AI Voice Scams Surge 1,210%: It Only Takes 3 Seconds

According to a June 2026 Fox News report citing cybersecurity researcher Kurt Knutsson, AI voice cloning scams surged 1,210% in 2025. The technology costs almost nothing, runs on a laptop, and needs just three seconds of audio to produce a convincing imitation of someone you love. That audio is already out there, in birthday videos, Instagram reels, and voicemails, waiting to be harvested.

Scammers do not cold-call phone books. They research. Data brokers sell profiles listing names, addresses, relatives, and phone numbers. A scammer buys a profile, finds the target's son on social media, clips a few seconds of video, and feeds it to a cloning tool. The call that follows sounds exactly right, because the voice is real.

The script is consistent. The cloned voice says it is in trouble, maybe an arrest, maybe an accident. It begs you not to tell anyone else. It says a lawyer needs $15,000 wired immediately. The manufactured panic is the point: it keeps the target reactive until the money moves.

Why the Voice Convinces You

Humans are wired to recognize the voices of people they love, and that recognition runs faster than conscious thought. When something sounds like your child in distress, your nervous system responds before your logic catches up.

Researchers have found that human accuracy at detecting cloned voices hovers around 55 to 60 percent, barely better than a coin flip. The Fox News report notes that criminals use data broker profiles to map out family relationships, then source audio from social media to match a voice to a name. It is systematic, scalable, and getting faster.

Public social media profiles are an open audio library. TikToks, Facebook videos, YouTube clips, even forwarded voice notes: any audio online is potentially harvestable. Privatizing your accounts is worth doing, but voicemails exist, old public posts exist, and the threshold keeps dropping. Three seconds today might be one second tomorrow.

What Actually Stops It

The Fox News article lists several defenses: family code words, callback rules, reduced social media exposure. Code words are the most powerful because an AI can clone a voice in three seconds, but it cannot clone knowledge that exists only inside your family's heads.

Trust Onion gives every family three rotating codewords that change every 60 seconds, calculated locally on your phone with no server involved. When a call comes in from someone claiming to be your son, you ask one question: "What are the words?" A scammer cannot guess them. They were not in any Facebook video, any data broker profile, or any voicemail. If you do hang up to call back on a number you already have, remember that a completed callback does not prove the original caller was legitimate. The person who answers must still know the family's private codewords.

Trust Onion also supports Proofie™, a selfie signed by your passkey the moment you take it. The signature binds your full public key to the exact original photo, the date, time, and location in the signed record. Verification checks that signature against your public key in your shared family group. A valid Proofie establishes that whoever created it possessed the private key at that moment; it does not guarantee physical presence if a key is compromised. Codewords work alongside Proofies, not as part of a Proofie's signed payload.

The scam script is engineered to make you act before you think. One question with an answer only your real family member can give breaks that loop before the money moves.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

Public by default, under your control. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.