The economics of voice fraud changed faster than most security programs did. Cloning a person’s voice no longer requires a studio or a data set.
Three seconds of audio is enough for current models to produce a voice roughly 85% similar to the original, and the entire process can be completed in under 30 minutes by someone with no technical background.
The results are visible in the incident data. AI voice cloning scams rose 148% between April 2024 and March 2025. Vishing attacks increased 442% from the first to the second half of 2024.
More than 8,400 fraud incidents linked to AI voice cloning were recorded in the first half of 2025, contributing to an estimated $3.046 billion in losses over the year.
The uncomfortable finding underneath those numbers is that people cannot hear the difference. In perceptual studies, human accuracy at identifying high-quality audio deepfakes sits around 24.5%, worse than chance on a binary decision, and roughly 70% of people cannot distinguish a cloned voice from a real one under normal listening conditions.
Training staff to “listen carefully” is not a control. It is a hope.
This article covers what detection actually looks like today, where it breaks, and what to build around it.
The supply side, and where the real control point sits
Voice synthesis is now a commodity. Dozens of models exist, many are open weights, and the compute required is trivial. Any strategy premised on restricting access to the technology is already obsolete.
What differs meaningfully between providers is not model quality but consent architecture. Legitimate voice cloning has real commercial uses: localizing training content, producing multilingual media, accessibility applications for people who have lost their voice.
The providers serving those markets generally gate cloning behind explicit verified consent, because they carry liability if they do not.
Rask AI voice cloning is one example of the pattern, requiring explicit recorded consent from the voice owner before a clone is created, with the cloned voice supporting output in 30+ languages for localization use cases.
That gating is worth understanding for two reasons. First, it means the mainstream commercial tools are not where most attack voices come from, which matters when you are scoping threat intelligence.
Attackers use unrestricted open-source models, not audited SaaS platforms with consent logs. Second, it defines what “responsible provider” means in practice, which is the question procurement and legal will ask when your own marketing or L&D team wants to use synthesis internally.
Assessing a provider in that context comes down to a short list: does it require verified consent before cloning, does it maintain an audit trail of who authorized what, can consent be revoked and the model deleted, and does it embed any provenance marker in the output.
Manual detection: the artifacts that still show
Human listening is unreliable on its own, but structured listening against known artifacts is better than casual listening. On lower-quality or older-model output, several tells remain.
Breathing patterns. Many models handle breath poorly. Listen for breaths that are absent entirely across long passages, placed at grammatically convenient points rather than physiologically natural ones, or identical in duration each time.
Uniform precision. Cloned voices tend to pronounce words with unnatural consistency. Real speakers slur, clip and vary articulation depending on fatigue, emotion and position in the sentence. Synthetic output is often too clean.
Cadence and intonation. Prosody is where models still struggle. Listen for flat emotional contour across content that should carry emotional weight, intonation that resets oddly at sentence boundaries, or pacing that does not vary with the meaning of what is being said.
Unnatural pauses. Either too few, or placed at regular intervals that track the text rather than the thought.
Background noise. Synthetic audio often has an unnaturally clean noise floor, or a noise bed that stays perfectly constant while the speaker’s apparent position changes. A genuine phone call has variable ambient sound.
Emotional flow. Human speech carries dynamic emotional movement across a conversation. Synthetic speech tends toward a single emotional register held throughout, which is particularly noticeable in urgent-scenario social engineering where the emotion should escalate.
Two important caveats. These artifacts are disappearing rapidly in newer models, so absence of artifacts proves nothing.
And in the live social engineering scenarios where this matters, the target is under time pressure and emotional stress, which is precisely when structured listening does not happen.
Automated detection: capability and limits
Forensic detection tools analyze audio signals for statistical signatures of synthesis rather than for anything a human would perceive.
Current platforms can identify output from more than 24 known generator models and return a verdict in under 30 seconds, which makes them viable for real-time flagging in call center and contact center environments.
Vendors commonly cite accuracy figures approaching 99% under benchmark conditions. Treat those numbers with the usual skepticism applied to any detector evaluated on the distribution it was trained against.
Independent assessments put real-world error rates above 13%, and performance degrades sharply in the two situations that matter most:
Novel generators. Detection is fundamentally a classification problem against known model families. Output from a model the detector has not seen is frequently misclassified. This is a structural lag, not a fixable bug, and it means detection capability decays continuously between updates.
Degraded audio. Telephony compression, packet loss, background noise and re-recording strip exactly the fine-grained spectral detail detectors rely on. A clean WAV file is a favourable case. An 8 kHz phone call recorded through a conference room speaker is not.
Then there is the error trade-off. In a contact center processing large call volumes, a false positive rate that sounds acceptable in percentage terms translates into a meaningful number of legitimate customers accused of impersonation every day. Tuning toward fewer false positives increases false negatives, which is how the attack gets through. There is no setting that makes this problem go away.
Watermarking and provenance offer a more durable approach, though only for cooperating generators. Cryptographic watermarks embedded at generation time can be verified downstream, and provenance standards for synthetic media are maturing. The limitation is obvious: an attacker using an unrestricted model simply does not watermark. Provenance verifies legitimate content rather than catching malicious content, which is still useful, just not as a detection control.
Speaker verification against known samples is worth running where you have a reference. Comparing a suspect recording against verified samples of the claimed speaker catches clones built from limited or poor-quality source audio. It performs worse against clones built from abundant public audio, which is exactly the situation for executives who appear on podcasts and earnings calls.
Preserve the original file. Any forensic analysis depends on the unmodified audio. Re-encoding, trimming or transcoding a suspect recording before analysis destroys the artifacts a detector needs. If your incident process involves forwarding call recordings through systems that transcode, fix that before you need it.
Use multiple methods together. No single technique is reliable alone, and agreement across independent approaches is more informative than any one confidence score.
Why detection alone is a losing strategy
Every control described above is probabilistic and degrades against improving models. Building a defense that depends on correctly identifying synthetic audio means accepting that a sufficiently good clone defeats you.
The alternative is to design processes where knowing whether the voice is real stops being necessary.
Retire voice as an authentication factor. Voice biometrics for account access is no longer defensible as a primary control. Where it exists, demote it to a low-assurance signal combined with other factors, or remove it.
Mandatory out-of-band verification for financial actions. Any wire transfer, payment detail change, or credential reset requested by voice gets verified through a separate channel initiated by the recipient, using contact details from the system of record rather than from the request. This single control neutralizes the large majority of vishing and CEO fraud attempts regardless of clone quality.
Dual authorization above a threshold. Two independent approvers for payments over a defined amount, with no ability for a single urgent request to bypass it. Urgency is the primary lever in these attacks and dual authorization removes it.
Remove urgency as an accepted justification. The organizational culture question matters here. If a request from a senior executive framed as urgent reliably causes staff to skip procedure, the technical controls are irrelevant. Make it explicit policy that no legitimate request will ever require bypassing verification, and back it when a real executive complains.
Codeword protocols for high-risk roles. Finance staff, executive assistants and anyone with payment authority can agree a pre-shared verbal challenge for unexpected voice requests. Crude, but effective, and it costs nothing.
Extend the same logic to family fraud awareness. The family-emergency scam targets employees personally and the mitigation is identical: a pre-agreed family codeword and a habit of calling back on a known number.
Training that reflects the actual base rate
Awareness training on voice cloning has to avoid a specific failure: teaching staff to detect clones by ear. Given human accuracy around 24.5%, that training produces false confidence, which is worse than no training.
Effective programs teach the procedural response instead. The correct reaction to an unexpected voice request is not evaluation, it is verification. Staff should not be asked to judge authenticity at all.
Structured simulation works better than slide decks. Organizations running quarterly vishing simulations report roughly 25.9% improvement in response behaviour, and engagement with voice-cloning-specific awareness content runs around 30% higher than with generic phishing material, largely because the threat feels concrete.
Run simulations that include a cloned voice of a real internal executive, with appropriate authorization, and measure whether staff verify rather than whether they detect.
Practical sequencing
For most organizations the order should be:
- Audit where voice currently functions as an authentication or authorization factor, and remove it as a primary control.
- Implement out-of-band verification and dual authorization for financial transactions. This is the highest-impact control and it does not depend on any detection technology.
- Deploy detection tooling in contact centers and high-volume voice channels as a flagging layer, with explicit documentation that it supplements rather than replaces verification policy.
- Run quarterly voice-based social engineering simulations and measure procedural compliance.
- For internal use of synthesis, require providers with verified consent workflows, audit trails and revocation, and document that requirement in procurement standards.
Detection tools belong in the stack. They should never be the thing standing between an attacker and a wire transfer.
