How to Verify a Suspected Voice Clone Call

How to verify a suspected voice clone call

Verify a suspected voice clone call by leaving the call and confirming the request through a channel you control. The voice itself is not evidence: the FTC's advice, published in March 2023, is not to trust the voice, and the FBI warned in May 2025 that AI clones can sound nearly identical to the real person. What a scammer cannot easily fake is the real person answering their own phone when you call them.

The steps below work for a family member asking for money, a manager approving a transfer or a bank caller asking for a code. Do them in order, and do not let the caller talk you out of any step.

• Pause. Say you will call back, then hang up. Urgency, secrecy and threats are the scammer's main tools, and a genuine caller will accept a short delay.
• Call back on a number you already had before this call: the contact saved in your phone, the number on your bank card, or your company directory. Never use a number, link or extension the caller gives you.
• If you cannot reach the person, contact someone close to them, such as another relative, a colleague or their assistant, as the FTC suggests.
• Ask for your pre-agreed code word or safe phrase. The FBI recommends families agree a secret word; Starling Bank's 2024 campaign suggests a safe phrase that is never shared digitally.
• Refuse payment methods that are hard to reverse: wire transfers, cryptocurrency and gift cards are the FTC's named warning signs.
• Never read out one-time passcodes or two-factor codes to a caller, whoever they claim to be.
• Write down the number, time and what was said, keep any voicemail, and report the call.

How do you detect an AI-generated voice on a phone call?

You detect an AI-generated voice on a phone call mostly by checking the request, not by judging the sound. Some cues are worth noticing: a voice that stays emotionally flat while describing a crisis, pauses before every answer, words that sound slightly off for that person, background noise that loops, or a caller who avoids answering unexpected questions. The FBI also mentions call lag and mismatched voice patterns.

Treat any of these as a reason to verify, never as proof either way. Modern clones often have none of them, and phone codecs blur the details further. A clone driven live by a human through voice conversion can answer questions naturally, which defeats the trick of asking something unexpected.

A simple test that still helps: ask about something only the real person would know and that is not online, such as a private family joke or the name of a childhood pet. Scammers research targets on social media, so avoid questions whose answers appear in public posts.

Verification rules for finance teams, help desks and contact centres

Organisations should write the callback rule into policy so no one has to make a judgement under pressure. Any voice request to move money, change bank details, reset credentials or add a device should require confirmation through a separate, pre-registered channel, regardless of who appears to be calling.

Help desks and contact centres need extra care because they handle strangers by design. Knowledge-based questions are weak when answers can be researched or bought. Stronger options are a push notification to the customer's registered app, a callback to the number on file, or a short hold on sensitive changes while the customer is notified on another channel.

Voice biometrics should not be the deciding factor. NIST's SP 800-63B-4, finalised in July 2025, states that biometric comparison based on voice shall not be used in its authentication guidelines. A voice match can still be one input to a risk score, but it should never be the factor that approves a sensitive change on its own.

Where automated voice clone detection helps

Automated detection is useful where humans cannot check every call: contact centres taking thousands of calls a day, fraud teams reviewing voice notes, and investigators handling recordings submitted as evidence. A detector scores audio for synthetic speech and flags calls that should go to stronger verification.

Neural Defend's NeuroCall, currently in Beta, analyses call audio for signs of synthetic speech and returns a risk signal that your call-handling rules can act on, for example by requiring a callback before any account change. For a recording that needs a documented review, NeuroDetect shows evidence down to audio segments and produces a forensic report with model context and analyst notes.

Detection has limits on phone audio. Narrowband codecs, packet loss and background noise hide part of the evidence, and new cloning tools appear constantly. Use detection to decide when to step up verification, and keep the callback rule even when the score is low.

What to do if you think you received a voice clone call

If no money or information changed hands, warn the person who was impersonated and the people around them, because scammers often try several contacts. Report the call: in the US to the FTC at ReportFraud.ftc.gov or to the FBI at ic3.gov.

If you sent money, call your bank or payment provider straight away on the number on your card and ask them to stop or recall the payment. If you shared a passcode or password, change it and sign out other sessions. Keep the voicemail or recording in its original form; a re-recorded copy loses detail that forensic analysis depends on.