbers is about quality, not the minimum needed. ElevenLabs says that audio quality is the most important aspect of instant voice cloning ⁴, and its guidance asks for clear audio with no reverb, artifacts or background noise ³. A short, clean clip from a public source can be enough to start a fake, and the speaker never has to cooperate. The recording's quality matters more than its length.

For how a voice clone is built and what the term means in practice, see the glossary entry on voice cloning. The question of how much audio a clone needs is answered in more detail on the page How much audio does it take to clone a voice?

Voice cloning scams imitate family members, executives and officials

Scams built on clones follow three patterns: a relative who seems to be in trouble, an executive who needs an urgent payment, and an official who wants you to act quickly. The FBI warned in May 2025 that malicious actors had sent text messages and AI-generated voice messages claiming to come from senior US officials ⁵. Its December 2025 update says the activity dates back to 2023 and has widened to officials' family members and personal acquaintances ⁶.

One documented case cost a company $25 million ⁷

One of the best-documented cases is the engineering firm Arup. CNN reported in May 2024 that a deepfake scam had led one of Arup's Hong Kong employees to pay out $25 million to fraudsters ⁷. Arup confirmed that fake voices and images were used ⁸. The lesson for a private person is the same as for a company: a voice that sounds familiar does not prove who is on the line.

Family scams rely on a short pause that never happens

Family scams are built on urgency. The caller sounds like someone you love, the story is serious, and the request is for money now. In a 2024 survey of UK adults, Starling Bank found that 28% think they have been targeted by an AI voice cloning scam in the past year ⁹. Those are self-reported beliefs rather than confirmed cases, but they show how many people believe the threat has reached them.

Read more about the specific question of whether your voice can be cloned from a recording you already have, and how to protect yourself from voice cloning scams.

Voice ID at banks and call centers can be fooled by a good clone

Voice ID is a speaker verification system: it compares the voice on the call with a voiceprint stored for your account. It is convenient, and it is not a strong password. In a 2023 University of Waterloo news item, researchers reported an attack that bypasses voice authentication with up to a 99% success rate after six tries ¹⁰. They said their method can fool most voice authentication systems within six attempts ¹¹. These are the researchers' own tests, so read them as evidence that the method works, not as a measured rate for your bank.

Illinois counts voiceprints as biometric identifiers under its Biometric Information Privacy Act ¹², which is one reason voice data falls under biometric data rules in some places. Those rules protect the data, but they do not stop a clone from passing a call-center check.

The checks you may meet on a call differ in how well they hold up against a clone:

Use voice ID as one factor among several, and never let it alone approve a payment. The question of whether voice authentication is still secure has a fuller answer.

Regulators now treat AI voices as a fraud and consent problem

Regulators have started to reach AI voices, mostly through rules on calls, disclosure and consent rather than cloning as such. In February 2024 the Federal Communications Commission ruled that voices generated by artificial intelligence are artificial voices under the Telephone Consumer Protection Act ¹³. That ruling governs calls made under the TCPA, so it targets AI robocalls rather than the making of a clone.

The EU takes a disclosure approach. Article 50 of the EU AI Act requires that a deepfake be disclosed as artificially generated or manipulated ¹⁴, and the article came into force on 2 August 2026 ¹⁵.

Product safeguards are a separate question, and an independent test found them weak. Consumer Reports assessed six voice cloning products, and its March 2025 report found that a majority did not have meaningful safeguards to stop fraud or misuse ¹⁶. Its researchers were able to easily create a voice clone from publicly available audio in four of the six products ¹⁷.

The common thread is consent. The rules ask who authorized the use of a voice, but they do not stop a scammer from trying, so the protection you can control sits with you. For the legal side of cloning someone's voice, see whether it is legal to clone someone's voice.

Stored recordings of your voice are the raw material for a clone

Any copy of your voice that a company keeps is a place a sample can be taken from, through a breach, an insider or a review. Microsoft says it keeps voice clips that people contribute for sampling and listening for up to two years ¹⁸, and that its employees and vendors working on its behalf can review contributed clips ¹⁹. It also says it uses Copilot data, including voice and conversation activity, for AI training, with exceptions for some categories of users and for people who have opted out ²⁰.

Contributing clips is optional. Microsoft says you can use voice typing without contributing voice clips ²¹. Stored audio is not the only source, since voice notes, podcasts and video calls supply the same material. A stored copy adds to the risk rather than creating it.

On-device recognition keeps the audio on your computer rather than on a provider's server, which removes one of the places a voice can be copied from. Yap, which we make, is a dictation app for Mac and Windows that runs on-device speech recognition, and our guide on how voice data is kept by the big platforms lists what each provider stores.

Check your own exposure in four steps:

1. Find your public audio. Search for your name with video, podcast and social media, since any clear clip of you is usable. Remove what you can, and note what you cannot.
2. Check your voicemail greeting. A greeting is a recording of you that anyone can call and hear, so keep it generic.
3. Review stored clips. Open the voice and activity settings of each service you use, and delete or stop sharing clips you do not need to keep.
4. Set a safe phrase with the people who would be most likely to call you for help, and tell them the call-back rule.

Check each service's retention and review settings, turn off optional clip sharing, and remember that a clone needs only a short clip. The guides on whether voice to text is safe, human review of voice recordings and AI training on voice data explain each risk in turn.

Detection is unreliable, so verification has to happen outside the call

You cannot reliably hear a clone, and software detectors do not yet solve the problem. In a 2023 PLOS ONE study, listeners spotted speech deepfakes only 73% of the time ²², which means about 27% went unnoticed ²³. Giving listeners examples of speech deepfakes improved their results only slightly ²⁴.

Software does worse on real-world fakes. On a benchmark built from deepfakes that circulated online in 2024, the accuracy of open-source detectors fell sharply compared with earlier academic benchmarks. The score (AUC, where 0.5 is guessing and 1 is perfect) dropped by 48% for audio ²⁵, by 50% for video ²⁶ and by 45% for images ²⁷.

The ASVspoof 5 challenge summary reports the same pattern for speech: attacks significantly compromise its baseline systems, while submitted systems bring substantial improvements ²⁸. Detection can help, but you cannot make a reliable judgment by ear or by software in the middle of a call. Verification has to use a channel the caller does not control.

Call back on a number you already have

The most effective defense is a routine you follow every time, whatever the voice sounds like.

1. Hang up. Do not continue the call, even if the caller ID shows a name you know.
2. Call back on a number you already have stored, not one the caller gives you. The FBI advises that you verify the identity of the person calling you or sending text or voice messages ²⁹.
3. Check with a second person if the first number does not answer, such as another relative or a friend who knows the person.
4. Use a safe phrase agreed in advance. Starling Bank encourages a phrase that no one else knows, so that close friends and family can verify they are really speaking to each other ³⁰.
5. Treat urgency and secrecy as warnings. A request to pay quickly and keep the call to yourself is the pattern these scams depend on.

The reason call-back works is structural. A scammer controls the call, the caller ID and the voice, but not the number you dial. A number you already have, reached by you, gives you a path to the real person that the caller cannot cut off. Detection tries to judge the voice, which the clone is designed to imitate. A call-back judges the route, which the clone cannot change.

Agree a safe phrase before anyone needs it

A safe phrase only works if it is set up in advance and kept private. Choose a phrase that cannot be found in your social media, your public records or a recording of you. Use it for money requests and urgent changes, and do not write it down where a person who has access to your phone can find it. A clone can copy the sound of a relative, but it cannot know a phrase that was never spoken in a recording.

The question of how to protect yourself from voice cloning scams sets these steps out in the order you would use them. For the broader topic of how voice to text handles your data, see our overview of voice privacy. Our guide on voice data retention and how to dictate privately covers the settings to check first.