# AI Voice Cloning Attacks: How They Work and How to Stop Them

> A cloned voice can sound like your CFO, your help-desk caller or your child. Why recognising a voice is no longer verification, and the procedures that still work.

- URL: https://www.awarexone.com/research/ai-voice-cloning-attacks
- Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone
- Published: 2026 (updated 2026-09-28)
- Topics: Deepfake, Vishing
- Related service: Social engineering and training: https://www.awarexone.com/services/social-engineering

## Short answer

You stop an AI voice cloning attack with procedure, not by judging the voice, because a clone can sound nearly identical and caller ID can be faked. Hang up and call back on a number you already hold, and require two approvers for payments. If money was sent, call your bank or the National Scam Response Centre immediately.

## Summary

- Criminals can copy a real person's voice and call as your boss, a supplier or a family member to ask for money, access or information.
- A familiar voice is no longer proof of identity, and caller ID can be faked, so check the request instead of judging the voice.
- Hang up and call back on a number you already hold, and treat a request not to call back as a reason to call back.
- Use a verification phrase agreed in person, require two people to approve payments and bank changes, and never reset access on a voice alone.
- Never share a password, OTP or backup code on a call. A caller who asks for one is the attack.
- If money was sent, call your bank's hotline or the National Scam Response Centre on 997 immediately, then make a police report.

It is 5.10 on a Thursday afternoon. The accounts executive at a Penang distributor picks up a call from the finance director. The voice is right: the slight hoarseness, the way he says her name, the habit of starting every sentence with "OK, so". He is at the airport, a supplier has changed banks, and the payment has to go out before the cut-off. His battery is nearly dead, so please do not call back. He will sign the paperwork on Monday.

This scenario is illustrative, but its pattern matches what the FBI and PDRM now warn about. A familiar voice used to settle the question of who was calling. Generative AI has ended that. The fix is not a better ear. It is a verification step that works whether or not the voice is real.

This guide explains what voice cloning attacks are, how criminals use them against organisations and families, and the procedures that stop them.

Last checked: 28 September 2026.

## What Is an AI Voice Cloning Attack, and How Do You Stop One?

An AI voice cloning attack is a scam or intrusion in which a criminal uses software to imitate a real person's voice, then calls or sends voice messages as that person to get money, access or information. Common targets are finance staff asked to pay or change bank details, IT help desks asked to reset a password or MFA, and families asked for emergency money. You stop it with procedure, not detection: hang up and call back on a number you already hold, confirm high-risk requests through a second channel, require two people to approve payments and bank-detail changes, use a pre-agreed verification phrase, and never reset access on the strength of a voice alone. In Malaysia, if money has moved, call your bank's hotline or the National Scam Response Centre on 997 immediately.

## What Is AI Voice Cloning?

AI voice cloning is the use of machine-learning software to generate speech that sounds like a specific person. The FBI's December 2024 public service announcement, [Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud](https://www.ic3.gov/PSA/2024/PSA241203), calls it vocal cloning and notes that creating synthetic content "is not inherently illegal". Audiobooks, accessibility tools and dubbing use the same technology legitimately.

The attack is the misuse: pairing a convincing voice with a believable story to make someone act. That is vishing, or voice phishing, which the FBI notes "may incorporate AI-generated voices". The story, the timing and the request do most of the work, and they are usually built from public information. Our guide to [how attackers research your company](https://www.awarexone.com/research/osint-how-attackers-research-your-company) shows how much of that is already online.

## How Do Criminals Use Cloned Voices Against Organisations?

Most organisational attacks aim at one of four actions: moving money, changing where money goes, resetting access, or handing over information. A cloned voice makes the request sound like it comes from someone with the authority to ask.

- CEO and CFO fraud. A call or voice note from a senior leader asks for an urgent, confidential payment. The joint NSA, FBI and CISA information sheet [Contextualizing Deepfake Threats to Organizations](https://www.cisa.gov/news-events/alerts/2023/09/12/nsa-fbi-and-cisa-release-cybersecurity-information-sheet-deepfake-threats) (September 2023) warns of criminals impersonating "key leaders or financial officers" to "illegitimately authorize the disbursement of funds".
- Supplier payment changes. A caller who sounds like a known supplier contact confirms new bank details that arrived by email, making a fraudulent email look verified.
- Help-desk resets. A caller claiming to be an employee asks IT to reset a password or move MFA to a new phone. CISA's [Scattered Spider advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a) (updated July 2025) describes criminals phoning help desks to do exactly that. It concerns phone social engineering generally, not cloned voices, but a cloned voice makes the approach more convincing.
- Voice messages that open a conversation. The FBI's [May 2025 PSA](https://www.ic3.gov/PSA/2025/PSA250515) and [December 2025 update](https://www.ic3.gov/PSA/2025/PSA251219) describe AI-generated voice messages impersonating senior US officials. Once targets moved to an encrypted app, criminals asked for authentication codes, identity documents, wire transfers and introductions.

The same information sheet records a May 2023 case in which a poor-quality WhatsApp audio call from an impersonated executive moved to a video meeting and then to text, where the caller pushed for a wire transfer. The target grew suspicious and ended it. Watch for that pattern: each change of channel moves the target further from normal controls.

Scale is hard to measure, because many reports do not say whether a voice was synthetic. The FBI's [2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf), covering complaints filed with IC3 in 2025 (mainly from the United States), counted 22,364 complaints referencing AI, with about US$893 million in reported losses, across every kind of AI use, not voice alone.

## How Are Cloned Voices Used Against Families?

The family version is simpler and faster. A parent gets a call from what sounds like their son or daughter: an accident, an arrest, a phone that has broken, a need for money right now. The FBI says criminals "generate short audio clips containing a loved one's voice to impersonate a close relative in a crisis situation, asking for immediate financial assistance or demanding a ransom".

Malaysian police describe the same thing. In a January 2026 [scam alert from PDRM's Commercial Crime Investigation Department](https://www.rmp.gov.my/news-detail/2026/01/26/besmartstayalert-letsfightscammertogether-posting-pilihan-scam-alert-awas-penipuan-ai-semakin-realistik!), police warned that criminals imitate the voices of family members or close friends to push for urgent transfers, using AI voice cloning, fake emergency calls and deepfake audio or video. The advice: do not trust a voice easily, verify identity through another channel, and do not rush a payment.

You may also have seen warnings about "silent calls" that record your voice. In December 2025, the director of the Bukit Aman Commercial Crime Investigation Department told Bernama that police had not yet received reports of voices being captured that way and used to defraud contacts, while still advising caution ([Malay Mail](https://www.malaymail.com/news/malaysia/2025/12/13/beware-silent-calls-police-caution-amid-fears-of-ai-voice-exploitation-scams/201797)). The practical point stands either way: many people's voices are already public on social media, so the defence has to work even if the criminal has a good sample.

## Why "It Sounded Like Them" Is No Longer Verification

Recognising a voice tells you who a caller sounds like. It does not tell you who is calling. The FBI now says cloned voices and real ones "can sound nearly identical", and that AI-generated content "has advanced to the point that it is often difficult to identify".

The other signals people lean on are weak too. Caller ID can be faked: a senior Selangor police officer told [Media Selangor](https://mediaselangor.com/ms/2026/08/390975) in August 2026 that spoofing lets criminals make a number look like an official police line. Personal details prove little, because a prepared caller has researched them. A choppy line is easy to explain away ("I'm at the airport").

Detection tools help in some contact centres, but most attacks land on an ordinary mobile where nothing is listening. Listening for odd tone or word choice, as the FBI suggests, is worth doing. Just do not make it the control.

> Note: **The rule that holds up.** Do not try to decide whether the voice is real. Decide whether the request is real, by checking it through a channel the caller does not control.

Falling for this is not carelessness. The request arrives with authority, urgency and a reason for secrecy, and our article on [the six psychological levers social engineers use](https://www.awarexone.com/research/six-psychological-levers-social-engineers-use) explains why those pressures work on careful people.

## Where Voice Fits in Deepfake Video Fraud

Voice cloning is often one layer of a larger deepfake. In the best-known case, a finance employee at Arup's Hong Kong office joined a video call in early 2024 with people he believed were the chief financial officer and colleagues. Hong Kong police said all were deepfake re-creations, and the Secretary for Security later told the [Legislative Council](https://www.info.gov.hk/gia/general/202406/26/P2024062600192.htm) that police believed the meeting was pre-recorded from public online video clips and voices of the impersonated officer. He sent HK$200 million (about US$25.6 million) across 15 transactions. Arup confirmed to [CNN](https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk) that "fake voices and images were used".

Live video brings its own checks, covered in our guide to [verifying a suspicious video call](https://www.awarexone.com/research/deepfake-video-call-verification). The controls below apply to phone calls and voice messages.

## Attack Situations and the Verification Control That Stops Them

Each common situation has one control that works however good the voice is:

*Common voice cloning situations and the matching control*

| Situation | What the caller wants | Verification control |
| --- | --- | --- |
| "CEO" or "CFO" calls about an urgent, confidential payment | A transfer outside the normal cycle | Call back on the directory number, plus a second approver for any payment outside the normal cycle |
| "Supplier" confirms new bank details by phone | Future payments redirected | Verify with a contact already on file, never one from the new email or call, through the supplier-change procedure |
| "Employee" asks the help desk to reset a password or MFA | Control of the account | Identity checked through a documented method that does not rely on the voice, such as a manager call-back or an authenticated ticket |
| Voice note from a "senior official" or "director" asks to move to another app | A private channel away from normal controls | Confirm through a previously known platform or number before replying |
| "Your child" or "your parent" calls in a crisis asking for money | An urgent transfer to a third-party account | Ask for the family verification phrase, then hang up and call them on their saved number |
| "Police", "bank" or "LHDN" calls about your account or a case | Money moved to a "safe" account, or personal details | Hang up and call the organisation's official number yourself |

## Call Back on a Known Number, Every Time

A call-back to a number you already hold is the single most useful control against voice cloning. End the call, find the person's number in the directory, your contacts or an earlier trusted record, and ring them yourself. The FBI gives the same advice: hang up, find the number independently, and call it directly.

- Never use a number, link or contact given in the call, the voice message or the email that started it.
- If their phone is "dead", reach them another known way: their assistant, their manager, an internal chat you already use.
- Treat "please do not call back" as a reason to call back, not a reason to skip it.

Malaysian guidance points the same way. PDRM's advisory on [business email compromise](https://rmp2u.rmp.gov.my/content/posting-pilihan-kenali-bec) tells businesses to verify payment requests by phone or another channel. MyCERT's May 2026 ["Boss Impersonation" alert](https://www.mycert.org.my/portal/advisory?id=MA-1439.052026) describes emails to executives, often at personal Gmail addresses, that open with "Are you in the office?" and steer away from normal procedures while "discouraging independent verification". That alert concerns email, not voice, but the pattern is the same. MyCERT recommends confirming sensitive requests by phone, an official messaging platform or face to face, and secondary verification for financial transactions.

## Use Pre-Agreed Verification Phrases

A verification phrase is a word or short phrase agreed in advance, in person, that the real person can give and a criminal cannot. The FBI recommends that families "create a secret word or phrase" to verify each other's identity. The NSA, FBI and CISA information sheet makes a similar point for organisations: identity checks during real-time communication can rely on something like a one-time PIN or known personal details, especially before financial transactions.

To make a phrase useful:

- Agree it face to face. Never send it by email, text or chat.
- Choose something that is not on social media: not a pet's name, a school or a birthday.
- Change it if it may have been overheard or written somewhere insecure.
- Keep family and work phrases separate, and limit work phrases to people who approve money or access.
- Use it with a call-back, not instead of one. A phrase can leak.
- Never type it into a website or give it to anyone who asks for it. It is not a system password.

## Require Dual Approval for Money and Bank-Detail Changes

Dual approval means no single person can both request and release a payment or a change to bank details. A cloned voice may persuade one person. It has to persuade two people, through two separate checks, to succeed.

- Any payment outside the normal cycle needs a second approver who was not on the original call.
- Any change to supplier or payroll bank details goes through the existing change procedure, whoever asks and however senior they sound.
- Leaders state in writing that they will never ask anyone to skip these steps, and that staff who verify them will be thanked.

The last point matters most: a rule that binds the managing director like a new hire removes the social cost of saying "I need to check". Our piece on [why social engineering beats your security stack](https://www.awarexone.com/research/why-social-engineering-beats-your-security-stack) explains why process controls like this often matter more than another tool.

## Build Help-Desk Identity Procedures That Do Not Rely on a Voice

A help desk should never reset a password, MFA method or device enrolment on the strength of how a caller sounds. The FBI warns that criminals have used AI-generated audio of individuals to access bank accounts, so a voice cannot be the proof of identity for account access either.

A defensible procedure usually includes:

1. A written list of acceptable identity checks for resets, agreed with security.
2. Verification through a channel the caller does not control, such as a call-back to the number on the employee record or confirmation from their line manager.
3. Extra checks for privileged accounts, executives and anyone moving MFA to a new device.
4. A notification to the user through an existing channel after every reset, so a real employee can flag one they did not ask for.
5. Logging and review of every reset, including how identity was confirmed.
6. Permission for staff to pause any pressured request and escalate to security.

If you use a contracted help desk, hold it to the same standard. CISA notes the same group abused trusted relationships with contracted IT help desks.

## Reduce the Audio and Context Criminals Can Use

You cannot remove every executive's voice from the internet, and leaders should not have to stop speaking. You can reduce the easy material. The FBI suggests limiting online content of your image or voice and keeping social media accounts private. Review whether voicemail greetings need full names and titles, whether internal recordings go public by default, and whether finance and help-desk direct lines belong on the website.

For creators and public figures, a cloned voice often appears alongside fake profiles, which our [digital identity protection](https://www.awarexone.com/digital-identity-protection) work covers. All of this raises the criminal's cost. Verification is still the control.

## What to Do If You Think You Took a Cloned-Voice Call

Act quickly and in this order. Speed matters most when money has moved.

1. If money was sent, call your bank's 24-hour hotline or the National Scam Response Centre on 997 immediately. The NSRC says acting fast can help reduce losses, though there is no guarantee money will be recovered.
2. Make a police report at the nearest police station.
3. Do not call the number back, and do not reply to the voice message.
4. Contact the person who was impersonated through a separate, known channel, so they can warn others.
5. Save evidence: the number, call time, any voice message, related screenshots and transaction details.
6. At work, report it straight away so security can check whether others got the same call.
7. For cyber incidents affecting an organisation, CyberSecurity Malaysia's [Cyber999 service](https://www.cybersecurity.my/portal-main/services/cyber999-overview) takes reports.
8. If you shared a password or login code, change the password from a trusted device and sign out of all other sessions.

> Warning: **Never share codes, whoever is calling.** No bank, police officer, platform or employer needs your password, OTP or backup codes over the phone. The FBI specifically warns never to give a two-factor code to anyone by call, text or messaging app. A caller who asks for one is the attack.

Report without blame. Someone who says "I think I was just fooled" within five minutes gives you the best chance to stop a payment. Someone who waits a day, afraid of blame, does not.

## Rehearse Before a Real Call Arrives

Written procedures are not the same as procedures people follow under pressure. The NSA, FBI and CISA information sheet tells organisations to plan for deepfake techniques, run "several tabletop exercises" with the likeliest targets, including executives, and train staff to respond to and report suspected manipulated media.

Rehearsal can be a tabletop session where finance and the help desk walk through a fake CFO call and practise the call-back. Some organisations go further with authorised voice simulations, which need written authorisation, an agreed scope and scenarios, an emergency stop contact, and reports that fix processes rather than name individuals. Our view on [why security awareness training often fails](https://www.awarexone.com/research/security-awareness-training-is-broken) explains why short, role-specific practice beats an annual slide deck.

AwareXone, a Malaysian security company, runs [authorised social-engineering testing and training](https://www.awarexone.com/services/social-engineering), including voice and deepfake scenarios where the scope covers them, under those same guardrails. You can read [how we work](https://www.awarexone.com/trust).

## Voice Cloning Readiness Checklist

- Staff call back on a known number before acting on unusual voice requests.
- A current directory covers executives, key suppliers and your bank.
- Off-cycle payments need a second approver.
- Bank-detail changes follow a fixed procedure, whoever asks.
- The help desk never resets passwords or MFA on voice alone.
- Finance approvers and families have phrases agreed in person.
- Leaders have said they expect to be verified.
- One easy reporting route exists, and early reporters are thanked.
- Everyone knows to call the bank hotline or 997 if money moves.
- The team has rehearsed a voice scenario in the last year.

## Frequently Asked Questions

### Can AI really copy someone's voice well enough to fool family or colleagues?

Yes. The FBI warns that cloned voices can sound nearly identical to the real person, and that AI-generated content is often difficult to identify. PDRM has warned Malaysians that criminals imitate family members' and friends' voices to request urgent transfers. That is why a familiar voice should not be treated as proof of identity for any request involving money or access.

### How can I tell if a phone call uses a cloned voice?

Often you cannot, and trying to judge by ear is not a reliable control. Listening for odd tone or word choice can help, but a good clone may have neither. The dependable approach is to end the call and ring the person back on a number you already hold, or ask for a verification phrase agreed in person. If the request is genuine, it will survive that check.

### What is a family safe word, and how should we set one up?

A family safe word is a word or short phrase agreed in advance that confirms a caller really is your relative. The FBI recommends one. Agree it face to face, choose something that never appears on social media, and change it if it may have been overheard. Use it together with calling the person back on their saved number, never as the only check.

### Is caller ID enough to confirm who is calling?

No. Caller ID can be spoofed. A Selangor police officer said in August 2026 that criminals can make a number appear to be an official police line. A familiar name or number on screen only shows what the caller wants you to see. Hang up and dial the person or organisation yourself, using a number from your contacts, a directory or the official website.

### Can a voice cloning attack get past our IT help desk?

It can if the help desk accepts a caller's voice as proof of identity. CISA has documented criminals phoning help desks to have passwords reset and MFA moved to their own devices. Resets should require a documented identity check through a channel the caller does not control, extra checks for privileged accounts, a notification to the real user, and logging of every reset.

### What should I do in Malaysia if I sent money after a cloned-voice call?

Call your bank's 24-hour hotline or the National Scam Response Centre on 997 immediately, because quick action can help reduce losses, although recovery is not assured. Then make a police report at the nearest station. Keep the caller's number, call times, any voice messages and transaction records, and tell the person who was impersonated through a separate channel.

### How is voice cloning different from a deepfake video call?

Voice cloning imitates only how someone sounds, usually on a phone call or voice message. A deepfake video call adds a synthetic face, as in the 2024 Arup case in Hong Kong. The core defence is the same for both: confirm the request through a channel the caller does not control. Live video calls also call for their own verification steps during the meeting.

### Can organisations safely test staff against voice cloning attacks?

Yes, through an authorised programme. That means written authorisation from leadership, an agreed scope and scenarios, an emergency stop contact, and reports that focus on process gaps rather than naming individuals. Tabletop exercises are a low-risk starting point. The aim is to find where procedures break under pressure and fix them, not to catch people out.

## Official sources

- [FBI IC3 PSA I-120324-PSA: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (3 December 2024)](https://www.ic3.gov/PSA/2024/PSA241203)
- [FBI IC3 PSA I-051525-PSA: Senior US Officials Impersonated in Malicious Messaging Campaign (15 May 2025)](https://www.ic3.gov/PSA/2025/PSA250515)
- [FBI IC3 PSA: Senior U.S. Officials Continue to be Impersonated in Malicious Messaging Campaign (19 December 2025)](https://www.ic3.gov/PSA/2025/PSA251219)
- [FBI IC3: 2025 Internet Crime Report (April 2026)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [NSA, FBI and CISA: Contextualizing Deepfake Threats to Organizations (12 September 2023)](https://www.cisa.gov/news-events/alerts/2023/09/12/nsa-fbi-and-cisa-release-cybersecurity-information-sheet-deepfake-threats)
- [CISA and partners: Scattered Spider advisory AA23-320A (updated 29 July 2025)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [MyCERT MA-1439.052026: "Boss Impersonation" Scam Email alert (12 May 2026)](https://www.mycert.org.my/portal/advisory?id=MA-1439.052026)
- [PDRM CCID: Scam alert, AI scams increasingly realistic (26 January 2026)](https://www.rmp.gov.my/news-detail/2026/01/26/besmartstayalert-letsfightscammertogether-posting-pilihan-scam-alert-awas-penipuan-ai-semakin-realistik!)
- [PDRM CCID: Kenali BEC, business email compromise advisory (updated 15 August 2026)](https://rmp2u.rmp.gov.my/content/posting-pilihan-kenali-bec)
- [NFCC: About the National Scam Response Centre (NSRC)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc)
- [CyberSecurity Malaysia: Cyber999 overview](https://www.cybersecurity.my/portal-main/services/cyber999-overview)
- [Malay Mail (Bernama): Police caution on silent calls and AI voice exploitation (13 December 2025)](https://www.malaymail.com/news/malaysia/2025/12/13/beware-silent-calls-police-caution-amid-fears-of-ai-voice-exploitation-scams/201797)
- [Media Selangor (in Malay): Scammers using voice cloning to impersonate family members (25 August 2026)](https://mediaselangor.com/ms/2026/08/390975)
- [CNN: Arup revealed as victim of US$25 million deepfake scam (16 May 2024)](https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk)
- [Hong Kong Government: LCQ9, Combating frauds involving deepfake, Secretary for Security's written reply (26 June 2024)](https://www.info.gov.hk/gia/general/202406/26/P2024062600192.htm)

---

AwareXone is an independent provider serving clients worldwide, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.