AI Voice Cloning Apps Have No Consent Checks. None.

The clone was built from audio scraped off the internet, and it was convincing enough to move $25 million in a single transaction.

In January 2026, BGR covered a Consumer Reports investigation into the biggest AI voice cloning platforms on the market. ElevenLabs, Speechify, PlayAI, and Lovo, four of the most widely used services, have no technical mechanisms to confirm that the person being cloned has given consent. Anyone can upload a few seconds of audio and get a voice back. These are not fringe tools. They have millions of users, legitimate business customers, and polished interfaces built for podcasters and marketers. Consumer Reports found the same technology is wide open to anyone who wants to sound like your boss, your CFO, or your finance director.

The Numbers

Voice cloning now requires just 20 to 30 seconds of audio, and that audio doesn't have to come from a private conversation. A voicemail, a video posted on social media, a clip from a podcast interview, that's enough. The FTC reported that Americans lost $2.7 billion to imposter scams in 2023, and AI voice tools are accelerating the trend. Researchers at McAfee found that 77% of voice cloning scam victims lost money, with 36% losing more than $1,000. Human detection accuracy for cloned voices sits at 55 to 60 percent, barely better than a coin flip, according to researchers at University College London.

The playbook is simple. Scammers find audio of the person they want to impersonate, feed it into a cloning app, and call. No verification required, no consent check, no flagging system. They use the cloned voice to create urgency: "I'm in trouble," "I need money right now," "Don't tell anyone, just send it." The emotional pressure is designed to short-circuit judgment. When the voice sounds right, the brain wants to believe it.

What "Hang Up and Call Back" Doesn't Solve

The standard advice when you get a suspicious call is to hang up and call the person back on a number you already have. That step is worth taking, but a successful callback does not prove the original caller was legitimate. Sophisticated scammers can spoof numbers or manipulate context. For any request involving moving money or changing vendor details, verify through a second channel before acting, and if someone may be in danger, contact local authorities.

This is exactly the kind of request that Trust Onion's three rotating codewords stop cold. Before approving a wire transfer, changing vendor payment details, or acting on an urgent executive request, staff ask one question: "What are the words?" The codewords rotate every 60 seconds, calculated locally on each authorized person's device, with no server and no internet required. A clone can sound like your CFO. It cannot know three private codewords that change every minute and were never said out loud anywhere a microphone could hear them.

The Consumer Reports investigation made one thing plain: ElevenLabs, Speechify, PlayAI, and Lovo were designed for speed and quality, not consent. ElevenLabs added some restrictions after a 2023 backlash over fake audio of public figures, but restrictions are not verification. A policy buried in a terms-of-service document does not stop someone from uploading 30 seconds of a stranger's voice. Regulation moves slowly. The scammers using these tools are not waiting for a terms-of-service update.

The scam fails the moment the caller can't answer the question.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.