The phone rings and it is your son, or your granddaughter, or your sister. They sound frightened. They have been in an accident, or arrested, or lost their wallet abroad, and they need money sent now, and please don't tell anyone. The voice is exactly right. It may not be them at all.
Voice-cloning scams use cheap AI tools to copy a real person's voice from a short recording, then use it to rush a relative into paying. They are not new, but they are getting easier to run and harder to spot. This guide explains how they work, what the latest UK and US figures say, why Christmas is a good time for criminals, and the simplest defence there is: a family safe phrase.
How the scams work
A voice clone needs very little to go on. Starling Bank, which has run a public campaign on the problem, warns that scammers can copy a voice from as little as three seconds of audio. That can come from a video posted on social media, a voicemail greeting, or a short "wrong number" call designed to get you talking.
The criminal then types or speaks, and the software answers in the cloned voice. Some tools now work in real time, a technique sometimes called "voice skinning", so the scammer can hold a conversation rather than play a recording. Caller ID can be faked too, so the call may even appear to come from a number you recognise.
The story is almost always an emergency: a crash, an arrest, a hospital bill, a stolen phone. The aim is to make you act before you think. The payment request usually points to a bank transfer to an unfamiliar account, gift cards, cryptocurrency or a courier collecting cash.
Not every voice scam is aimed at your family. In February, Which? and National Trading Standards (NTS) warned about cold calls dressed up as "lifestyle surveys". The answers, and the recording of the person's voice, were then used to set up direct debits in the victim's name. "Criminals are using AI not just to deceive victims, but to trick legitimate systems into processing fraudulent payments," said Louise Baxter, who leads the NTS scams team.
How big is the problem in the UK?
In a Starling Bank survey of more than 3,000 UK adults, 28% said they thought they had been targeted by an AI voice-cloning scam in the previous year, and 46% did not know such scams existed. Only around three in ten said they would know what to look for.
Fraud overall remains huge. UK Finance's annual report, covered by the BBC in June, found almost £1.3bn was stolen through fraud in 2025, across 4.1 million cases, up 11% on the year before. The BBC reported that criminals are using AI to mimic the voices of celebrities and of victims' own family and friends. UK Finance's previous report put the average loss to a deepfake scam call at £595 per incident, with some victims losing more than £13,000.
People are also finding it harder to trust what they see and hear. In a Which? test published in May, 70% of the 514 adults taking part could not correctly tell all of the real videos from the deepfakes they were shown. And the NTS AI Scam Watchlist, published in September, found 47% of UK adults say it is now harder to tell what is genuine online, while 79% are concerned about a friend or relative being caught out. Voice cloning was among the public's top worries.
And in the US
The picture is similar across the Atlantic. The Federal Trade Commission (FTC) says Americans reported losing $3.5bn to impostor scams in 2025, nearly three times the figure for 2020, with impostor scams making up almost one in three fraud reports. Total reported fraud losses reached a record of around $16bn. Separately, the FBI says Americans lost more than $893m to AI-related scams last year, according to CNN.
Why Christmas raises the risk
There is no special Christmas scam, but the season gives criminals plenty to work with. Families post more videos and voice notes, which means more audio to copy. Relatives are travelling, so a call saying someone is stranded or has lost their phone sounds believable, and they may genuinely be hard to reach. Money is moving anyway, for presents, travel and parties, so one more urgent transfer feels less unusual. And everyone is busy and tired, which is exactly when people skip a quick check.
Older relatives can be particularly exposed, as the survey scams showed. A short conversation over Christmas dinner about how these calls work may be the most useful present you give this year.
How to set up a family safe phrase
A safe phrase is a word or short phrase that only your close family knows. If someone calls claiming to be a relative in trouble, you ask for it. A clone cannot guess it. Starling Bank and Age UK both recommend the idea. Here is how to do it well.
- Agree it in person. Do it face to face, ideally when the family is together. Starling and Age UK both advise against sharing it by text or online. If you must text it, delete the message afterwards.
- Make it random but memorable. Pick something odd that nobody could work out from social media: "purple kettle Tuesday" works better than a pet's name, a birthday or a football team.
- Keep it separate from passwords. Don't reuse a password or a memorable word from your bank.
- Keep the circle small. Share it only with the people likely to call each other in an emergency, and make sure older and younger relatives both know it.
- Agree the rule. No phrase, no money, however upset the caller sounds. A real relative will understand.
- Don't give it away. Ask the caller to say it. Never prompt them with it or offer clues.
- Change it now and then, and straight away if you think it has been shared.
If you don't have a phrase, ask a question only the real person would know and that isn't online, as the FTC suggests. Better still, do both.
Red flags to listen for
- An emergency that needs money right now.
- A request to keep it secret, especially from other family members.
- Payment by bank transfer to a new account, gift cards, cryptocurrency or a cash courier.
- A reason why you can't call them back: a broken phone, a borrowed one, a "lawyer" or "police officer" taking over.
- A voice that sounds right but slightly flat, or pauses oddly before answering.
- Any call from your "bank" asking you to move money to keep it safe. Banks don't do that.
What to do if you're targeted
Hang up. That isn't rude, it's sensible. The FTC's advice is simple: don't trust the voice. Call the person on a number you know is theirs and check the story. If you can't reach them, try someone else in the family.
In the UK: if the call claims to be from your bank, hang up and call 159, the free number that connects you to most major UK banks. Which? advises waiting at least 15 minutes before calling back, or using a different phone, because criminals can keep a line open. Only use a number from the bank's official website, a letter or the back of your card. If you have lost money, call your bank straight away on the number on your card and report it to Report Fraud (formerly Action Fraud), or to Police Scotland on 101 if you live in Scotland. Which? also suggests registering with the Telephone Preference Service and using a call blocker to cut down on cold calls.
In the US: report the scam to the FTC at ReportFraud.ftc.gov, and call your bank or card provider at once if you have paid.
Whatever happened, don't be embarrassed. These calls are designed by professionals to fool careful people. Reporting them helps stop the next one.