The phone rings on a Tuesday at 4:40 p.m. It is your boss's voice, or the principal's, or your son's. It sounds agitated. They need a transfer "right now," a code you just received, or a favor you "must not mention to anyone." Everything about the call feels authentic, and that is exactly the problem: a familiar voice no longer proves anything.
In this article I explain how voice cloning works, what the data say (FBI, Hong Kong, Colombia), what the warning signs are and, above all, I give you a verification protocol ready to use at your company, school or home. Date of the last check of data and rules: October 9, 2026.
Summary. A few seconds of audio posted on social media can be enough to imitate a voice. Listeners spot fake voices only 73% of the time. What protects you is not a good ear but verifying through a second channel, using a number you already have, and requiring double approval for payments and bank-account changes.
How voice cloning works and why it fools us
A synthetic voice model is trained on recordings of a person and learns their timbre, rhythm and verbal tics. It can then "read" any text in that voice, even in real time during a call. The US Federal Trade Commission (FTC) warns that a scammer only needs a short clip of a relative's voice, which can come from content posted online, and a cloning program. WhatsApp voice notes, Instagram videos, recorded classes and conference talks are more than enough raw material.
Would we notice? A University College London study published in PLOS ONE in 2023 asked 529 people to tell real voices from fake ones: they got it right 73% of the time, and training them with examples barely helped. The authors themselves note they used relatively old algorithms, so with today's models the figure is probably worse. The practical conclusion is uncomfortable: you cannot trust your ear, you have to trust a procedure.
What the data say: from the FBI to Colombia
In 2024 the FBI's Internet Crime Complaint Center (IC3) received 859,531 complaints and recorded losses of US$16.6 billion, 33% more than in 2023. Business email compromise (BEC, where someone poses as a boss or supplier to divert a payment) alone caused US$2.77 billion in losses, with 21,442 complaints. It is the second-largest source of losses, and voice and video cloning are the new version of that same script.
The most cited case happened in Hong Kong. A finance employee at the engineering firm Arup joined a video call with who he believed was the chief financial officer and other colleagues; all of them were fake recreations. He made 15 transfers totaling about HK$200 million (roughly US$25 million) to five accounts, and only found out a week later when he checked with headquarters. He had first doubted a "secret" email, but the video call dispelled his doubts: seeing and hearing "colleagues" who looked real was the false proof of authenticity.
And here? Colombia does not yet have a consolidated official statistic on voice-cloning scams. What exists are signals. A report from the Sound Engineering program at the Universidad de San Buenaventura, covered by Portafolio, speaks of a 30% increase in December 2025 (the article does not specify compared with which period). The National Police reported, as of December 2025, 64 extortion complaints in Bolívar, 24 of which involved digital methods such as cloned voices and AI-generated images, and the Gaula anti-extortion unit recorded 36 related arrests. And the National Digital Security Strategy places Colombia as the second most attacked country in Latin America in 2025, with 17% of the region's attempts.
What a scam call sounds like: the pattern that repeats
The voice and the technology change, but the script hardly varies. Look for this combination:
- A voice of authority or affection: the manager, the principal, the accountant, your child, your mother.
- Urgency: "it's for today," "otherwise we lose the contract," "they're waiting for me."
- Secrecy: "don't tell anyone," "it's confidential," "I'm embarrassed."
- A payment that cannot be reversed: a transfer to a new account, digital wallets, cryptocurrency, gift cards, or a code that arrived by message.
- A channel that stops you from verifying: they call from an unknown number, tell you not to hang up, or say their phone is "broken."
When two or more of these signs appear together, it stops mattering how real the voice sounds. At school the typical version is the "principal" asking the treasurer for an urgent payment to a new supplier; at home, the "detained" or injured child who needs money now. The FTC and the Universidad de San Buenaventura report give the same advice: don't trust the voice, verify through another channel.
Verification protocol for companies, schools and families
This is the resource I promised. It is designed to be applied in under two minutes and so that it does not depend on someone "noticing." Print it and stick it next to the treasury phone, or share it in the family group.
| Situation | Verification rule |
|---|---|
| They ask for a new payment or a bank-account change | Confirm by calling the number that is already on file (not the one they give you). Two people approve it and it is written down. |
| They ask for a code, password or personal data | Never give them over the phone, even if the voice belongs to someone you know. Codes are personal and non-transferable. |
| "Urgent" call from an executive | Pause 20 seconds, hang up and call back through the official channel. Any real emergency survives that wait. |
| Video call asking for money | Ask the person to do something unexpected (a gesture, a question only they would know) and confirm by another means before acting. |
| A relative "in trouble" asks for money | Use the family code word agreed in advance, or call that person or another relative directly. |
| They ask you to keep it secret | Secrecy is a warning sign, not a reason to obey. Talk to someone you trust. |
Some recommendations from the Universidad de San Buenaventura report help adapt the protocol: pause at least 20 seconds before acting, ask a question only the real person could answer, listen to the audio with headphones to catch cuts or unnatural endings, save the recording and report it. As lecturer Marcelo Herrera puts it: "What protects you is not the technology, but the calm to verify."
How to set up a family code word
- Choose it in person, not by chat; make it a word or phrase nobody could guess that appears on no social network.
- Use it only for money or safety emergencies so it keeps its value.
- Explain it to grandparents and teenagers too: they are the most frequent targets of this kind of call.
How to protect yourself at work and at school
For a small company or school, the cheapest and most effective change is to separate whoever requests the payment from whoever authorizes it and to standardize the document used to request it. A payment order with a fixed format, with the amount also written in words, the registered account and two signatures, makes it harder for an urgent voice to replace it. Checks had that logic; transfers lost it. If you use Excel for payment orders, the Number-to-words converter for Excel writes the amount in words automatically (there is also a free online version), and the Invoice with email delivery to the customer always keeps the same sender, format and bank details, so any change of account stands out as an anomaly.
What to do if you already made the transfer
- Call your bank immediately and ask them to try to block or reverse the operation. In business fraud every hour counts: according to Proofpoint's summary of the FBI report, its Recovery Asset Team froze 66% of the business email compromise transfers it handled in 2024.
- Save the evidence: the audio, the number they called from, the messages, the receipts.
- Report it. In Colombia you can do so at the National Police's CAI Virtual and with the Attorney General's Office (Fiscalía). Elsewhere, use your national cybercrime reporting channel (in the US, IC3).
- Change passwords and turn on two-step verification on your email and online banking, in case the scammer also obtained credentials.
What the law says in Colombia
Law 2502 of 2025, enacted on July 28, 2025 and published in Diario Oficial 53.198, defined a deepfake as a fake audiovisual record (photos, videos or sound recordings) created or modified with AI, and added to the crime of personal forgery (article 296 of the Penal Code) an aggravating circumstance when the impersonation is done with artificial intelligence: according to the text, the fine increases by up to one third, provided the conduct does not constitute another crime. The law also orders a public policy on the use of AI to deceive or harm. Keep in mind that fraud and extortion have their own crimes and penalties; ask a lawyer or the Fiscalía how your case would be classified, and check the law's text for when the aggravating circumstance takes effect, because this article is not legal advice.
How to talk about this with students and families
Teenagers share their voices and their families' voices on social media all day, and their grandparents are frequent targets. A 15-minute exercise works better than a lecture: ask students to write, in pairs, a "fake call" script and have another pair identify the five signs of the pattern (authority, urgency, secrecy, irreversible payment, unverifiable channel). Then let each family agree on its code word. If you teach technology or computing, the AI Kit for teachers helps you prepare digital-literacy resources by subject without starting from scratch, and the AI Exam Generator lets you turn this protocol into a comprehension quiz in minutes (there is a free demo).
To widen the picture of what AI can and cannot do, I recommend "AI won't replace you, but whoever masters it will" and "The Big Lie About AI", where I review what a machine really understands and which laws exist in Colombia, Latin America and the world.
Frequently asked questions
How many seconds of audio does a scammer need to clone my voice?
There is no single reliable figure: it depends on the tool and the audio quality. Official warnings speak of "a short clip." The prudent assumption is that any public audio (stories, videos, forwarded voice notes) is enough for a convincing imitation.
Can a cloned voice be detected?
Sometimes. Cuts, odd pauses, missing breathing or an overly flat tone can give it away, but studies show people get it right about 73% of the time and models improve every year. That is why the protocol does not depend on detecting the fake, but on verifying the request.
What is a family code word and how is it used?
It is a word or phrase agreed in person that only the family knows. If someone calls asking for money urgently, you ask for the word; if they don't know it, you hang up and call the person directly. It must not be posted or typed in chats.
Does my company need special software against these scams?
Not to start. The most effective controls are about process: double approval, call-backs to registered numbers, standardized payment templates and training. Detection software complements these rules but does not replace them.
What do I do if my voice or my principal's was cloned and is circulating online?
Save screenshots and links, report the content to the platform, warn your community through official channels and file a report with the CAI Virtual or the Fiscalía.
Turn information into action. Standardize your payment orders with the Number-to-words converter for Excel, always send invoices in the same format with the Invoice with email delivery and, if you teach, bring the topic into the classroom with the AI Kit for teachers. And share this article with whoever handles payments at your home or institution: it is free and could save a lot of money.
Food for thought
For centuries, recognizing someone's voice was the most intimate way of trusting them. If that proof no longer works, should we get used to distrusting by default the people we love most, or redesign our institutions so that trust does not depend on a voice? And who should bear the cost when a company, a school or a family is deceived: the victim, the bank, the platforms that host the audio or the people who develop these tools?
Was this article helpful?
React and share it with someone who might find it useful.
- Like 0
- Insightful 0
- Celebrate 0
- Love 0
- Thought-provoking 0
Prefer to have it ready?
More guides in AI and technology for teachers