Voice Cloning Scams: How Deepfakes Use What You Post

Additional resource for the lesson “Deepfakes and Voice Cloning: How the New Scams Work” — Online Privacy course

Voice cloning scams use a copy of a familiar voice to ask for money or information, and the copy is often built from clips that are already online. This resource explains how deepfakes and cloned voices are made, what the typical scams sound like, and why the more useful question is not “does this sound real?” but “who can hear my voice online?”

A. Why this matters

Until recently, a call from someone you love was its own proof: you knew the voice, so you knew the person. Voice cloning changes that. Software can now imitate a voice well enough to carry a short, emotional request.

This is a privacy story as much as a security one. To copy a voice, someone needs a sample of it; to make the request believable, a few personal details: a name, a relationship, a place. Both often come from what people share publicly.

None of this means you should stop posting videos or sending voice notes. It means treating a public clip of you speaking as personal data, like a photo, and deciding who it is for.

What the sources say

Ofcom, the UK’s communications regulator, describes deepfakes as “videos, pictures or audio clips made with artificial intelligence to look real”. It lists fraud among their main uses, “by misrepresenting someone else’s identity”. In its 2024 research, 43% of people aged 16 and over said they had seen at least one deepfake online in the previous six months, while fewer than one in ten felt confident they could identify one.

The US Federal Trade Commission (FTC), the national consumer protection authority, explains that to clone a loved one’s voice a scammer needs only “a short audio clip of your family member’s voice”, which could come from content posted online. In a separate guide it notes that scammers “may know your name, where you live, and other information they could have found on social media sites”.

The FBI, through its Internet Crime Complaint Center, warns that criminals generate “short audio clips containing a loved one’s voice to impersonate a close relative in a crisis situation”, and also create video for “real time video chats with alleged company executives”. Several of its tips are privacy tips: limit online content of your image or voice, and make social media accounts private. Police Scotland gives the same advice, suggesting you “avoid sharing videos and audio clips publicly to protect your voice from being cloned”.

On how far your ears can be trusted, a 2023 study from University College London (UCL) played real and artificial speech to 529 participants. They identified the fake speech 73% of the time, and training improved this only slightly.

B. Key concepts

Five ideas about how these scams work and where your choices come in.

Deepfake

As defined above by Ofcom: media made with artificial intelligence (AI) to look real.

Why it matters to you: Deepfakes are not only about famous people. The same tools can put a familiar face or voice into a private message or a call meant for you.

Voice cloning

Police Scotland describes voice cloning as using digital tools such as AI “to make a copy of your voice”, which can then be used to pretend to be you.

UCL’s article on its study notes that recent algorithms can recreate a voice from a clip of about three seconds. The figure will change as the technology does; the principle will not.

Why it matters to you: The raw material is a recording of you speaking. Every public video, livestream or voice clip is a possible sample, and you decide who can reach them.

The details around the voice

A voice alone is not enough. The FTC describes scammers who already know a name, an address or other information found on social media, and who sometimes simply guess.

Why it matters to you: A clip of your voice, a public list of your relatives and a post saying you are abroad fit together into a convincing script. Each piece seems harmless; the combination is what a scammer uses.

The script: urgency, secrecy, payment

The FTC describes a familiar pattern: it is urgent, you are the only one who can help, please keep it secret. A fake lawyer or police officer may join in, and payment is asked for by wire transfer, cryptocurrency, payment app or gift card. The workplace version, described by the FBI, uses a fake video call with company executives.

Why it matters to you: A deepfake makes the voice new, but the story is old. You do not need to spot the technology if you recognise the shape of the request.

Signs are unreliable; checking works

The FBI suggests listening closely to tone and word choice and looking for flaws in images and videos, such as distorted hands. These clues help, but the UCL listeners still missed fakes after training. The FTC’s advice moves the test elsewhere: “Don’t trust the voice.” Hang up, and call the person back on a number you know is theirs.

Why it matters to you: Detection depends on the quality of the fake; checking through a channel you already know does not. The next resource in this section, on the separate channel and the family safe word, turns that check into a habit.

C. A practical example: Lucia and the voice note from an old friend

Lucia is 48 and uses online services every day. She posts short cooking videos on a public profile, talking the viewer through each recipe. Anna, a school friend she sees once or twice a year, shares public clips of her choir’s concerts, often with a few words to camera.

One Saturday morning, a voice note arrives from a number Lucia does not know. It is Anna’s voice: her bag has been stolen at a station, she is on a borrowed phone, and she needs money for a ticket home, sent through a payment app within the half hour. Please do not mention it to their friends: she feels silly enough already.

The voice is right, and so is the nickname Anna has used since school. What makes Lucia pause is the shape of the request: a hurry, a payment that is hard to undo, a reason to keep quiet. She does not reply. She calls Anna on the number she has had for years. Anna answers from her kitchen, bag beside her.

What changed when Lucia looked at her own public voice

Later that week, Lucia did the exercise below, curious rather than frightened.

• Anna’s concert clips held plenty of her voice, and one post named the school they had both attended.
• Lucia’s own profile had many minutes of her speaking to camera, plus a family birthday video naming several relatives.
• Anyone could see her connections, including Anna: a stranger could work out whose voice would persuade her.

She kept the cooking videos public: she enjoys sharing them and decided the trade was worth it. She moved the birthday video and her connections list to friends only, removed a few connections she did not know, and told Anna, so that Anna could decide about her own clips.

Nothing was deleted in a panic. Lucia now knew which parts of her voice and family life were public, and she had chosen them.

D. Try it yourself: find your public voice and face (15 minutes)

Four short steps, best done on a computer. Nothing you find means you did something wrong.

Step 1 — Look for yourself as a stranger would (4 minutes)

• In a private browsing window, search your full name, then your name with the names of the platforms you use.
• Open your own profiles while signed out, where the platform allows it.
• List every public place where someone can hear you speak or see your face move: videos, reels, livestreams, voice clips in public groups, recorded talks or podcasts.

Step 2 — Note what each item reveals (4 minutes)

• Next to each item, write V if your voice can be heard clearly, F if your face can be seen clearly, and D if it also gives details: names of relatives, where you live, when you travel.
• An item with V and D together is the closest to a ready-made script.
• This is a picture, not a score. Some items you will want to keep exactly as they are.

Step 3 — Check who can see each one (4 minutes)

• For each item, find its audience: public, friends or followers only, or anyone with the link.
• On most social networks this is in the post’s own menu or in the privacy or audience settings.

• On YouTube, Google’s help page explains that you can change a video’s visibility in YouTube Studio, under Content and then Visibility. Public videos can be seen by anyone, unlisted ones by anyone with the link, and private ones only by you and the people you choose.

Step 4 — Make one decision (3 minutes)

For one item with a V, choose one of three options:

• Keep it public: it matters to you, and now you know it is there.
• Narrow the audience: move it to friends, followers or a private link.
• Remove it: take it down if it no longer serves you.

E. Videos, articles and further resources

Institutional sources first, then research, a real case and platform documentation.

Institutional sources

Ofcom (UK) — A deep dive into deepfakes that demean, defraud and disinform
What deepfakes are, how they are used to defraud, and how many people say they have seen one.
https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/deepfakes-demean-defraud-disinform

Police Scotland — Voice cloning scams
A plain explanation of voice cloning, with advice on calling back and sharing audio and video less publicly.
https://www.scotland.police.uk/advice/scams-and-frauds/voice-cloning-scams/

FTC (US) — Scammers use AI to enhance their family emergency schemes
How a short clip posted online can be used to clone a relative’s voice, and what to do instead of trusting it.
https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes

FTC (US) — Scammers Use Fake Emergencies To Steal Your Money
The script of the family emergency scam: urgency, secrecy, fake authority figures and hard-to-reverse payments.
https://consumer.ftc.gov/articles/scammers-use-fake-emergencies-steal-your-money

FBI Internet Crime Complaint Center (US) — Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
How criminals use AI-generated audio, images and video, with tips that include limiting your public image and voice.
https://www.ic3.gov/PSA/2024/PSA241203

Research and a real case

University College London — Humans unable to detect over a quarter of deepfake speech samples
A study of 529 listeners showing why judging a voice by ear is not a reliable test.
https://www.ucl.ac.uk/news/2023/aug/humans-unable-detect-over-quarter-deepfake-speech-samples

World Economic Forum — ‘This happens more frequently than people realize’: Arup chief on the lessons learned from a $25m deepfake crime
The engineering firm’s Chief Information Officer on a video call with deepfaked managers: “technology-enhanced social engineering”.
https://www.weforum.org/stories/emerging-technologies/deepfake-ai-cybercrime-arup

Platform documentation

YouTube Help — Change video privacy settings
The difference between public, unlisted and private videos, and where to change a video’s visibility.
https://support.google.com/youtube/answer/157177?hl=en-GB

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner: understanding how ordinary public content can become raw material for a scam.

Skills

• Finding where your voice and face are publicly available.
• Checking and changing the audience of a video or post.
• Recognising the script of an urgent, secret request for money.

Awareness

• Understanding that voice cloning scams are built from public samples plus personal details.
• Knowing that a familiar voice, on its own, is no longer proof of who is speaking.
• Treating your voice as personal data, without giving up sharing what you enjoy.

Secure Behaviour

• Choosing the audience of each video in which you speak, rather than leaving it to the default.
• Calling back on a number you already know before acting on an urgent request.
• Accepting connections only from people you actually know.

G. Questions to sit with

• If a stranger listened to everything you have posted publicly, how much of your voice and family life could they piece together?
• Which of your public videos would you keep public even now, and why?
• If a friend’s voice asked you for money tonight, on a number you did not know, which number of theirs would you call?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Your public voice and face

• MS6 — Make your social media accounts private, so that your videos and voice clips reach the people you chose rather than anyone who searches for you.
• MS7 — Limit access to your account, photos and posts by changing privacy settings, starting with the items in which you can be heard speaking.

Minimum commitment: today, choose one public video in which you speak and either narrow its audience or decide, knowingly, to keep it public.

2. Who can reach you and your family

• R23 — Connect only with people you know: every accepted stranger can see what you share with friends, including your voice and the names of the people close to you.

Minimum commitment: tell one person close to you that a familiar voice alone is not proof, and that you will both call back on the usual number before sending money.

In short

• Voice cloning scams copy a familiar voice from short recordings, often taken from content posted publicly.
• The voice is new; the script is old: urgency, secrecy, a fake authority and a payment that is hard to reverse.
• Your ears are not a reliable test. Calling back on a number you already know is.
• You decide who can hear your voice online: keep, narrow or remove, one video at a time.

Related resources in this course

• Family Safe Word and Call-Back: Your Defence Against AI Scams
• Spear Phishing: Why Scam Messages Know So Much About You
• Spam Calls: How Your Number Spreads and How to Cut Them

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.