AI Voice Cloning & Deepfake Call Scams: How to Verify Who’s Really Calling

A cloned voice can sound like family, your boss or a tax official. Learn the warning signs, how to verify a caller, and where to report it.

A phone call from someone who sounds exactly like your child, your boss or a tax official is no longer proof that it’s really them. Criminals can now copy a person’s voice from a short audio clip and use it in a call or voice note to demand money urgently, the FTC and FBI warn.

This guide explains the scripts these calls follow, why neither the voice nor the caller ID can be trusted, and exactly what to check before you pay or share anything – including how to verify a caller and where to report a scam in the US, UK and India.

Last reviewed: 21 September 2026. The official guidance cited below was checked on that date.

Key takeaways

• An urgent call asking for money or personal details is unverified until you check it – both the voice and the caller ID can be faked.
• Hang up and call back on a number you already have, or ask your family safe word.
• The IRS says a call isn’t from the IRS if it threatens you or demands payment now.
• HMRC says an automated call claiming HMRC is filing a lawsuit against you and asking you to press 1 is a scam.
• Never pay by gift card, wire transfer or cryptocurrency because a caller insists. If you’ve already paid, contact your bank first, then report it.
• ScamCheck can check a text, link or screenshot a caller sends for common scam warning signs – but it can’t listen to or analyse calls or voice recordings, or tell you who a phone number belongs to.

What is an AI voice-cloning scam?

AI voice and deepfake scams use a cloned voice or synthetic video to impersonate someone you trust – a family member, a boss, or a public figure – to extract money or approvals. From a short audio clip – for example, a video posted online – scammers can create a convincing copy of someone’s voice (FTC; FBI), making the classic ’emergency call’ far more dangerous.

The scripts these calls follow

Voice-cloning scams often rely on the same levers: urgency (“act now”), authority or a trusted relationship, and secrecy (“don’t tell anyone”). The aim is to get money, a payment approval or personal details before you have time to check.

Behind each script, the pattern is similar:

1. Scammers take a short voice or video sample, for example from social media.
2. They clone the voice or build a deepfake video with AI tools.
3. You receive an urgent call, voice note or video: a relative in trouble, or a ‘CEO’ authorising a transfer.
4. The synthetic voice or face pressures you to pay or share details immediately.
5. Money is sent before anyone verifies the request was real.

The family-emergency call

A caller who sounds like your child, grandchild or partner says they’ve had an accident or are in trouble, and needs money now. The FBI describes criminals using short audio clips of a loved one’s voice to impersonate “a close relative in a crisis situation”, asking for immediate financial help or demanding a ransom. The FTC’s advice: don’t trust the voice – call the person back on a number you know is theirs.

The fake boss or CEO request

A call, voice note or video call from someone who sounds or looks like a senior manager asks you to make an urgent transfer, change a supplier’s bank details or skip the usual approval steps. The FBI warns that criminals use AI-generated video in live video chats with “alleged company executives”. As a practical precaution, treat any request to bypass normal payment checks as a reason to stop and verify.

The celebrity or public-figure deepfake

A video or audio clip of a well-known person appears to promote an investment, giveaway or cause. The FBI notes that criminals use AI-generated audio to impersonate public figures to get money, and AI-generated content to promote investment fraud. Treat any celebrity “opportunity” that asks you to pay or invest quickly as suspect.

Calls from a fake tax authority follow a script of their own – see the next section.

Fake tax-authority calls: IRS and HMRC

Tax scams work because the threat sounds official: unpaid tax, a lawsuit, arrest. The FBI warns that criminals use AI-generated audio to impersonate public figures and relatives, and AI-generated video to pose as executives, law enforcement or other authority figures – which can make these calls more convincing. The tax agencies’ own guidance covers impersonation calls in general rather than AI voices specifically, but it applies either way.

United States: the IRS

• The IRS says it normally contacts you the first time by mail. The IRS or private collection agencies may call you about account matters – sometimes with automated messages that direct you to IRS.gov – but those messages don’t share specific details (IRS).
• According to the IRS, a phone call, email or text isn’t from the IRS if it is unexpected, rushes you, threatens you, asks for personal or financial information, or demands payment now.
• IRS impersonators want you to pay “now or else”, threaten arrest or deportation, and don’t let you question or appeal the amount of tax you supposedly owe (IRS).
• What to do: record the number and hang up. Report the call to the Treasury Inspector General for Tax Administration (TIGTA) hotline or on 800-366-4484, and send IRS-themed emails to phishing@irs.gov (IRS). To check whether you really owe anything, use contact details from IRS.gov – not the ones the caller gives you.

ScamCheck’s explainer on how fake IRS calls work covers the most common scripts.

United Kingdom: HMRC

HMRC’s published examples of scam contact (GOV.UK, updated 15 December 2025) include:

• An automated call saying HMRC is filing a lawsuit against you and to press 1 to speak to a caseworker to make a payment. HMRC says: “This is a scam and you should end the call immediately.”
• Calls that mention National Insurance number fraud, or offer a tax refund and ask for your bank or credit card details.

HMRC’s advice: “If you cannot verify the identity of a caller, we recommend that you do not speak to them.” Report a suspicious call with HMRC’s online Report a suspicious HMRC phone call service, forward suspicious texts to 60599 (network charges apply) and forward suspicious emails to phishing@hmrc.gov.uk (GOV.UK). If you’ve lost money, report it to Report Fraud (see below).

Caller ID isn’t proof. Scammers can make a call appear to come from a company or government agency you already know and trust. Hang up and call the number on an official letter, statement or website (FCC).

Warning signs on a call or voice note

Watch for these warning signs:

• Urgent money requests by call or voice note from ‘family’ or a ‘boss’
• Refusal or inability to verify via a known channel
• Odd pauses or an unusual tone – but a good clone can sound completely natural, so never rely on the voice alone
• Pressure and secrecy (‘don’t tell anyone’)
• Requests that bypass normal approval processes
• A demand to pay by gift card, wire transfer or cryptocurrency – the FTC says these could be signs of a scam

If a call ticks even one of these boxes, treat it as unverified until you’ve checked it yourself.

Why caller ID and the voice can’t be trusted

Two things people instinctively trust can both be faked:

• The number. The FCC warns that scammers can “spoof” caller ID so a call appears to come from a local number, or from a company or government agency you already know and trust. Because caller ID can be spoofed, a familiar number on screen is not enough to confirm who is calling.
• The voice. A cloned voice can sound just like your loved one (FTC). The FBI suggests listening closely to tone and word choice, but a convincing clone may give nothing away – so the answer is to verify, not to judge by ear.

The FCC also notes that you’ll usually get a written statement in the mail before a phone call from a legitimate source, particularly if the caller is asking for a payment.

How to verify a caller before you act

Agency advice is credited where it applies; the other steps are practical precautions.

1. Don’t trust the voice or the number. Both can be faked.
2. Hang up – politely, and without confirming any details.
3. Call back on a number you already have – saved in your phone, or from an official website, bill or statement (FTC, FCC).
4. Ask your family safe word. The FBI recommends agreeing a secret word or phrase with your family in advance. As an extra practical check, you can ask something only the real person would know.
5. Refuse unusual payment methods. Gift cards, cryptocurrency and wire transfers demanded urgently are red flags (FTC, FBI).
6. Tell someone else before you pay. As a practical precaution, if the caller pushes you to keep the request secret, treat that as a reason to slow down.

Deepfake video calls: what to check

The FBI suggests looking for glitches such as distorted faces or hands, unrealistic eyes, inaccurate shadows, lag, or a voice that doesn’t match the lips. But don’t rely on spotting them: end the call and contact the person through a channel you already trust. If a video call asks you to move money or share login details, verify the request separately before you act.

How to protect yourself

Habits the FTC and FBI recommend:

• Agree a family ‘safe word’ to verify emergencies.
• Hang up and call the person back on their known number.
• Never act on an urgent money request without checking it through a separate channel.
• Limit public voice/video that can be sampled – for example, by making social media accounts private.

It also helps to check any follow-up messages, links or screenshots with ScamCheck. The underlying principle is always the same: slow down and verify before you act.

A verification routine for small businesses

Fake-boss and fake-supplier requests aim to get money moved or payment details changed. The steps below are practical precautions for businesses, not official agency guidance:

• Confirm any urgent payment or change of bank details by calling back on a number already on file – never one given in the call, voice note or message.
• Require two people to approve payments above an agreed amount.
• Never change a supplier’s or employee’s payment details because of a call or voice note alone.
• Agree a verification phrase or question for senior staff, in the same way families use a safe word.
• Make it clear that staff can always pause to verify, even when a request seems to come from the top.

What ScamCheck can – and can’t – check

ScamCheck can’t listen to or analyse a phone call or voice recording, and it can’t tell you who a phone number belongs to. What it can check are the messages, links and screenshots that often come with these scams – a follow-up text with a payment link, for example, or a screenshot of a “tax notice” sent on WhatsApp. It looks for common warning signs such as urgency, payment demands and suspicious or shortened links, and explains what it found. It’s free to use, with a daily limit.

ScamCheck is made by A Square Solutions, the publisher of this guide (how we built it).

Already sent money or shared details? What to do now

Act as quickly as you can: contact your bank or payment provider first. If you shared passwords or account details, change them. Then report it:

• United States: report to the FTC at ReportFraud.ftc.gov and to the FBI’s Internet Crime Complaint Center (IC3). For IRS impersonation, report to TIGTA on 800-366-4484, and send IRS-themed emails to phishing@irs.gov.
• United Kingdom: report to Report Fraud online or on 0300 123 2040 (England, Wales and Northern Ireland; in Scotland, call Police Scotland on 101). Report HMRC-related calls, texts and emails through HMRC’s channels (see the tax section above). Forward scam texts to 7726 and suspicious emails to report@phishing.gov.uk (NCSC).
• India: call 1930 or report at cybercrime.gov.in.
• Elsewhere: contact your bank and your national police or fraud-reporting service.

Common myths about AI voice scams

“I’d recognise my child’s voice.” A cloned voice can sound just like your loved one – that’s the point (FTC). Verify with a call-back or a safe word instead of trusting your ear.

“Caller ID proves who’s calling.” Caller ID can be spoofed to show the number of a company or government agency you know (FCC).

“It won’t happen to me – I’m too careful.” Falling for a scam is about timing and context, not intelligence. Careful people can still be caught out when a convincing call arrives at the wrong moment, so rely on a verification routine rather than confidence.

“My bank will refund me anyway.” Not always. In the UK, banks must reimburse many authorised-push-payment scam victims – up to £85,000 for payments made since 7 October 2024, with conditions (PSR). Rules differ in other countries, so contact your bank immediately.

Related ScamCheck guides

• WhatsApp Scam Detection Guide
• Fake UPI Payment Screenshot Scams
• ScamCheck – free message, link and screenshot checker
• WhatsApp scam checker

Sources

• FTC – Scammers use AI to enhance their family emergency schemes (20 March 2023)
• FBI IC3 – Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (PSA I-120324-PSA) (3 December 2024)
• FCC – Caller ID Spoofing (last reviewed 13 November 2024)
• IRS – How to know it’s the IRS (updated 3 September 2026)
• IRS – Recognize tax scams and fraud (updated 7 April 2026)
• IRS – Report fake IRS, Treasury or tax-related emails and messages (updated 30 July 2026)
• HMRC – Examples of phishing emails, suspicious phone calls and texts (updated 15 December 2025)
• HMRC – Report suspicious HMRC emails, texts, social media accounts and phone calls (updated 24 November 2025)
• Report Fraud (UK)
• NCSC – Phishing scams: how to spot and report them
• Payment Systems Regulator – APP fraud reimbursement protections
• US Federal Trade Commission – report fraud
• FBI Internet Crime Complaint Center (IC3)
• National Cyber Crime Reporting Portal (India)

Frequently asked questions

Can scammers really clone a voice?

Yes. The FTC and FBI warn that a short audio clip – for example from a video posted online – can be enough to make a convincing copy of a voice. That’s why urgent voice requests need checking.

How do I verify a suspicious call from family?

Hang up and call them back on their known number, or use a pre-agreed safe word. Never act on urgency alone.

What is a deepfake scam?

Using AI-generated video or audio to impersonate a trusted person and extract money, approvals, or data.

How can I spot a deepfake video call?

The FBI suggests looking for glitches such as distorted faces or hands, unrealistic eyes, inaccurate shadows, lag, or a voice that doesn’t match the lips. But don’t rely on spotting them: end the call and contact the person through a channel you already trust.

Would the IRS or HMRC really call me?

The IRS says it normally contacts you first by mail, but that the IRS or private collection agencies may call about account matters. It also says a call isn’t from the IRS if it is unexpected, rushes you, threatens you, asks for personal or financial information, or demands payment now. Separately, HMRC says an automated call claiming it is filing a lawsuit against you and asking you to press 1 is a scam, and recommends not speaking to a caller whose identity you cannot verify. If in doubt, hang up and contact the agency using details from its official website.

What is a family safe word?

A secret word or phrase agreed in advance with your family, so you can check that an urgent call really comes from them. The FBI recommends creating one. If the caller can’t give it, hang up and call the person back on a number you know.

Can ScamCheck help with AI scams?

ScamCheck checks the accompanying messages, links, and screenshots – the parts of an AI scam you can paste in.