BBB: AI Scam Complaints Hit 100,000 as Voice Cloning Explodes

Complaints are climbing year over year and are on pace to surpass 3,000 in 2026 alone. The BBB issued its warning in August 2026: AI has turned phone fraud into an automated assembly line, and voice cloning is the sharpest tool on the belt.

Scammers need just 20 to 30 seconds of audio to build a convincing clone of almost anyone's voice. A voicemail greeting is enough, and so is a social media video or a clip from a public recording. The clone can mimic tone, pacing, and speech patterns convincingly enough that human detection accuracy sits at only around 55 to 60 percent, barely better than a coin flip.

The "Are You Sure It's Really Them?" Problem

The call arrives. It sounds like your son. He's panicked, says he's been in an accident, needs money fast, please don't tell anyone. You wire the money. An hour later, your actual son calls.

This is the scenario those 100,000 BBB complaints describe. The script works because it keeps you emotionally activated and moving fast. Scammers know families don't interrogate the people they love.

The BBB's advice is to pause, call back on a known number, and verify. That's sound, but a failed callback does not prove the original caller was legitimate, and in a moment of panic, most people don't remember to do it at all.

How the Automation Works

AI doesn't sleep or need a call center. According to the BBB's August 2026 warning, scammers now chain multiple tools together: a cloned voice handles the call, a polished phishing message handles the follow-up, a deepfake video handles the proof. For higher-stakes fraud, the video call variant is especially dangerous. In February 2024, engineering firm Arup lost $25 million when an employee authorized a wire transfer after joining a video call where every participant, including someone who appeared to be a senior executive, was a deepfake.

Each piece of the pipeline reinforces the others, and none of it requires a human scammer on the other end in real time.

AI can clone a voice. It cannot know something it was never told. That's the gap a family's three rotating Trust Onion codewords fill. The free app gives every family three words that change every 60 seconds, calculated locally on each phone. When a call comes in sounding like your daughter, you ask one question: "What are the words?" A cloned voice cannot answer that. The words changed 40 seconds ago and will change again in 20 more. If the caller knows them, it's really her. If they hesitate or deflect, hang up. A failed callback on its own does not confirm the original caller was genuine; the codewords give you an independent check.

A Proofie™ is a selfie signed using your passkey in the Trust Onion app. Share the link and anyone can verify in the app that your key signed that exact photo after a known moment, and that nothing has changed since. Codewords work alongside Proofies, not as an overlay or signed field.

The BBB also recommends reporting scams at bbb.org/scamtracker, which helps others recognize patterns. Families who set up a verification plan before a call arrives are the ones who hang up before the money leaves their account.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

Public by default, under your control. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.