AI Voice-Cloning Scams: How to Protect Your Family

A voice message arrives from your son asking for money, urgently. You know his voice from the first word. Is that enough to believe it? Until recently the answer was yes. Today it is no. In this article I explain how the fraud works and what you can do this week to protect your parents, your children and your team.

I have worked in information security inside organisations in Saudi Arabia, Canada and Jordan, and the protection rules below come from that work. Everything is current as of October 2026, and every figure or incident has a source listed at the end.

Your son's voice asks for money… and it is not your son

Picture it. It is ten at night, and a WhatsApp voice note arrives from the number of your son, who is studying abroad. It is his usual voice, with what sounds like real panic in it: "Dad, I had a small accident and I'm fine, but I need some money tonight. Don't tell Mum, she'll worry." Your heart outruns your head, and your thumb moves toward your banking app.

I made that scene up, but it follows a pattern that official bodies warn about. In March 2023 the US Federal Trade Commission described a call in which the caller sounds like a panicked grandchild who says he has had a car crash, is in jail and needs money. It explained that the scammer needs only a short clip of your relative's voice and a voice-cloning programme. In April 2024 the FTC returned to the subject, saying scammers use cloning to make their requests for money or information more believable.

The technology is not the most dangerous part. The moment is. Fear for someone you love switches off cold thinking, and the scammer builds everything on that.

How your voice can be cloned from a few seconds

Cloning software learns the tone of a voice from a sample, then speaks any text the scammer types in that voice. Samples are easy to find: a video on your public profile, a clip from a family event, a voice note that fell into a stranger's hands.

How much audio is needed? The security company McAfee surveyed 7,054 people in seven countries and reported in May 2023 that its researchers got an 85% match with the original voice from just three seconds of recording in one of their tests. But McAfee is a commercial vendor, the survey figures are self-reported, and the test was its own, so do not read these numbers as settled science. The direction is clear, though, and it agrees with the FTC's warning.

One more number carries different weight, because it comes from filed complaints rather than a company survey. In its 2025 report, the FBI's Internet Crime Complaint Center (IC3) said victims reported losses of more than $5 million to "distress" scams, which include the grandparent scam where voice cloning is used to mimic a loved one in trouble. These are only the complaints that reached the Center, not everything that happened.

The voice can also come from a place you would not expect. In October 2025 the UAE government's Cyber Security Council warned of scammers who pose as acquaintances or relatives, faking their voice and image on a video call to ask for money. The newspaper Emarat Al Youm quoted an expert saying the trick rests on stealing WhatsApp accounts, and that the new twist is a scammer downloading a person's voice messages and then using AI to produce a similar voice.

The same expert thought the trick had not succeeded in the Arab world because AI had not yet mastered dialects, and his simple advice was to call the other person and not to rush. That was his view in October 2025, and I would not build your protection on it: the technology improves, and a dialect is not a line of defence you can test in a moment of panic.

Can your ear tell real from fake? In an experiment published in PLOS ONE in August 2023, 529 participants listened to audio samples and identified the fake ones only 73% of the time. Showing them examples improved the result only slightly. And note that the participants knew they were being tested, so they were on guard. What about someone who hears their own child sounding terrified in the middle of the night?

Your ear is no longer a verification tool. What protects you is a rule agreed in advance, not a gut feeling in the moment.

Three scenarios that fit our habits

I could not find a reliable Arabic-language statistic that measures this specific fraud, and I will not invent one. I found two official warnings: the UAE one I mentioned a moment ago, and a warning from Jordan's Cybercrime Unit about fake accounts using deepfakes to impersonate public figures, according to a record dated 29 July 2025 in the OECD's AI Incidents Monitor. The Jordanian warning is not the same as a family scam, but it covers the same territory.

These are three patterns that keep recurring in warnings and reports, and I think our habits make the road easier for them: WhatsApp voice notes, children living abroad, and the authority of the boss.

• Your child abroad is in trouble. The messages McAfee's respondents said they would most often reply to were these: a car incident (48%), a robbery (47%), a lost wallet or phone (43%) and needing help while travelling (41%).
• The lost phone and the stolen account. "My phone broke, so send the money to this account." If the account has been taken over, the message leaves from the real number.
• The boss in a hurry. Your manager's voice asks for a confidential transfer today.

In social engineering, the art of deceiving people rather than machines, these patterns share three things: urgency that stops you thinking, emotion or authority that pushes you to obey, and a demand for secrecy so that you consult nobody. When all three arrive in one message, stop, however familiar the voice sounds.

The family code word: a three-step protocol

The code-word idea is not mine. The FBI recommended it in an alert issued on 3 December 2024, and McAfee recommends it too. It is simple: a word only your family knows, which you ask for whenever someone asks you for money or sensitive information. A scammer can clone a voice, but cannot guess what he has never heard.

What if your son forgets the word while genuinely in trouble? That is what step three is for: you verify through another channel and then send the money, which usually takes minutes. Tell your family plainly: "I won't be angry if you ask me for the word, I will be glad." Embarrassment is the first thing a scammer exploits.

Alongside the word, take two technical precautions. First, turn on two-step verification in WhatsApp for your account and your parents' accounts: Settings, then Account, then Two-step verification, with a six-digit PIN and a recovery email. As Malwarebytes explains, that PIN stops someone who has obtained your SMS code from registering your number on another device. And never give anyone the code that arrives by text message. Second, cut down how much of your voice you post publicly and keep your accounts private, as the FBI advises.

At work: the two-channel rule before any transfer

In companies the lie changes from "my son is in danger" to "I'm your boss and this is a secret deal". The cases are documented.

In 2019 the chief executive of a British energy firm transferred about €220,000, roughly $243,000, after a call in which the speaker seemed to be the chief executive of the German parent company. He reportedly noticed the faint German accent and the familiar melody of the voice, so he believed it, and the money went to a supplier's account in Hungary. The fraudster then called twice more: in the first call he claimed the money had been reimbursed, and in the second he asked for another payment, from an Austrian number. When the supposed refund never arrived, the victim grew suspicious and did not pay. But the first payment had already moved from Hungary to Mexico and then been dispersed, according to what was reported from the insurer Euler Hermes, whose representative said the voice was made with AI.

In 2024 the trick moved from voice to video. A finance employee in the Hong Kong office of the British engineering firm Arup received an email that seemed to come from the chief financial officer in the UK about a confidential transaction, and suspected phishing. Then he joined a video meeting with what appeared to be the CFO and other colleagues, all of whom were AI-generated. He was convinced and made 15 transfers totalling HK$200 million, about US$25 million. It came to light when he contacted head office. Arup said fake voices and images had been used, and that its internal systems were not compromised.

The lesson is harsh: the employee did doubt at first, and then the video meeting convinced him. What reassured him was part of the forgery itself. That is why I don't trust a rule like "call to confirm" when the call runs through the channel the request came from. The right rule is the two-channel rule.

That last point is the hardest and the most important, because any rule collapses in a place where staff fear holding up their boss. The losses are large: in the IC3's 2025 report, 24,768 complaints were recorded about business email compromise, a fraud that targets companies making regular transfers by manipulating the channels they communicate through, with reported losses of $3.05 billion. These figures are not about voice alone, and the report said businesses reported losses of more than $30 million in cases involving AI.

In my judgement, what separates one company from another is a culture that lets the junior employee say to the boss: let me check first. It is close to the idea of my book The Blind Manager (Arabic): a manager who sees the devices and the reports but not the human dynamics, including the fear that silences the team.

If it already happened: the first hour

If you sent money and then discovered the deception, don't waste time blaming yourself. The Arup employee doubted and was still fooled. These are the steps for the first hour:

1. Call your bank or payment provider at once. Say: "I've been defrauded and I want the transfer stopped or recalled." Speed is everything because the money does not stay put: in the 2019 case it went from Hungary to Mexico and then scattered. There is no guarantee of getting it back, but delay wastes any chance.
2. Keep the evidence and delete nothing. The voice message, screenshots, numbers and account details, the transfer receipt, and the timing of each step.
3. Report to the right authority. Your country's cybercrime unit. In the United States, the FTC's reporting site is ReportFraud.ftc.gov.
4. Secure your accounts. Turn on two-step verification and change your passwords. If it was your relative's account that was taken over, tell their family and contacts through another channel so nobody else falls for it.
5. Beware of the second scam. Anyone offering to recover your money for an upfront fee is a scammer, according to the FTC.

The bottom line: protection is an agreement made before the crisis

You cannot stop anyone cloning your voice, but you can make the voice alone worthless. A code word agreed this week, a call-back rule taped near the phone, and a two-channel rule in your company. Three steps that take an hour, and may save you money, reputation and a long regret. Send this article to your father or mother tonight, because they need this rule more than anyone.

One chapter of my book Resigning from Yourself (Arabic), "The Lawyer in Your Head", asks a question worth reading after this article: how do we convince ourselves of anything?