Your phone rings. It’s a number you don’t know. The voice sounds like your daughter, or your brother, and says: “Hi, it’s me. I’m on a stranger’s phone, mine’s about to die.” Would you hang up?
Most of us wouldn’t. That’s the whole scam. So the real question is how hard it is for someone to fake that voice. A recent test from ZDNET gives a useful, fairly calm answer.
One note first. I didn’t run this experiment myself. A ZDNET writer did, and I’m walking you through what she found and what I’d do about it. I’m a SOC analyst, not the person who made the clone.
What the test actually was
In ZDNET’s test, the writer cloned her own voice using free tools. She used recordings of the kind a scammer could pull from public videos. She also had an AI chatbot write the scam script, which took no more than three minutes. It leaned on panic: a stolen bag, a dying phone, a last train home, and “please don’t tell anyone, I feel so stupid.”
She then called five people close to her, from a temporary phone number, which is what a scammer would likely do too. She asked their permission afterward to write about it. She says she doesn’t recommend others do the same, and I agree.
What a clone needs
Less than you’d hope. According to the writer, about 10 seconds of audio was enough to make versions that were “almost passable.” They wouldn’t fool most people who know her well, but they weren’t far off from something that could work on a phone call.
Source material is easy to find. Videos on Facebook, Instagram or TikTok are the obvious places, and longer videos give an attacker more to work with. More audio means the AI can copy accent, favourite phrases, and the rhythm of how you talk.
She also used free tools only. A scammer willing to pay could have better options.
How convincing it sounded
Not very, yet. Results varied a lot between tools. Some sounded fit only for a video voiceover. Some sounded like she was choking. One tool was so clean it sounded like a news anchor, not a frightened person. Others added odd pauses, heavy breathing, or strange pitch changes. Apart from that one polished tool, the clones were flat and lacked the emotion a panic call needs. When she tried emotion settings on one open-source tool, the result was an odd, breathy whisper.
The results with real people:
- Four of five knew something was wrong right away.
- Two of those didn’t think it was meant to be her at all.
- Two said it sounded like her, but something in the call felt off.
- One person believed it was her. She was older and slightly hard of hearing, which made it harder to pick up the small clues that make a voice familiar.
What gave it away: the voice was too flat, the tone and rhythm were strange, some words were mispronounced, and it wasn’t her usual phone number.
That’s reassuring, but don’t over-read it. Five people is a tiny sample. And the writer’s own warning is that models are improving fast, so a flat, robotic clone today may not stay that way. I wouldn’t plan around “it still sounds fake.” I’d plan around not needing to judge the voice at all.
How to tell if this affects you
Anyone with a phone number and family is a possible target. Your risk goes up if your voice is easy to find: public videos, podcasts, interviews, or regular talking-to-camera posts. The writer notes that people who post videos of themselves often are likely at higher risk.
If you run a small business, your voice may be on a website, in a promo video, or on a voicemail greeting. I’d treat all of that as available audio. I’m not saying take it down. Just know it’s out there.
What to do today
1. Set a family safe word. ZDNET’s advice is to create a password for conversations that could end in someone losing money. In general practice, that works like this:
- Agree on it in person or on a call you trust, not in a text thread.
- Pick something that can’t be guessed from social media. Not a pet’s name, a street, or a school.
- Make it a word or short phrase everyone can remember under stress.
- Make sure the older people in your family are in on it. Explain it simply. In the test, the person who was fooled was the one who had the hardest time hearing the clues.
- The rule: if someone calls asking for money or urgent help, they give the word first. No word, no money.
2. Make “call back” a habit. The source’s advice is simple. If a caller asks for money, hang up. If they say they’re family, a friend, or a colleague, call them back on the number you already have for them. If the call came out of the blue, it was probably a scam. A real person in trouble will understand you hanging up to check. A scammer will push you to stay on the line.
3. Know the warning signs on the call. From the test and the source:
- An unknown number
- A flat voice, odd rhythm, odd pauses, or sentences that cut off
- Words or phrases the person wouldn’t normally use
- Background noise that doesn’t fit
- No small talk, and no way to answer a personal question only the real person would know
- Pressure to keep it secret, which was baked into the test script
4. Think about what you post. You don’t have to delete everything. But if you post lots of videos of yourself talking, be aware that you’re giving away voice samples. Checking your privacy settings on who can see your videos is a reasonable step.
Signs something already went wrong
If you’ve sent money after a call like this, or find out someone cloned your voice to contact people, the source’s first step is to tell your friends, family and possibly colleagues, so they don’t fall for the same thing. It also suggests reporting it to law enforcement and fraud organizations, reporting any online posts or media using your voice, and contacting service providers to make them aware.
Beyond what the source says, my general advice is to contact your bank right away if money moved. Speed matters.
When to get help
A family safe word doesn’t need a professional. But if you run a business and someone could call your staff pretending to be you, asking for a payment, it’s worth setting up a simple verification rule: no payment or account change is made on a phone call alone, whoever it sounds like. That’s the kind of thing I help with.
Need help with this?
I’m a SOC analyst and I help small businesses with exactly this kind of problem. Book a free call and I’ll tell you honestly whether you need help or just a couple of settings changed.