Voice cloning scams: how to check a call really is from someone you know

How a voice-clone call works

A voice clone is speech generated by software fed with recordings of a real person. Starling Bank’s chief information security officer, Lisa Grahame, has said scammers need as little as three seconds of audio to make one. Treat that as a warning about what the tools can do, not a measured UK statistic. Starling’s point is that people regularly post recordings of their own voice online without thinking of it as raw material.

The clone is the new part. The rest is an old script: someone you trust is in trouble, money is needed now, and there is a reason you cannot check in the usual way. Stop! Think Fraud, the government’s fraud campaign, says fraudsters can spoof numbers, so caller ID is not proof of who is calling.

Cloned voices are also turned on systems rather than people. In February 2026 National Trading Standards warned that criminals run “lifestyle survey” cold calls to harvest personal, health and financial details, then use an AI clone of the victim’s voice to fake consent for direct debits. Ofcom’s advice applies: don’t give personal details to anyone who calls unexpectedly.

What the calls and messages sound like

The relative. A message or call from a son or daughter, often from a “new number” because their phone is lost or broken, asking for money. Santander UK said about £160,000 had been reported stolen through “Hi Dad” impersonation scams so far in 2026, as of mid-June, by message or by an AI-generated call pretending to be the victim’s child. The text version changes costume with the season: The Independent’s headline on 9 July 2026 was “Warning over new heatwave-themed ‘hi mum’ text scam sent to British phones”.

The boss or colleague. One well-documented case is international. In May 2024 the engineering firm Arup confirmed that a Hong Kong finance employee had been deceived, on a video call with deepfaked colleagues including the chief financial officer, into sending HK$200 million (about US$25.6 million) in 15 transactions. The lesson travels: an instruction to move money gets checked through a separate channel, however familiar the voice.

The bank or the police. A caller says your account has been compromised and you must move your money to a “safe account”. Age UK’s advice is blunt: safe accounts don’t exist. Hang up, then call back on a number you found yourself, or dial 159 for your bank or 101 for the police.

The tells

Don’t count on hearing a clone. Build your defence on the shape of the request, not on listening harder. Ofcom’s scam-call guidance is the plainest test: genuine callers will not pressure you to act immediately or ask you to keep a call secret, and it is always safe to hang up.

The pattern is the same whether the voice is cloned or not: urgency; a reason you cannot call back on the usual number (a new phone, a flat battery); a request to send money to an account you have never paid before; and often a nudge to keep it between the two of you. Take Five, the banking industry’s fraud campaign, puts the family version simply: if a friend or family member messages saying they urgently need money, speak to them directly first to check it is them.

How to check: hang up, call back, safe phrase, 159

Hang up and call back. Take Five’s rule for any caller claiming to be from a trusted organisation is to hang up and call back on a number you know to be correct, never one the caller gives you. Age UK says the same for a relative in a supposed emergency: hang up and call back on a number you already have. If you cannot reach them, send nothing until you have checked with someone else you trust. The pause is the point; the scam depends on keeping you on the line.

Ask for the safe phrase. Stop! Think Fraud’s advice is to agree a safe phrase with close friends and family, never share it outside that group, and if someone claiming to be family or a friend cannot tell you it, hang up immediately. Starling Bank’s Safe Phrases campaign, launched in September 2024 in support of Stop! Think Fraud, made the point with an AI clone of the actor James Nesbitt’s voice. Starling’s advice is to pick something easy to remember, never shared publicly or digitally, and different from your passwords. Our family safe word guide covers choosing and agreeing one; The Family File, which is gaining a ‘Scams and our safe word’ page, is a sensible place to record who knows it, but never the phrase itself.

159 is for the bank, not for family. If the caller says they are your bank, hang up and dial 159. Stop Scams UK says 159 connects you directly to your own bank, cannot be spoofed and will never call you, so a call claiming to come from 159 is itself a scam. In September 2026 Stop Scams UK listed 27 bank and fintech brands on the service. It is not necessarily free: the cost depends on your phone provider and is often the national rate. It cannot tell you whether the voice was really your daughter. Call her back.

How big is this, honestly

There is no official UK figure for money lost to voice-clone or “Hi Mum” scams. UK Finance’s annual fraud report splits authorised push payment fraud into eight types, none of them a family emergency or a voice clone, and “Hi Mum”, WhatsApp and voice cloning do not appear in the 2026 report. Treat any national total you see quoted with caution.

The measured picture is mixed. Our AI scams hub has the national totals. Impersonation scams, the closest official category, fell in 2025: losses down 12% and cases down 11%, with 80% of those losses returned to victims. Scams that started through telecoms, such as a phone call, were fewer (17% of APP cases) but larger (28% of APP losses). UK Finance says criminals are exploiting AI to industrialise their operations, and gives no figure for how much fraud involves it.

The survey figures in circulation are older than they look. Starling’s 28% of UK adults who said they had been targeted by an AI voice-cloning scam in the past year, and 46% who had never heard of such scams, come from a self-reported Mortar Research poll of 3,010 adults, fieldwork 21–23 August 2024. National Trading Standards’ Censuswide poll (2,001 adults, October 2025) found UK adults get an average of seven scam calls or texts a month; 21% get them most days. The honest backdrop: scam attempts are frequent, and nobody officially measures how many use a cloned voice.

If you have already sent money

Call your bank first, on the number on your card or 159. Then report it. In England, Wales and Northern Ireland that means Report Fraud, at reportfraud.police.uk or on 0300 123 2040. It replaced Action Fraud on 4 December 2025, with the full public launch in January 2026, so an older leaflet that still says “Action Fraud” is out of date: use Report Fraud. In Scotland, report to Police Scotland on 101.

Block the number, then report the call by copying the caller’s number into a text to 7726, which is free; Ofcom sets out how, and Police Scotland’s voice-cloning advice recommends the same step. If you gave away personal information, follow the NCSC’s advice. Our guide to what to do if you’ve been scammed covers the bank reimbursement rules, the time limits and the Northern Ireland ‘call for service’ route.

Helping older relatives

Ofcom’s advice for anyone looking after a relative is to encourage them to check with you, or another trusted person, before sending money. Say the rule out loud once: “If I ever ring you in a panic asking for money, hang up on me and ring me back.” Agree the safe phrase in person; Age UK says it should never be shared by text or online.

Then reduce the calls that reach them. The National Cyber Security Centre points people to their phone provider for caller display, incoming call blocking and anonymous call rejection. Police Scotland adds: avoid answering unknown numbers, ask the provider to block anonymous calls, and avoid sharing videos and audio clips publicly. Fewer calls means fewer moments where a good clone meets a tired person.