UNITED STATES – The evolution of phishing, which goes as far back as the 1990s when scammers used fake emails to scam unsuspecting victims, has entered a new phase with voice-phishing or vishing attacks that involve voice cloning.
According to reports, one method of this is to send a voicemail message generated by artificial intelligence (AI), seemingly from a panicked child, grandchild or other family member, urging them to send money often through a bogus bank link. Nathan House, CEO of StationX, a United Kingdom-based cybersecurity training platform said, “The everyday vishing script is a high-pressure, ‘urgent problem’ phone call.”
He added, “The caller spoofs your bank’s number, claims your account is compromised, and needs you to ‘verify’ a one-time passcode they just texted — actually your real two-factor code.” Other variants impersonate police, utility companies, or a panicked relative demanding emergency funds.
House said, “The hallmarks as a trusted name on caller ID, an emotional or financial threat, and a demand for immediate action — usually sharing credentials, reading back a code, or wiring money.”
Jurgita Lapienyte, chief editor of Cyber News, a Lithuania-based publication focused on cybersecurity, highlighted the growing prevalence of vishing. She warned that while current AI voice cloning technology is only able to stick to a script and can’t react spontaneously to questions or responses in real time, “it’s only a matter of time until it actually learns to be more like us and can be weaponized against us.”
She added, “If I feel like I’m actually talking to a relative of mine, I will be more willing to lend them money because I’m convinced that this is the actual person that I’m talking to, and this is really dangerous.”
The Federal Bureau of Investigation’s (FBI) Crime Complaint Center’s annual cybercrime report, released on April 23rd, stated that in 2024 it had received 193,407 complaints of phishing or spoofing. Spoofing is a technique in which scammers makes their own phone number and trick victims into thinking they are on a genuine call.
That was the most prevalent type of scam, compared to 86,415 for extortion and 441 for malware. House and the FBI report shows just how large of a problem phishing or spoofing has become.
House said, “Phishing, spoofing and their offshoots — voice-phishing or vishing, smishing, OR-phishing — have been the workhorses of cyber crime for years because they’re cheap to run and scale to millions of targets with almost no technical skill.” Lapienyte said it is becoming cheaper to scam people using voice cloning.
She said, “In 2020, if you wanted to clone a voice, you would need probably around 20 minutes of recording. These days, AI and automation, and other innovations, you just need a couple of seconds of someone’s voice, and you can fake someone’s voice, make a recording resemble the person that you are trying to impersonate.”
House said scammers only need a few seconds of audio to make a convincing replica using AI voice-cloning tools, “say a TikTok clip or brief wrong-number call.”
He added, “That lowers the cost and skill barrier dramatically. Criminals no longer need studio-quality samples or lengthy recordings. So they can scoop up snippets posted online, feed them into a free cloning engine and start dialing.” House said most incidents are written off as wire-transfer fraud.
Lapienyte agreed that there is an issue of under-reporting of vishing and other scams, especially among the elderly who are often ashamed to admit they were scammed. In a statement published on April 23rd, FBI Director Kash Patel said, “Reporting is one of the first and most important steps in fighting crime so law enforcement can use this information to combat a variety of frauds and scams.”
He added, “It’s imperative that the public immediately report suspected cyber-enabled criminal activity to the FBI.” Chinese organized crime syndicates, such as the 14K triad, have in recent years built large-scale cyber scam hubs in Cambodia, Laos, and Burma, which target Americans.
Erin West, a former prosecutor who now runs Operation Shamrock, which seeks to highlight the threat from the cyber scamming industry, said the triads “should be feared at every level of any evil-doing nation state.” She added, “They’re that big; they’re that organized; they’re that well-funded.”
House said a code word between family members “is a simple, effective speed-bump. If someone calls sounding like your son begging for bail money, asking for the agreed phrase — something no outsider could guess. It forces the imposter to break character, or hand up.” He said it is not foolproof, but it’s a low-tech defense that could dramatically weaken voice-cloning scams.
