Voice Clone Scams

Scammers are making use of widely available and relatively cheap voice cloning software to create believable requests to send them money.  The principle is that a call is received from a relative or family member; they are in some sort of difficulty and need funds to get by.  This might be an accident or issue with local authorities that requires cash to be handed over immediately before things get any worse.  This is not a new concept; in the past emails or texts have been used for this sort of fraud.   By sending a voicemail message that sounds like the caller the request is more likely to be acted upon.  The clone does not need to be 100% perfect as the ‘victim’ might be assumed to be in distress rather than speaking calmly.

Many Internet based voice cloning services act on a software as a service basis.  In some cases a basic solution is free.  Additional refinements of the product will up the overall price.  The host voice can be captured through a microphone or through uploading a sound file.  The latter is a boon to scammers as they can harvest suitable files from sources such as YouTube, Facebook and TikTok.  These are not only a reliable source of voices but also a context in which the scam can be wrapped.  The criminal not only has access to a voice but also knows where the owner is allowing a more credible request for funds to be created.

Legitimate uses for voice cloning exist in the media and training fields.  A narration or script can be worked up and a sound track created with less work than a conventional recording session.  The same script can be re-used for different markets by altering the dialect or language output.  A service is clearly going mainstream when the big players start to show an interest.  Microsoft claim that their new service VALL-E can create a believable clone based on 3 seconds of original speech. The systems use AI to read out a new script using the stolen voice.  The number of characters output depends on the cloning service chosen but scammers are unlikely to need lengthy, sophisticated speech files to create a small number of fake assistance requests.

McAffee commissioned a study into voice cloning scams in April 2023.  Results were based on a questionnaire organised by MSI-AC that elicited 7,054 responses in total from the USA, UK, France, Germany, Japan, Australia and India.  36% of the responders had never heard of voice cloning scams but 10% stated that they had personally experienced one.  45% of those surveyed said they would respond to a request for cash from a friend or loved one.  The cloning software investigated by McAffee was able to replicate a range of accents including that of the USA, U.K., India, and Australia.  Particularly distinctive voice patterns were noted to be harder to clone.  For example a pace or rhythm of speech.  Voice cloning services claim to support a range of language outputs and upload scripts including Greek and Russian although they do concentrate on the more populous target countries.

Voice cloning detection systems are finding it hard to keep up with the quality of synthesised speech.   A study by Hany Farid at the University of California, Berkeley showed known that fake broadcasts allegedly from the ousted Sudanese president Omar Al-Bashir very closely matched the sound pattern of genuine recordings.  In this case the ‘broadcasts’ were being used to spread fake news.  It is unlikely that any target of a request for funds from a friend or relation would go to great lengths to check the voice quality of a message.

At present it would be difficult to have a real time conversation using voice cloning.  Appropriate texts need to be prepared in advance and dropped as voice messages.  With rapidly evolving software systems it is possible that a live speaker could be spoofed in the near future.

With the increase in voice cloning everyone should be careful what they share on the Internet.  In some professions such as teaching or journalism it would be almost impossible to avoid having data on-line with a known voice.  Certainly any public sharing of data such as where someone is or what they are doing should be restricted to those who need to know.  Even in such cases hacking of a ‘friends’ account will expose these details.

With an awareness that voice cloning scams exist there are steps that can be used to reduce the chance of being exploited:

• Arrange a code word or phrase to only be used in cases of real need.
• Check where a message has come from, the device and if possible location.
• Listen to messages carefully, does any grammar or wording seem out of place?
• Contact a mutual acquaintance to check up on the caller.
• Contact police or emergency services local to any suspected incident.
• Avoid sending funds through routes that are hard to trace such as crypto currencies.