How AI Voice Scams Work (And What Actually Stops Them)

The call arrives with urgency already built in. Wire this money. Give me your login. Don't tell anyone yet. The voice sounds exactly right because it was engineered to: Group-IB's research documents how attackers harvest a short audio sample, run it through AI voice synthesis tools, spoof the caller ID to show a familiar number, and then call someone who trusts that voice.

The whole sequence can unfold in under five minutes, and the people on the receiving end are not careless. Human detection accuracy for synthetic voices sits around 55 to 60 percent, barely better than a coin flip.

Who Gets Hit First

Group-IB's incident data points to three sectors absorbing the most damage: financial services, executive support, and remote-work help desks. These environments run on calls from authority figures employees have never met face to face. A finance team member hears the CEO asking for a wire transfer. An IT help desk gets an executive requesting a password reset. Nobody questions the voice because the voice sounds right.

Families face the same attack in a different register. A grandparent hears a grandchild in trouble. A parent hears their teenager's voice in distress. The FBI reported that grandparent scams cost Americans over $74 million in 2023 alone, and that was before AI voice cloning became this accessible.

Why Detection Tools Fall Short

Organizations are investing in call authentication systems, AI detection software, and staff training. Group-IB's research is clear that these cannot carry the full load. Voice synthesis quality improves faster than detection tools can keep pace, and a clone that fools a trained security professional today was not possible two years ago.

The deeper problem is structural. On a phone call, you cannot see a badge, check an email signature, or confirm a face. You rely entirely on the voice, and the voice is now fakeable. The only reliable countermeasure is something the attacker cannot know: something absent from every audio clip, earnings call, and social media post the target has ever produced.

For families, that countermeasure is a shared set of rotating codewords. If a caller claiming to be family cannot answer "What are the words?", the call is over. AI can clone a voice. It cannot produce three words that exist only on your family's phones and rotate on a schedule.

Trust Onion is a free app built on this idea. The three words rotate automatically, so overheard words expire before they can be used. The app also supports Proofie™, a selfie signed by your passkey the moment you take it, binding a verified key to the exact photo, time, and location. Share the link and anyone can verify in the Trust Onion app that the key signed that exact image and that nothing has changed since. A valid signature confirms key use at the time of signing, not unconditional proof of physical presence.

For security and finance teams, the same principle applies at the organizational level: verbal challenge protocols, out-of-band confirmation, and rotating challenge questions for any request involving money or credentials. Treat voice-only verification as insufficient for sensitive actions. If you hang up to call back on a known number, remember that a successful callback does not prove the original caller was legitimate; use an independently sourced number from a card, statement, or official app.

Group-IB's findings show these attacks succeed because they exploit trust, not just technology. The attacker borrows the voice of someone you trust and uses it against you, so the countermeasure has to work at that same layer.

The voice on the phone sounds real because it is designed to. The only question worth asking is the one the attacker cannot answer.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

Public by default, under your control. Proofie™ photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie™ is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie™ private, or delete it at any time. Deleting a Proofie™ removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.