How to Spot a Cloned Voice: A Practical Checklist for Calls, Messages and Videos

The call sounds exactly like your grandson, your daughter, your boss. That is precisely the problem. Voice cloning has made “I recognised the voice” worthless as evidence, and the US Federal Trade Commission now says so in plain language: in its consumer alert on voice-cloning scams, the FTC’s first instruction is “don’t trust the voice.” This checklist turns that instruction into a routine. Some items help you judge a suspicious call or voice note in the moment; the stronger ones remove the judgement call entirely, by shifting verification to habits your family sets up in advance. The technology background — how clones are made and why they are convincing — is in our pillar guide, AI Voice Generators Explained.

Why your ears cannot settle this anymore

It helps to understand why “spotting” a clone by listening is a losing game at the top end. A cloning system studies a recording and rebuilds the voice’s patterns — pitch, timbre, rhythm, accent — well enough that the copy carries the features families use to recognise each other. The FTC’s alert makes the input requirement plain: “a scammer could use AI to clone the voice of your loved one. All he needs is a short audio clip of your family member’s voice — which he could get from content posted online — and a voice-cloning program.” Most adults and teenagers have far more than a short clip online: birthday videos, voice notes forwarded into group chats, podcast appearances, work presentations. Lower-quality clones do have tells — flat emotion, odd pacing, a robotic sheen — and the listening checks below are worth knowing. But they are a backup layer. The primary defence is procedural, and it works even against a perfect clone, because it does not depend on the audio at all. OpenAI, whose own Voice Engine research pushed cloning quality forward, reached the same conclusion institutionally: it recommends phasing out voice-based authentication for bank accounts and other sensitive information. If a voice is no longer proof for a bank, it is no longer proof for a grandmother either.

The checklist: during a suspicious call or voice note

1. Slow the moment down. Urgency is the weapon; every scam script is engineered to make you act before you think. A real emergency survives a two-minute pause. A scam often cannot, because the caller must keep emotional pressure high to stop you verifying.

2. Hang up and call back on a number you trust. This is the FTC’s central advice, verbatim in spirit: “Call the person who supposedly contacted you and verify the story. Use a phone number you know is theirs.” Not the number that just called you — the one saved in your contacts or written in your address book. If the real person answers, confused and safe, the matter is closed.

3. If you cannot reach them, verify sideways. The FTC again: “If you can’t reach your loved one, try to get in touch with them through another family member or their friends.” A cloned-voice scam depends on you staying inside a sealed conversation with the caller. Any second channel breaks the seal.

4. Ask something only the real person would know. Not data from their social media — a shared memory, a family nickname, what you cooked together last Sunday. Clones copy sound, not biography. (The pre-agreed code word below is this check, formalised.)

5. Interrogate the request, not the voice. The FTC lists the payment signatures scammers rely on because they are hard to reverse: being told to wire money, send cryptocurrency, or buy gift cards and read out the numbers and PINs. A real grandson in real trouble does not need gift cards. When the payment method is the emergency, it is a scam.

6. Listen — but treat what you hear as weak evidence. Flat or mismatched emotion, strangely even pacing, breath sounds that seem pasted on, answers that dodge when you interrupt or change topic: all worth noticing, all consistent with synthetic speech of the kind catalogued in our guide to why AI voices sound fake. But a call that sounds perfect proves nothing either way. Ears are the supporting check; callbacks are the deciding one.

The checklist: set these up before anyone calls

7. Agree a family code word. Pick a word or phrase that would never appear in a normal conversation — the name of a childhood pet plus a colour, say — and share it in person with the people a scammer might impersonate: children, grandchildren, an elderly parent’s carers. Any call asking for money or secrecy must produce the word. This is the single highest-value item on this page: it converts an emotional ambush into a factual test, and it works for text messages and video calls too. Our cloning FAQ explains why platforms cannot do this part for you — consent rules govern making clones, not receiving calls from them.

8. Reduce the raw material. Public videos with clear speech are cloning feedstock. You do not need a digital detox — but tightening who can see family videos, and thinking twice before posting a child’s or grandparent’s clear voice publicly, lowers the supply. The FTC’s warning is specifically that clips posted online are enough.

9. Retire voice as a password, everywhere. If your bank or any service still treats your voice as authentication, switch to app-based or hardware methods where offered. OpenAI’s recommendation to phase out voice authentication exists because providers know the copy problem is permanent.

10. Brief the likely targets. Scammers aim at grandparents and at busy executives’ assistants — people with access to money and a habit of helping quickly. Walk them through items 1–5 once, calmly, before a crisis. A person who has rehearsed “hang up and call back” does it; a person who has only been warned does not.

If you have already sent money

Act in hours, not days. Contact your bank or the payment provider immediately and ask about recall or freeze options — wire and card payments sometimes can be stopped; gift card and cryptocurrency payments almost never can, which is exactly why scammers demand them. Then report the attempt or the loss to the FTC at ReportFraud.ftc.gov, the destination the FTC’s alert itself gives. Reports feel unsatisfying individually, but they are the raw material from which investigators map scam rings and platforms spot patterns. Finally, tell the family member who was impersonated: their voice is in circulation, other relatives may be targeted next, and the code word from item 7 just became urgent rather than theoretical. The wider landscape of AI-enabled fraud — deepfake video calls, cloned executives, fake investment pitches — follows the same verification logic and is surveyed in AI myths and scams: what to believe and what to avoid.

What this means

The deeper shift this checklist responds to is the collapse of voice as identity evidence — a signal humans have trusted since before writing. Every prior communications technology preserved it: a letter could be forged, but a phone call carried the unforgeable texture of a person. Cloning severs that link permanently, and no coming improvement in “detection” restores it, because detection is an arms race judged in the worst possible conditions — a frightened relative, a bad phone line, thirty seconds to decide. The FTC’s approach, and this checklist’s, is therefore the durable one: stop asking “does this sound real?” and start asking “can this be verified through a channel the caller does not control?” For US readers the stakes are concrete. The family-emergency script targets the country’s most trusting demographic with the country’s most common technology, the mobile phone, and it monetises in minutes through payment rails designed to be irreversible. Compared with the defensive habits Americans adopted for email — hovering over sender addresses, distrusting urgent links — voice hygiene is a generation behind, mostly because the threat feels like science fiction until the phone rings. It is not fiction; it is a documented FTC warning backed by the same research labs building the technology. Families that adopt the code word and the callback habit are not being paranoid. They are doing for voice what they already did for passwords: accepting that a familiar signal can be copied, and building the small ritual that copying cannot defeat.

The same logic is already migrating into business. The cloned-executive fraud — a finance employee joining a video call with a synthetic CFO and wiring company money — runs the family-emergency script at corporate scale, against the same vulnerability: a familiar voice treated as authorisation. Companies are responding with exactly this checklist’s corporate dialect: call-back procedures on known numbers, code words for payment instructions, and a rule that no voice or video presence alone can move money. The household and the boardroom rarely share security advice, but voice cloning has merged their threat models. A family that adopts the callback habit is practising the same discipline that auditors now demand of finance departments — verification through a channel the requester does not control — and it scales from a grandparent’s kitchen phone to a treasury wire without changing its essential shape.

Bottom line

Voice is no longer evidence. Agree a family code word today, verify any money emergency by calling back on a number you already have — and no clone, however perfect, can follow you there.

Read Next

• What Is Voice Cloning? Consent, Rules and the Questions Everyone Asks
• AI Myths and Scams: What to Believe and What to Avoid

Sources

• Scammers use AI to enhance their family emergency schemes — Federal Trade Commission (accessed 7 November 2026)
• Navigating the challenges and opportunities of synthetic voices — OpenAI (accessed 7 November 2026)