“That Sounds Like My Boss!” How AI Voice Cloning Is Changing Phone Scams

Cyber Threats Explained | ApexSiteDefense

Your phone rings.

It’s your boss.

You recognize the voice immediately. The familiar tone, the little pauses between words, even the way they pronounce your name.

There’s an urgent problem with a vendor payment. Your boss needs you to transfer money to a different account before the end of the day.

And please, don’t bother the accounting department. There’s no time.

Something doesn’t feel quite right.

But that voice? You’re certain it’s your boss.

There’s just one problem.

Your boss never made that call.

Welcome to the world of voice phishing, also known as vishing, where cybercriminals use phone calls, impersonation, psychological manipulation, and increasingly artificial intelligence to convince people to surrender sensitive information or money.

And the voice on the other end may not belong to a real caller at all.

What Is Voice Phishing (Vishing)?

Voice phishing is a form of social engineering in which criminals use telephone calls, voice messages, or other voice communications to deceive someone into revealing information, transferring money, or performing an action that benefits the attacker.

The term vishing combines the words voice and phishing.

Traditional phishing typically involves fraudulent emails. Smishing uses text messages. Vishing relies on spoken communication.

The attacker might pretend to represent:

• Your bank or credit card company

• A government agency

• Technical support

• Your employer or company executive

• A trusted vendor

• A family member experiencing an emergency

The criminal’s goal is to make the target believe the conversation is legitimate.

And sometimes, the attacker doesn’t even need to sound like themselves.

How Artificial Intelligence Is Changing Voice Phishing

Voice impersonation isn’t new.

For years, scammers have pretended to be bank representatives, technical support agents, and worried relatives.

What’s changing is how convincingly they can imitate another person.

AI voice-cloning technology can analyze recordings of someone’s speech and generate synthetic audio resembling that person’s voice.

Depending on the quality and quantity of the source material, the resulting voice may reproduce recognizable characteristics such as tone, accent, rhythm, and pronunciation.

Criminals may obtain voice samples from publicly available videos, podcasts, interviews, social media posts, or other recordings.

Some technologies can generate prerecorded speech, while others support interactive synthetic conversations.

The frightening implication is simple:

Hearing a familiar voice no longer guarantees you’re speaking to the person you think you are.

The Federal Trade Commission has specifically warned that scammers can use recordings of loved ones to create convincing voice-cloning scams.

And the FBI has documented malicious campaigns involving AI-generated voice messages impersonating senior government officials.

This isn’t merely a hypothetical concern.

How Does an AI Voice Phishing Attack Work?

Let’s walk through a fictional example involving a small business.

Step 1: The Attacker Researches the Target

A criminal identifies a business owner who regularly appears in online videos.

The business website lists employees and their positions.

The attacker learns who manages payments and discovers the name of a frequently used supplier.

Even without hacking the company’s systems, publicly available information may help create a believable impersonation.

Step 2: The Attacker Creates a Convincing Voice

Using audio samples from online sources, the criminal prepares synthetic speech resembling the business owner’s voice.

The attacker also develops a believable story about an urgent financial issue.

Step 3: The Employee Receives a Call

The employee answers the telephone.

The caller sounds like the owner.

There’s an unexpected problem with a supplier payment, and immediate action is supposedly required.

The caller insists that the matter is confidential.

Step 4: The Criminal Applies Pressure

The attacker creates a false sense of urgency.

Perhaps the supplier will cancel an important delivery.

Perhaps a client relationship is supposedly in danger.

The criminal may insist that the employee act immediately and avoid involving coworkers.

Step 5: The Victim Takes Action

Believing the request came from the owner, the employee might transfer money, share an authentication code, disclose confidential information, or change payment details.

The attack succeeds not because the criminal broke through a firewall, but because they persuaded someone to trust an impersonation.

Fortunately, this scenario has a straightforward defense: independently verifying unexpected requests before acting.

A Real-World Warning from the FBI

In May 2025, the FBI issued a public warning about malicious voice and text messages impersonating senior U.S. officials.

The agency reported that attackers were using AI-generated voice messages to establish trust and manipulate targeted individuals.

The FBI updated that warning in December 2025, describing continued impersonation activity involving officials and their contacts.

The guidance emphasized independently verifying unexpected communications and protecting sensitive information.

These warnings illustrate why businesses and individuals should no longer rely on a recognizable voice, familiar name, or displayed phone number as sufficient proof of identity.

Common Types of Voice Phishing Attacks

1. The Fake Bank Representative

Someone calls claiming there has been suspicious activity on your account.

They sound professional and may already know your name.

They ask you to provide a verification code, password, or other information to stop a fraudulent transaction.

In reality, the caller may be attempting to gain access to your account.

Legitimate financial institutions may contact customers about suspicious activity, but you should verify unexpected calls using the institution’s official contact information.

2. The Family Emergency Scam

You receive a call from someone who sounds like a family member.

They’re frightened, injured, or in serious trouble.

They need money immediately.

The caller may insist that you keep the situation private.

Artificial intelligence can make these scams particularly upsetting because the voice may sound familiar.

The FTC recommends independently contacting the family member using a number you already know.

3. The Fake Technical Support Call

The caller claims to represent Microsoft, Apple, your internet provider, or your company’s IT department.

They insist that your computer is infected or that your account is about to be disabled.

They may ask you to install remote-access software, provide login credentials, or approve an authentication request.

Instead of following the caller’s instructions, contact your IT department or service provider independently.

4. The Executive Impersonation Scam

An employee receives a call supposedly from the CEO, owner, or financial director.

The caller demands an urgent wire transfer, purchase, or confidential document.

Sometimes these attacks are part of broader business email compromise schemes.

When high-ranking executives are specifically targeted or impersonated, the incident may overlap with techniques associated with whaling.

5. The One-Time Code Scam

An attacker initiates a real login attempt using stolen or otherwise obtained credentials.

The victim receives a legitimate authentication code.

A caller claiming to be from security support asks the victim to read the code aloud.

If the victim cooperates, the criminal may be able to complete the login.

Never give an unexpected caller your authentication code, even if the caller claims to work for the company that sent it.

Why Are Vishing Attacks So Effective?

Voice phishing exploits human behavior.

We naturally associate familiar voices with familiar people.

We also tend to respond quickly when someone sounds frightened, authoritative, or urgently in need of help.

Criminals exploit these reactions through several common tactics.

Authority: The caller claims to be your boss, a bank representative, or a government official.

Urgency: You’re told the problem must be resolved immediately.

Fear: The caller warns of financial loss, legal consequences, account closure, or danger to a loved one.

Secrecy: You’re discouraged from consulting someone else.

Familiarity: The caller uses names, personal details, or a recognizable voice to establish credibility.

An attack may combine several of these tactics at once.

The solution is to recognize the manipulation before taking action.

Seven Warning Signs of a Voice Phishing Scam

Although AI-generated speech can sound natural, suspicious requests often reveal more than the voice itself.

Watch for these warning signs:

1. Unexpected urgency. The caller demands immediate action without allowing time for verification.

2. Requests for authentication codes. You’re asked to share a one-time password, MFA code, or account recovery information.

3. Unusual payment instructions. Someone requests payment through gift cards, cryptocurrency, or an unfamiliar bank account.

4. Pressure to keep secrets. The caller tells you not to speak with coworkers or family members.

5. Refusal to allow a callback. The person becomes upset when you suggest independently verifying their identity.

6. Unexpected technical instructions. You’re asked to install software, share your screen, or approve a login request.

7. Behavior that doesn’t match the situation. A familiar person makes an unusual request that contradicts established procedures.

Remember, an AI-generated voice won’t necessarily sound robotic or unnatural.

Pay more attention to what the caller wants you to do than to how convincing their voice sounds.