O2 Blocks 3 Million Scam Calls a Week. The Rest Still Get Through.

The scale is real. O2, now part of Virgin Media, has rolled out a free AI-assisted fraud call blocking service to all its UK customers, built on technology from voice security company Hiya. According to The Fast Mode's January 2026 report, the system monitors the network in real time, refines its detection based on customer reports and call behaviour analysis, and is expected to stop more than 3 million fraudulent calls every week before they reach a phone.

That is a serious piece of infrastructure. And it still leaves a gap that matters.

Network-level filtering catches calls that match known patterns: numbers on blocklists, traffic that behaves like a dialler, signatures Hiya has already seen and catalogued. What it cannot catch is a targeted call from a number that looks clean. A scammer who researches a specific household, or a fraudster running a voice-cloned impersonation of a colleague to authorise a wire transfer, does not look like bulk spam traffic. Those calls arrive sounding personal, urgent, and entirely plausible.

The Calls That Get Through

AI can clone a voice from about 15 seconds of audio, according to NPR's April 2024 reporting on voice synthesis tools. A call that mimics a CFO asking a finance officer to approve an urgent vendor payment, or a grandparent hearing what sounds like a grandchild stranded abroad, does not trigger a spam filter. It sounds like someone they know, and studies show people often cannot tell a cloned voice from a real one. That is the gap network blocking does not close.

For families, the question worth asking is not only whether a call was blocked, but what to do when one gets through and sounds real. A three-word check gives everyone a practical way to handle that moment: if someone calls claiming to be a family member in trouble, ask for the family's three rotating codewords. A cloned voice cannot know words it never heard, and because they change every 60 seconds, an overheard word expires before it can be used.

The Same Problem in a Finance Context

Security and finance teams face an equivalent version of this. A call from a number that belongs to the CEO, arriving in business hours with a familiar voice, sits well outside what a carrier-level spam filter is designed to catch. The same principle applies: a shared three-word challenge between the executive and the approver gives the person receiving the request a way to check before any funds move. If they cannot give the words, treat the request as unverified, hang up, and call back on a number you already know. A failed callback does not prove the original caller was legitimate; the caller must still provide the team's private codewords.

O2's 3-million-calls-a-week figure is not a reason to feel complacent. It is a measure of the volume that makes it worthwhile to think past the filter. The calls worth worrying about are not the ones that look like spam. They are the ones that sound like someone you trust.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it.