How to Spot AI Deepfake and Voice Clone Scams, and What to Do

An AI voice cloning scam uses a few seconds of someone’s voice, often taken from social media, to fake a call from a family member, boss or official who urgently needs money. The safest way to spot one is not to judge the voice at all: hang up, call the person back on a number you already have, and ask a family code word. In India, if you have been cheated, call the national cyber crime helpline 1930 or report at cybercrime.gov.in immediately, and report suspicious calls and messages on Sanchar Saathi’s Chakshu facility.

Deepfake video calls and cloned voices are now good enough that most people cannot tell them apart from the real thing. This guide explains how these scams work, the warning signs, a verification routine for families and businesses, what to do in the first hour if you paid, and how to protect your voice and face online.

How AI voice cloning and deepfake scams work

AI voice tools can now copy how a person sounds from a short recording. Security firm McAfee reported that about three seconds of audio can be enough for a voice clone with an 85% match. Video deepfakes go further, putting a real person’s face on a live video call. The tools themselves are legitimate, the same technology behind AI voice generators and voice cloning for creators, but scammers misuse them.

ICICI Bank’s advisory describes the typical sequence:

1. Collect a voice sample. From school performance videos, birthday reels, vlogs or forwarded voice notes.
2. Create panic. A fake kidnapping, accident, arrest or medical emergency, often with crying or a stern “officer” in the background.
3. Hide the source. Calls come from masked, spoofed, internet or foreign numbers.
4. Play the cloned voice at the peak moment. A few words in a loved one’s voice override doubt.
5. Demand instant payment. UPI, wallet or QR code, right now.
6. Disappear. The money is split across accounts within minutes.

Common types of deepfake scams in 2026

The business risk is real. In a widely reported 2024 case, an employee at engineering firm Arup in Hong Kong transferred HK$200 million (about US$25.6 million) across 15 transactions after a video call in which the “colleagues” were deepfakes. Deloitte has forecast that generative AI could push US fraud losses to $40 billion by 2027, up from $12.3 billion in 2023.

Warning signs of an AI voice or video scam

• Urgency plus secrecy: “Don’t tell anyone, I need it in 10 minutes.”
• Unusual payment method: UPI to an unknown name, gift cards, crypto or a “new” bank account.
• Unknown or masked number claiming to be someone you know.
• Refusal to verify: they will not let you call back or put someone else on.
• Odd details: they cannot answer a personal question, or the story changes.
• On video: blurry edges around the face, odd lighting, lips slightly out of sync, a stiff or blank expression, or a “bad connection” excuse when you ask them to turn their head.

The 30-second verification routine

1. Pause. Any request for urgent money is a reason to slow down, not speed up.
2. Hang up and call back. Use the number saved in your phone, not the one that called you or one they give you.
3. Ask the code word. Agree a family or office code word in advance that never appears online.
4. Check with someone else. Call another family member or colleague who would know.
5. Never share OTPs, PINs or screen access. No real bank, police officer or company needs them over a call.

What to do if you have been scammed in India

1. Call 1930 immediately. This is the national cyber crime helpline. Reporting quickly gives the best chance of freezing the money in the scammer’s account.
2. Report online at cybercrime.gov.in. File a complaint with transaction IDs, screenshots, phone numbers and times.
3. Call your bank. Block cards or UPI if details were shared, and dispute the transaction. Under RBI rules, reporting an unauthorized transaction quickly, ideally within three working days, protects your rights.
4. Report the number. Use Chakshu on the Sanchar Saathi portal (sancharsaathi.gov.in) to report suspected fraud calls, SMS and WhatsApp messages.
5. Save evidence. Keep call logs, voice notes, chats and payment screenshots. Do not delete the conversation.
6. Warn others. If your voice or face was cloned, tell family and colleagues so they do not fall for the same trick.

ICICI Bank’s voice-cloning scam advisory lists the same reporting channels. Outside India, contact your local police and your bank right away.

How to protect your voice and face online

• Limit public voice and video. Set personal social accounts to private, especially children’s videos and long voice notes.
• Think before posting greetings. Clear, long clips of your voice saying names and phrases are ideal training data for scammers.
• Do not answer unknown calls with long sentences. Scammers sometimes record your voice by keeping you talking.
• Use strong account security. Two-factor authentication stops scammers taking over your WhatsApp or email to message your contacts. Our guide to AI account safety covers similar settings.
• Be careful with AI apps. Only upload your voice or face to reputable services with clear deletion policies. Our guide to AI data privacy lists what to check.

Deepfake protection for businesses

Ransomware and fraud are increasingly AI-assisted: in an October 2026 survey by security firm Semperis, 84% of ransomware victims said attackers used AI somewhere in the attack. Every business, including small ones, should adopt a few simple controls.

1. Two-person approval for new payees, changed bank details and urgent transfers above a set amount.
2. Call-back rule: verify any payment request from a “senior” by calling them on a known number, even if the request came by video.
3. Code phrases for finance teams and executives.
4. Training: show staff real examples once a quarter and make it safe to question the boss.
5. Customer warnings: tell customers you will never ask for OTPs or payments over WhatsApp, a common target for impersonation. See our guide to WhatsApp for business.
6. Write it down: add these rules to your company AI and security policy; our AI usage policy template is a starting point.

Can AI detect deepfakes?

Deepfake detection tools exist, and some vendors report high accuracy in lab tests, but real-world performance is lower and new fakes keep improving. They are useful for companies screening media at scale, not as a family’s main defense. The same is true of text: our review of AI detectors shows how unreliable detection can be. For individuals, verification through a trusted channel remains the most reliable protection.

To understand how these fakes are made, read our explainer on what generative AI is and see how easily photos become video in our image to video AI guide.

Frequently asked questions

The bottom line

AI voice cloning and deepfakes have made “I recognized the voice” worthless as proof. Protect yourself with habits, not detection: pause on urgent money requests, call back on a saved number, use a code word, and report fast through 1930 and cybercrime.gov.in if something goes wrong. Share this guide with your family and team today. Scam tactics and reporting systems change, so check official cyber crime and bank advisories for the latest guidance.

Related reading: AI voice changers explained and AI for small business.