Real or Fake? How Easy It Is to Clone a Voice — and Fool the People Who Know You Best

Your mobile rings late in the evening. It's a number you don't recognise, but the voice on the other end is someone you love, and they sound frightened. Below are two short recordings of that kind of call. One is a real person speaking. The other is an artificial intelligence copy of that same person's voice. Have a listen to both, then pick the fake.

For demonstration only. The voices in these clips belong to actors who gave their full permission for them to be recorded and cloned. Never copy anyone's voice without their consent.

How close is it, really?

If you found that harder than you expected, you're in good company. The cloned voice keeps the things we instinctively use to recognise someone: the pitch, the accent, the rhythm, the little habits in how they say certain words. On a quiet recording with good headphones you might pick up a slight flatness or an odd breath. On a real phone call, in the middle of a stressful conversation, almost nobody does.

And this isn't a rare problem. Research by Starling Bank found that 28% of UK adults believe they had been targeted by an AI voice cloning scam in the previous year, while nearly half didn't know this type of scam existed at all.

How we made it, for free, in minutes

We didn't use any specialist equipment or paid software. The voice sample came from an ordinary WhatsApp call, and the clone was made using an open-source tool anyone can download. Total cost: nothing. Time taken: about 30 minutes.

The clone you heard was built from just 9 seconds of audio. Nine seconds, with no fine-tuning. Imagine how good it would sound with a few minutes of someone's voice, or a few hours of practice and polish. That's the version a determined criminal would use.

That's the uncomfortable part. Today's tools need only a few seconds of someone's voice to get started: the sort of audio that's sitting in a voicemail greeting, a social media video, a recorded webinar, or a quick phone call with a stranger who asked "Can you hear me OK?"

How the technology works (the short version)

There are two main ways AI copies a voice:

• Text to speech. You type words, and the AI reads them out in the copied voice. Useful for pre-recorded voicemails and voice notes.
• Speech to speech (sometimes called voice conversion). This is the one that should worry you. The scammer simply talks into a microphone, and the software swaps their voice for the cloned one as they speak. They keep their own natural timing, emotion, pauses and reactions; only the "sound" of the voice is replaced.

In simple terms, the software splits speech into two parts: what is being said (the words and delivery) and who is saying it (the unique character of the voice). It keeps the first, swaps the second, and rebuilds the audio.

The reason it can work this fast is how modern models store a voice. Older approaches often had to be trained on hours of recordings of one person, and the result was slow and heavy. Newer models learn to separate the two parts of speech from the start. The "who" is squeezed into a compact voice profile, a short list of numbers that works like a fingerprint of the voice (the technical name is a speaker embedding). It is made once, from a short sample, and saved. After that the model only has to deal with the "what": the words, sounds and timing of the live speech, in tiny slices. Nothing about the voice has to be learned again during the call, so there is far less work to do each time, and each new generation of models gets quicker.

The critical point is speed. Research systems can now do this conversion in roughly 20 to 100 milliseconds, and common free tools typically run in around a fifth of a second or less. For comparison, a normal phone call already has a delay of around 150 milliseconds that we never notice. That means a criminal can hold a live, two-way conversation, answering your questions in real time, in a voice you trust.

Why the phone makes it even harder to spot

Here's the part most people don't realise: the phone network is already doing the scammer a favour.

A traditional phone call carries audio sampled 8,000 times per second. That limits the sound to frequencies up to about 3,400 Hz, roughly a third of what you'd hear standing next to the person. The crisp "s" sounds, the breathiness and the fine detail that help you spot a fake are simply cut off before they reach your ear. Everyone sounds a bit muffled on the phone, so a slightly muffled fake sounds completely normal.

Internet calling apps such as WhatsApp can carry better audio, but they automatically drop the quality when the signal is weak, which is exactly what you'd expect from someone "stuck on the hard shoulder".

Then add background noise. In our example we layered in road noise, using freely downloadable sound effects of passing traffic. It does two jobs at once:

1. It hides the small digital imperfections in the cloned voice.
2. It makes the story feel real. Your brain hears traffic and fills in the rest.

Muffled line + background noise + a familiar voice = a very convincing call.

The three tricks criminals rely on

The technology is only half the scam. The other half is psychology. Voice cloning fraud almost always leans on three things:

• timer
  1. Urgency: "It has to happen now."

  The caller creates a deadline: the breakdown truck won't come until they're paid, the phone battery is about to die, the supplier's payment has to go today. Urgency is designed to stop you pausing, thinking, or checking with anyone else.

• fact_check
  2. Believability: "That could actually happen."

  The story is ordinary and realistic. A family member broken down on the motorway with no bank card. A director travelling who needs an invoice paid. Nothing outlandish, just plausible enough that questioning it feels unkind or awkward.

• sentiment_stressed
  3. Emotion: "I'm scared, I need you."

  Fear, panic, worry or guilt. Hearing someone you love sounding distressed switches off the careful, logical part of your thinking. In a business setting the emotion is often pressure from authority instead: a "senior manager" who is irritated and in a hurry. Either way, the aim is the same: make you react with your heart rather than your head.

Put all three together and even sensible, cautious people can be caught out. Many go along with it because they feel something is a bit odd but don't want to risk being wrong.

Is this legal?

No, not without permission. For this demonstration, the voices belong to actors who gave their full consent to be recorded and cloned. Doing the same to someone who hasn't agreed is a different matter, and the law treats a voice as personal.

• Using a cloned voice to trick someone out of money is fraud. In the UK that is a criminal offence under the Fraud Act 2006, whatever technology is used.
• A voice can be biometric data. When a voice is used to identify a person, as in a voice-recognition security check, data protection law treats it as biometric data, a special category that needs the person's explicit consent. Recording and copying someone's voice without that consent can break UK GDPR, and the Information Commissioner's Office can act on it.
• Other rules can apply too. Impersonating a real person to sell or endorse something can fall foul of passing-off, defamation and performers' rights, and in some countries new laws specifically target deepfakes.

The rules are still catching up with the technology, and criminals using these tools are not worried about breaking them. That's why your own checks matter more than the law does in the moment a call comes in. This is general information, not legal advice.

How they make the story believable

The voice is only the start. Before they ring, criminals often do their homework, and for most people it takes very little effort. This is called social engineering: using ordinary, publicly available information to make a made-up story feel real.

Look at what's easy to find about almost anyone:

• Where you are. A holiday photo, a "checking in" post or an out-of-office reply tells a scammer you're away, which explains an odd number, a bad line and why you can't easily check anything.
• Who you know. Public friends lists, tagged photos and family members' profiles give them real names to drop into the call. "It's Dan, I've lost my phone, I'm with Sophie" sounds convincing when Sophie really is his girlfriend.
• Where you work. LinkedIn and company websites show who the managing director is, who handles payments and who looks after IT, which is everything needed to aim a call at the right person.
• Details leaked elsewhere. Information from past data breaches, and from earlier scam calls and texts, can supply phone numbers, addresses and birthdays.

Put a cloned voice together with a few accurate details and the caller no longer sounds like a stranger with a story. They sound like your daughter, who mentioned your dog by name and said she's stuck at the airport. The more specific the story, the more believable it feels, and the less you stop to question it.

What to look out for on the call

Almost every voice cloning scam starts the same way: a phone call, usually to a mobile, from a number you don't know. The voice may be perfect, but the situation around it rarely is. Watch for:

• phone_disabled
  A number you don't recognise, or none at all

  Unknown, withheld or international numbers should make you cautious, especially when the caller claims to be someone close. Caller ID can be faked too, so a familiar number isn't proof either. Treat it as a hint, never a guarantee.

• smartphone
  "I'm using a friend's phone" or "this is my new number"

  This is the classic cover story, because it explains why the number is unknown and why you can't ring them back on their own mobile. So do exactly that: hang up and ring their usual number. If they're really stuck, they'll understand.

• battery_alert
  "Mine's broken, lost, stolen or out of battery"

  Another reason you can't call back or check. Any story that stops you verifying it should raise your suspicion, not lower it.

• videocam_off
  No video, no texts, no questions

  A caller who can't switch to video, won't let you ring back, or dodges a simple personal question is a warning sign. So is one who asks you to keep it secret from the rest of the family or the office.

• credit_card_off
  Unusual ways of paying

  A transfer to a new account, gift cards or crypto, "to a friend who'll sort it out". Real emergencies rarely need any of these.

What technology can do about it

You shouldn't have to catch these calls by ear alone, and some of the protection is already working for you.

• Your mobile network filters known scam calls. The major UK networks block or flag calls from numbers they know are used for fraud, and Ofcom's rules require networks to stop many calls from abroad that fake a UK number. It helps, but a brand new number isn't on any list yet, and it can't tell whether the voice is real.
• Your phone has its own filters. iPhones can silence unknown callers, which sends them to voicemail. Android's Phone app has spam warnings and call screening. WhatsApp can silence unknown callers too, and that matters because calls made over apps like WhatsApp don't pass through your network's scam filters at all.
• Report what slips through. Forward scam texts, and report scam calls, to 7726 (it spells SPAM on the keypad). Networks use the reports to block the number for everyone else.
• Detection software exists, but it's for organisations. There are services, such as Pindrop and Reality Defender, that analyse a call and flag signs of a synthetic voice, and banks and contact centres are starting to use them. Their accuracy varies, they're in a constant race against better cloning tools, and nothing like them is built into an ordinary phone call yet. Treat them as one layer of protection, not a replacement for checking.

The honest summary: technology will catch many scam calls before they ring, but a clone made from a number nobody has flagged can still get through. That's why the habits below matter.

It's not just families: businesses are targets too

The same approach works on staff: a call that sounds exactly like the managing director asking the finance team to make an urgent payment, or a "supplier" phoning to change bank details. Contact centres and help desks are also at risk, where a cloned voice could be used to pass security checks or talk an agent into resetting an account. If your phones are moving to internet-based calling after the BT switch-off, a session border controller also helps protect your phone system from fraudulent calls, although it can't tell whether a voice is real.

How to protect yourself and your business

At home

• key
  Agree a family safe word or phrase

  Something only you know, never shared online or by text. If a "family member" calls asking for money and can't give it, hang up.

• phone_callback
  Hang up and call back

  Use the number you already have saved, not one they give you.

• help
  Ask a question only the real person would know

  And not one whose answer is on social media.

• pause_circle
  Slow down

  Any request that insists you mustn't wait or check is a warning sign in itself.

• public
  Think about what's public

  Videos and voice notes posted online are raw material for cloning. Holiday plans, tagged friends and family names give a scammer the details to make a story believable, so tighten your privacy settings and post trips once you're back.

At work

• payments
  Never approve a payment or bank-detail change on a phone call alone

  Always confirm through a second, separate channel.

• record_voice_over
  Don't rely on recognising someone's voice as proof of who they are

  That goes for staff on the phone and for voice-recognition security checks.

• school
  Train staff to spot urgency and pressure tactics

  Make it clear they will never get in trouble for stopping to check.

• support_agent
  Review your contact centre's identity checks

  Make sure they don't depend on how someone sounds.

The voice is no longer proof

The voice on the other end of the line is no longer proof of who you're talking to. The technology is free, fast and convincing, and the phone network hides its flaws for it.

Long Communications helps organisations review their telephony, contact centre and security processes so that a convincing voice alone is never enough to move money or change account details. Get in touch to talk it through.

If you think you've been targeted, report it to Action Fraud (0300 123 2040 / actionfraud.police.uk), or forward suspicious texts to 7726. If money has been sent, contact your bank straight away by calling 159.

Common questions