AI Voice Cloning Scams: How to Verify a Caller (FTC & FBI Guidance)

How voice cloning scams actually play out

A voice cloning scam is an old confidence trick with a new prop. The scammer still needs urgency, secrecy, and a payment channel that cannot be reversed. What the cloned voice adds is the emotional shortcut: a familiar voice in distress makes people skip the step where they would normally ask questions. The voice does not have to be perfect. A phone line, a bad connection, crying, and a "lawyer" who takes over the call cover a lot of imperfection.

For the scale of the problem, including FBI complaint and loss figures, see our sourced AI voice cloning scam statistics roundup. This article is about the moment the phone rings.

What the FTC, FBI, and FCC say

Three US agencies have published guidance or rules on AI voice cloning, and their advice converges on one behaviour: independent verification through a channel the scammer does not control.

FTC: call back on a number you know

In its April 8, 2024 consumer alert "Fighting back against harmful voice cloning", the FTC's core advice is to call the person who supposedly contacted you using a phone number you know is theirs and verify the story. If you cannot reach them, try to get in touch through another family member or their friends. Scams should be reported to the FTC at ReportFraud.ftc.gov.

FBI: research, verify independently, use a secret phrase

The FBI's Internet Crime Complaint Center issued a public service announcement on May 15, 2025, "Senior US Officials Impersonated in Malicious Messaging Campaign", warning that malicious actors were using AI-generated voice messages (vishing) alongside text messages (smishing) to impersonate senior officials, and noting that AI-generated audio is increasingly used to impersonate both public figures and personal relations. Its recommendations apply to any suspicious call:

• Before responding, research the originating number, organisation, or person, then independently identify a phone number for that person and call to verify their authenticity.
• Create a secret word or phrase with your family members to verify their identities.
• Listen closely to tone and word choice to distinguish a legitimate call or voice message from a known contact from AI-generated voice cloning.
• Do not send money, gift cards, cryptocurrency, or other assets to people you do not know or have met only online or over the phone.
• Report incidents to the Internet Crime Complaint Center at ic3.gov.

FCC: AI voices in robocalls are "artificial" under the TCPA

On February 8, 2024 the FCC announced the unanimous adoption of a Declaratory Ruling recognising that calls made with AI-generated voices are "artificial" under the Telephone Consumer Protection Act, effective immediately. The practical effect is that using AI to generate the voice in an unsolicited robocall is itself illegal, giving state attorneys general additional tools against the people behind voice cloning scams. It does not make the calls stop, which is why the personal routine below still matters.

Verify a caller in 60 seconds

Notice that none of these steps require deciding whether the voice is real. They work because they move the decision to a channel the scammer does not control. That is the whole design, and it is why official guidance leads with call-back rather than with detection.

Setting up a family code word

The FBI recommends a secret word or phrase with family members; the FTC's call-back advice assumes you know who to call. Combining them takes ten minutes at a family dinner.

• Pick something that has never been online. Not a pet, a street, a team, or a maiden name. An inside joke, a made-up word, or a phrase from a family story works better because it cannot be scraped from a profile.
• Share it face to face or by a channel you already trust, and never in the same message thread a stranger could read later.
• Include the people most likely to be targeted: grandparents, teenagers with public accounts, and anyone who handles money for the family.
• Agree the rule, not just the word: "If anyone calls asking for money, we ask for the word, then we hang up and call back." Rehearse it once so it is muscle memory under stress.
• Extend it to work. Teams that approve payments can adopt the same idea: a verbal request from an executive is confirmed on the executive's known number or in person, every time, with no exceptions for urgency.

What a voice detector can and cannot do during a live call

People searching for an AI voice detector in the middle of a scam are usually hoping for a live verdict. Free consumer tools do not offer one. The EyeSift AI voice detector analyzes a saved file in your browser; it cannot listen to a call. Real-time detection exists, but as enterprise products aimed at banks, contact centers, and meeting platforms, not as an app on a personal phone.

Where a detector does help is afterwards. If the scammer left a voicemail or sent a voice note, save the file and screen it. EyeSift reports waveform and file-quality signals (duration, bitrate, silence, clipping, dynamic range, micro-variation) with a reliability label, and never uploads the audio. It is a heuristic screen, not a spectral classifier, and it can miss a good clone or flag a badly compressed real message, so treat the result as one note in your report rather than a verdict. For how to listen critically yourself, see how to tell if a voice is AI-generated; for the free tools compared honestly, see free AI voice detectors in 2026.

If money has already been sent

1. Contact the bank, card issuer, or payment provider immediately and ask them to stop, recall, or dispute the transaction. Speed matters more than anything else at this stage; do not wait to gather evidence first.
2. If gift cards were used, contact the card issuer with the card numbers and receipts and ask whether the balance can be frozen.
3. Report to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov. Include the phone numbers, the times, any voicemail file, and the payment details.
4. Preserve everything: the voicemail or voice note as an unmodified file, screenshots of messages, call logs, and receipts. Do not re-record audio from a speaker; forward or export the original.
5. Warn the person who was impersonated and the rest of the family. Scammers who succeed once often try the same voice on other relatives.
6. Do not pay anyone who offers to recover the money for a fee. Recovery scams target recent victims.

Reduce the raw material

Cloning needs a voice sample, and the easiest samples are public: video posts, voicemail greetings, podcast appearances, and answering unknown numbers with a few full sentences. You do not need to disappear from the internet, but it is reasonable to make voicemail greetings short and generic, to let unknown numbers go to voicemail, and to talk with teenagers and older relatives about why a stranger might want them to keep talking. For organisations, the same logic applies to executives whose voices are on every earnings call: assume the voice is clonable and build approval processes that do not depend on recognising it. Our guide for teachers, podcasters, and HR teams covers policy language for exactly that.

Provenance tools are slowly making some synthetic audio identifiable: ElevenLabs says it embeds imperceptible watermarks in audio it generates and offers a classifier for its own output, and Google's SynthID marks audio from Lyria and NotebookLM. Scammers do not use tools that label their output, so those signals help journalists and platforms more than families. We explain what they cover and do not cover in Does ElevenLabs watermark its audio?

Frequently Asked Questions