AI Voices Are Robbing Companies Blind. Your Family Is Next.

The call looked right. It sounded right. It wasn't.

Deepfake voice incidents rose 680% year-over-year, according to research published on BleepingComputer in April 2026 by Adaptive Security researcher Marshall Bennett. At engineering firm Arup, an employee joined a similar AI-generated call in February 2024 and wired $25.6 million to Hong Kong accounts. Same method. Bigger number. The technology is moving faster than the defenses built to stop it.

Why Technical Defenses Keep Failing

Security software scans files, flags emails, and blocks known malware. It wasn't built to watch a video call and ask whether that's actually your CFO. Bennett's research makes the gap explicit: deepfake voice and video attacks exploit human trust through phone and video channels that most security stacks don't monitor. The attack is a conversation, and conversations happen outside the firewall.

Voice cloning now requires as little as 20 to 30 seconds of audio , a LinkedIn video, a conference recording, a voicemail greeting. That's enough. The cloned voice can then call anyone, say anything, and apply the kind of urgency that short-circuits careful thinking: "I need you to wire funds before end of day." "Don't tell anyone yet, it's sensitive." "I'm at the airport, just handle it for me."

Bennett's primary recommendation is to train employees to "pause and verify" before acting on any urgent financial request. That's genuinely good advice. The problem is that "pause and verify" is vague. Verify how? Call back on what number? A callback to a number the attacker supplies proves nothing, and a failed callback doesn't prove the original caller was legitimate. Always use a number from your company directory, a card, or a statement sourced independently of the call itself.

The FBI reported that Americans lost more than $10 billion to phone and online fraud in 2023. Elder fraud alone accounted for $3.4 billion of that, according to the FBI's Internet Crime Complaint Center. The same AI that fooled a trained finance professional can fool anyone. Grandparent scams now routinely use cloned voices, a panicked voice on the line saying bail money is needed immediately, real enough to cause real fear and real transfers.

For finance and security teams, a practical fix already exists inside most approval workflows. Before authorizing a wire transfer, a vendor payment change, or an executive instruction that arrived by phone or video, the receiving employee asks for a shared verification challenge. Trust Onion supplies three rotating codewords, calculated locally on the device, that change every 60 seconds and never touch a server. There is nothing to steal, nothing to intercept. If the words match, the request proceeds. If they don't, it stops.

For families, the conversation is simpler. Agree on the system before a scam call happens: "If anyone calls claiming to be me and needs something urgent, ask them for the words." When someone calls, ask "What are the words?" If they're really who they claim to be, they open the app and read them. If they can't, the call ends. A Proofie™ adds another layer: a selfie signed by your passkey the moment you take it, binding the exact photo to a time and signing key that can be verified in the Trust Onion app and compared against the person's full public key in your shared group.

AI can clone a voice. It cannot fake knowing three codewords that rotate on a schedule and are calculated locally on authorized devices. A fake voice can sound like your CFO. It cannot know what your CFO's phone showed at 3pm today.

Deepfake voice attacks rose 680% in a year. The technology will keep improving.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

Public by default, under your control. Proofie™ photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie™ is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie™ private, or delete it at any time. Deleting a Proofie™ removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.