AI Clones Your Doctor's Voice. Then Asks for Gift Cards.

A Voice You Trust, a Script You Don't Expect

Most people don't question a call from their doctor. The voice is familiar. The name they use is yours. The concern in their tone sounds real.

That's the opening these scammers exploit. They clone a medical professional's voice using AI, call victims by their real names to establish credibility, then create urgency around a fabricated medical or legal situation. The ask at the end: buy gift cards and text the codes.

Gift cards are the payment method of choice for scammers because they're instant, irreversible, and nearly impossible to trace. By the time a victim realizes something is wrong, the money is gone.

Why Mandarin Speakers Are Being Targeted

Targeted scam campaigns against specific language communities are not accidental. Scammers choose communities deliberately, often because language barriers create hesitation around reporting, or because trust in authority figures like doctors runs high.

Using a cloned voice that sounds like a real, local medical professional adds another layer of believability. If the caller already knows your name and convincingly mimics someone you've seen in person, questioning the call feels almost rude.

Victoria Police confirmed at least 10 reports since early September 2026. Given how rarely people report scam losses, the true number is likely higher.

How the Scam Unfolds

This scam follows a pattern researchers call "authority plus urgency," and it typically works in four steps.

The call. A voice that sounds like your GP, surgeon, or specialist contacts you. They use your real name. They may reference a real clinic or practice.

The manufactured problem. There's an issue: a billing discrepancy, a legal matter tied to your medical records, a payment needed to release test results or continue care. The details vary, but the pressure does not.

The unusual payment request. Gift cards. Specifically, gift card codes sent via text. This is where the scam breaks from anything a real medical office would ever request.

The silence. Once the codes are shared, the call ends. The money is gone.

The sophistication is in the first two steps. By the time a victim reaches the payment request, the emotional groundwork has already been laid.

Voice Cloning Is Not Science Fiction Anymore

AI voice cloning now requires as little as 20 to 30 seconds of audio. A doctor who has appeared in a local news segment, a clinic welcome video, or a recorded voicemail greeting has likely provided enough source material.

The resulting clone can hold a real-time conversation, respond to questions, and express concern, reassurance, or urgency on demand. The voice alone is no longer a reliable signal that someone is who they claim to be.

Caller ID is equally unreliable. Scammers routinely spoof phone numbers to display the name of a real clinic or practice. Seeing a familiar name on your screen and hearing a familiar voice on the call creates a convincing illusion, even for careful people.

What to Do If You Get a Call Like This

Victoria Police advise hanging up and calling back on a number you find independently, such as one from the clinic's official website or one you have saved from a previous legitimate interaction. This is good advice, but a successful callback does not prove the original caller was legitimate. Scammers sometimes answer follow-up calls using the same spoofed number. Always source the number yourself from a card, a statement, or an official website.

A few other things worth knowing:

• Real medical offices do not ask for gift card payments. No legitimate billing department will ever request iTunes, Google Play, or any other gift card as a payment method.
• Urgency is a manipulation tool. A caller who insists you act immediately and discourages you from checking with anyone else is applying pressure on purpose. Slow down.
• Your name is not proof. Scammers buy personal data or scrape it from public sources. Knowing your name means nothing.

The Check That Cuts Through the Confusion

Here's what catches scammers that voice cloning and spoofed caller ID cannot: a shared secret they don't know.

Trust Onion gives you three private rotating codewords that only you and the people you trust can access. The words change every 60 seconds, calculated locally on your phone with no server involved. If someone calls claiming to be your doctor, your bank, or your insurer, you can ask a simple question: "What are the words?"

A real person you've verified with beforehand will know. A scammer with a cloned voice and a spoofed number will not. The call ends there.

The words rotate on a schedule, so even if someone overheard them once, they expire fast. Voice cloning can replicate how someone sounds. It cannot replicate a shared secret that changes every minute and lives only on your device.

Trust Onion is free and works offline. No account is required to share the words with someone you trust.

Protect Yourself Before the Next Call

Scams like this work because they arrive before you've had a chance to set up any defense. The moment the call comes, the pressure starts.

Setting up a simple verification method with the people and institutions you trust takes a few minutes. After that, any call claiming to be from someone you know has to pass a test the caller can't fake.

Victoria Police urge anyone who has received one of these calls to report it to ScamWatch at scamwatch.gov.au and to local police. If you have already sent gift card codes, contact your bank immediately.

The scammers targeting Mandarin-speaking Victorians are counting on the moment of confusion between hearing a trusted voice and questioning what you're actually being asked to do. Close that gap before the next call arrives.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.