2026: The Year AI Impersonation Scams Hit Everyone

A scammer today needs roughly 20 seconds of audio and a free tool. That is the entire barrier between your family and a voice that sounds exactly like someone you love.

CFO Dive reported in January 2026 that enterprise fraud experts are bracing for a surge. Nametag's 2026 Workforce Impersonation Report names the threat plainly: impersonation attacks, powered by widely available deepfake and voice-cloning technology, are the defining fraud story of the year. The FBI's numbers confirm the scale. Over $50.5 billion in fraud losses since 2020, with a growing portion tied to AI impersonation. What hits corporate finance departments hits kitchen tables with the same tools and the same logic. Only the target changes.

What the Attack Actually Looks Like

A phone rings. The caller sounds exactly like your son. He says he's in trouble: an accident, an arrest, a stolen wallet. He needs money fast, and he needs you not to tell anyone.

This is the grandparent scam, and AI made it far more convincing. The FBI received more than 101,000 complaints related to elder fraud in 2023, with losses exceeding $3.4 billion, and that figure covers only reported cases. Voice cloning builds the clone from the real person's recordings: the pitch, the cadence, the small verbal habits. Human detection accuracy for cloned audio hovers around 55 to 60 percent, according to research cited by the World Economic Forum, barely better than a coin flip.

The corporate version draws larger headlines. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every participant was a deepfake. Nametag's 2026 report also flags a rise in fake AI-generated job candidates who successfully pass video interviews. If a trained hiring manager can be fooled on a video call, a parent answering a call from someone who looks and sounds like their child is in serious trouble.

AI compounds the problem through scale. A scam operation that once required ten people working phones can now run on a handful of people with automated tools, producing more calls, more texts, and more targets without pause.

Why Caution Alone Is Not a System

People hear about these scams and think they would recognize their own child's voice. The clone is built from actual recordings of that child. Add a stressful scenario designed to trigger emotion over logic, and even sharp, skeptical people get caught. Caution helps. It is not a system.

A system means that before anyone acts on a call claiming to be family, there is a step that always happens, a question that always gets asked: "What are the words?"

Trust Onion is a free app that gives families and teams exactly that. It generates three rotating codewords, calculated locally on your device with no server required, that everyone in a shared group can see. The words change every few hours. A Proofie™ adds a second layer: a selfie signed by your passkey at the moment you take it, binding the exact photo to a key, a time, and a location. Anyone with the link can verify it in the Trust Onion app by checking the passkey signature against the full public key in your shared group and confirming the original photo has not changed. Family codewords work alongside Proofies, not as part of a Proofie's signed payload. A scammer cannot produce the specific three words your family uses right now. The real person can.

If a callback feels necessary, use a number from a card, statement, or official app rather than one the caller provides. A completed callback does not by itself prove the original caller was legitimate; the caller must still know your family's private codewords.

The tools are built. The operations are running. The next time a scammer calls with a cloned voice, the question is whether your family has an answer ready.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

Public by default, under your control. Proofie™ photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie™ is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie™ private, or delete it at any time. Deleting a Proofie™ removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.