Fake Walmart Calls Are Using AI Voices to Steal Your Identity

The call sounds like a Walmart customer service agent: calm, professional, helpful. Since July 2026, a nationwide robocall campaign has been running exactly this script, with AI-generated voices going by the names "Carl" or "Emma." The FCC ordered the voice service provider responsible to cease and desist. The calls kept coming.

The pitch is simple: an unauthorized purchase of roughly $900 to $919, usually a PlayStation 5, has appeared on your account. Press 1 to dispute it. Pressing 1 connects you to a live fraudster who "verifies your identity" by asking for your name, address, date of birth, account information, and, in many reported cases, your Social Security number. Every request is framed as protection: cancel the charge, secure your account, get your refund. None of it is real.

Why the Voice Fools You

Robocalls used to sound robotic. That era is over. Researchers studying synthetic audio put human detection accuracy at around 55 to 60 percent, barely better than a coin flip. The "Carl" and "Emma" voices are generated on demand, adjusting tone and pacing in real time. Walmart has no agent named Carl calling you about a PlayStation 5, but the voice just keeps talking.

The $919 price point is not random. It sits just below $1,000, a threshold some financial institutions use for automatic fraud flags. Scammers study these limits. According to the FTC's Consumer Sentinel Network report, impersonation scams cost Americans $1.1 billion in 2023 alone, part of a broader $10 billion lost to fraud that year. Send 10 million robocalls and even a 0.1 percent success rate yields 10,000 victims.

The Walmart scam is the easier version to spot. You have no relationship with "Carl" and no reason to trust him. The harder version is when the voice belongs to someone you love. With 20 to 30 seconds of audio, a scammer can clone your son's voice, your mother's, your best friend's. The technology is widely available, inexpensive, and requires no technical expertise.

In 2023, a mother in Arizona received a call that sounded exactly like her 15-year-old daughter crying and saying she had been kidnapped. The voice was cloned. The daughter was safe at school. The mother could not tell the difference.

What Stops It

Legitimate companies do not cold-call you and ask for your Social Security number to cancel a purchase. If you get a call like this, hang up, then contact Walmart or your bank using the number on their official website, card, or statement. Do not call back any number the caller provided. A failed callback does not prove the original caller was legitimate; always use an independently sourced contact method.

For calls that sound like someone you know, Trust Onion gives you and your trusted contacts three rotating codewords, calculated locally on your phone, that change every 60 seconds. When a voice claims to be someone you trust, one question settles it: "What are the words?" A familiar voice, a spoofed caller ID, and a convincing script are all things a scammer can fake. A Proofie™, a selfie signed by your passkey the moment you take it, adds a further layer: anyone can check in the Trust Onion app that your key signed the exact original photo, after a known moment, and that nothing has changed since.

AI can clone a voice. It cannot know codewords that exist only on the phones of people you have personally authorized. The real caller answers in three seconds. In 2023, a mother in Arizona could not tell a cloned voice from her daughter's. A shared codeword would have ended that call before the fear set in.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

Public by default, under your control. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.