Deepfake Scam Calls Are Surging. Here's How to Stop Them.

The Voice on the Phone Isn't Who You Think It Is

Voice cloning now requires just 20 to 30 seconds of audio. That's a short voicemail, a quick video posted to social media, or a clip from a family call recorded months ago.

Once someone has that audio, they can generate a convincing imitation of that person's voice, close enough that most people cannot tell the difference.

Criminals use these tools to impersonate airlines, hotels, banks, and travel agents. They call you during a trip. They call your parents when you're unreachable. They call anyone who might panic, act fast, and not stop to think.

A Summer Surge Is Already Here

Experts warned in May 2026 that deepfake scam call volume on U.S. phone networks had hit record levels. Summer travel season makes the problem worse. People are away from home, out of routine, and more likely to get an unexpected call about a delayed flight, a frozen card, or a family member in trouble.

The scam exploits exactly that moment. The urgency is manufactured. The voice is fake. The pressure is real.

The numbers show it works. According to the CW33 report, individual victims of scam calls lost an average of $1,500 per incident in 2024. That's a car payment, a month of rent, a semester of tuition.

How the Scam Actually Works

The setup varies, but the structure is almost always the same.

You get a call. The voice sounds familiar, or official, or both. There's a problem that needs solving right now. You need to provide information, send money, or approve something before the window closes.

Experts point to a few tells: strange pauses between words, a slightly flat tone, and relentless pressure to act immediately. But these tells are getting harder to spot as the tools improve, and relying on your ear alone is not a reliable defense.

The more dangerous version of this scam doesn't target you directly. It targets someone you love.

When the Caller Claims to Be Your Family

Imagine your mother gets a call. The voice sounds exactly like yours. It says you've been in an accident, or arrested, or robbed abroad. It says you need money wired immediately, and not to tell anyone else.

This is the grandparent scam, updated with AI. It's been running for years, and voice cloning has made it far more convincing. The Federal Trade Commission has documented cases where elderly victims sent thousands of dollars before anyone in the family knew the call had happened.

The caller sounds like your kid. How is your mother supposed to know it's not?

The Problem With Telling People to "Listen Carefully"

The advice going around right now is to listen for AI voice tells: the pauses, the flatness, the pressure. That advice isn't wrong, but it puts the entire burden on the person receiving the call, in real time, while they're scared.

That's a hard test to pass under pressure, and scammers know it.

The tells are also getting subtler. Newer voice cloning models produce more natural cadence, more realistic emotional tone, and fewer mechanical artifacts. The audio-detection advice will be even less reliable by next summer than it is today.

What you need is a verification method that doesn't depend on your ability to detect a fake voice in the moment.

Three Words That Stop the Scam

Trust Onion is a free app that gives you a private set of three rotating codewords to share with anyone you want to be able to verify: people you know, or institutions you've pre-registered a challenge with. The words rotate every 60 seconds, calculated locally on each device with no server involved. When someone calls claiming to be a person you know, a bank, or another trusted institution, you ask one question: "What are the words?"

If the caller can't answer, the call is over. It doesn't matter how convincing the voice sounds, how official the caller ID looks, or how urgent the story is. If they don't know the words, they're not who they say they are.

An AI can clone a voice. It cannot know three codewords rotating on a private schedule that live only on authorized devices.

The words expire automatically, so stolen words become useless within seconds. There's nothing to intercept, no server to breach, no account to compromise. You share three words with the people and institutions you trust, and you ask for them when something feels off. Three seconds, done.

A Proofie™ is a selfie signed by your passkey the moment you take it. Share the link, and anyone can check in their own browser that your key signed this exact photo, after a known moment, and that nothing has changed since. A standard P-256 WebAuthn passkey signs after Face ID, fingerprint or device-passcode unlock. The signature must carry both user-presence and user-verification flags. This is not a crypto-wallet signature. Identity is the full signing public key, not its shortened label. Save a previously trusted key to recognize later Proofies from the same key. This does not automatically verify a real-world identity or detect AI-generated images. Signed time and place cannot be changed undetected; they are not independent proof of physical whereabouts or exact capture time. Family codewords work alongside Proofies, not as an overlay or signed field. The photo is permanently published to public IPFS, and the full signed record is public JSON pinned to IPFS. Removing a Proofie in the app hides it from your list and disables its share link, but does not erase the photo from IPFS. Only create Proofies whose photo and signed information you are comfortable making public permanently.

What to Do Before the Call Comes

You don't set up identity verification after something goes wrong. You set it up now, when everyone is calm and the stakes are low.

Talk to the people in your life. Decide on a plan for what to do when a call seems urgent and the voice seems familiar. The plan should include a way to verify identity that doesn't rely on recognizing a voice or trusting a caller ID.

The summer surge is here. Scammers are making record numbers of calls with tools that make fake voices sound real, and they're targeting travelers, seniors, and anyone who might act on fear before thinking.

A shared codeword system costs nothing and takes minutes to set up. That's the difference between a scam that lands and one that gets stopped in the first three seconds.

Trust Onion is free. The three rotating codewords work offline. You can have this protection today.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

A lasting record of a place and time. Proofie™ images are stored on IPFS, a third-party distributed file network. Once created and shared, copies can’t be deleted everywhere by you, the recipient, us, or bad actors. So when you create a Proofie, you make a verifiable record of the place and time it captures.