The call comes in at 11:43 PM. An unknown number. The mother picks up because her daughter is travelling.
“Amma. Amma, I need help.” The voice is unmistakably her daughter’s — the exact cadence, the particular pitch when she is frightened. “I’ve been in an accident. I’m at the police station. Please just listen.”
A second voice comes on. Calm, authoritative, identifying himself as a senior officer. A minor incident, no injuries. But there is a settlement — ₹45,000, to be transferred via UPI — and if it is not cleared tonight, her daughter will be held until morning.
Her daughter was asleep in her hostel room, phone on silent. The call was built from six seconds of audio clipped from a WhatsApp Status she had posted three weeks earlier.
The short answer. AI voice cloning tools can copy a person’s voice from as little as three to six seconds of public audio, then use it in a fake “emergency” call to their family. The tools are cheap, legal, and easy to use. Two things stop the scam. First, a family code word that any distressed caller must give before you act. Second, a callback rule: hang up and reach the person on a number you already have. Reduce your exposure by keeping WhatsApp Status and social audio visible to contacts only.
How voice cloning actually works
Until recently, creating a convincing synthetic voice required hours of studio recordings and expensive engineering work. That window closed somewhere around 2022.
ElevenLabs, one of the most widely used commercial voice cloning services, can generate unlimited speech in a cloned voice from a 30-second audio sample. A subscription costs $5 per month and requires no technical background to operate. You upload audio, name the voice, and start typing text for it to speak. The output is available within minutes.
Other tools have pushed the threshold even lower. Microsoft’s VALL-E research model demonstrated convincing cloning from just three seconds of audio in 2023. Resemble AI, Murf.ai, and Speechify all offer commercial cloning with varying sample requirements. Retrieval-based Voice Conversion (RVC) is an open-source framework that enables real-time conversion. A scammer can speak into their phone and have their voice come out sounding like yours, live, during an active call.
The tools are not hidden. They are advertised, rated, and reviewed like any other software product.
The scam, step by step
A scammer identifies their target: a parent, grandparent, or spouse of someone whose voice is publicly available. WhatsApp statuses, Instagram reels, YouTube videos — any of these work. A six-second WhatsApp status clip is sufficient for basic cloning with most current tools.
They run the audio through ElevenLabs, create the voice clone, write a brief script. “I’ve been in an accident. I’m at the police station. Please, I can’t talk long, just help me.” The script is designed to be emotionally overwhelming enough to bypass critical thinking.
They call the family member and play the clone. The voice is correct. The panic is correct. The target’s brain — primed by years of knowing exactly what this voice sounds like — fills in every remaining gap.
A second scammer then takes over, playing a police officer or lawyer. This person handles the rational layer: the amount, the payment method, the urgency of doing it now and not calling anyone else. “She asked us not to worry anyone unnecessarily. Just get this sorted and she can call you herself in an hour.”
The money moves via UPI, NEFT, or gift cards. The call ends.
Where India sits in this threat
In 2024, Kerala Police documented multiple cases of voice-cloning scams targeting families with relatives working in the Gulf. NRI families already expect calls from abroad on unknown numbers — the social context for “a call from someone you love on a number you don’t recognise” exists before the scammer even dials.
WhatsApp is the attack surface. Voice notes and Status posts circulate openly; a clip posted in one family group and forwarded twice is now accessible to people the original speaker has never met. Bulk call centres in some states are experimenting with AI voice automation at scale — reducing the human effort required to run dozens of scam calls simultaneously.
This is not a new idea — AI just made it cheap
In 2019, fraudsters used AI-generated audio to impersonate the CEO of a UK energy company and authorise a €220,000 wire transfer to a Hungarian account. The subsidiary in the UK heard their German parent company’s CEO on the phone and complied. That attack required expensive, bespoke tooling.
In early 2023 in Arizona, a mother received a call in which she heard her 15-year-old daughter’s voice screaming for help. CNN and ABC News reported it as one of the first documented uses of consumer voice cloning tools in a virtual kidnapping scam. The same year, the FBI issued an IC3 advisory about AI voice cloning in kidnapping schemes, where ransom demands come before a family can reach the person supposedly in danger.
The audio artifacts that made early clones detectable — a slightly robotic cadence, unnatural pauses, flattened emotional range — are narrowing with every model update.
How to detect it in the moment
Voice clones have one structural weakness: they cannot answer questions they were not trained to answer.
Ask something only the real person would know — not a birthday or a middle name, but a specific shared memory, a private joke, the name of a childhood pet. Something that requires genuine recall. A clone playing scripted audio cannot do this. A real-time conversion system can attempt it but will stumble on specificity.
Alternatively, end the call and dial the person on their known number. The scammer cannot intercept an outbound call to your family member’s real phone. If she is actually at a police station, she will answer or call back within minutes.
Emerging tools like AI or Not (ainot.io) are building audio detection capabilities, though real-time phone call detection is not yet widely available to consumers.
What to put in place before a call like this comes
Set a family code word. One word that no one outside the immediate family knows. If anyone calls claiming to be a family member in distress, ask for the code word before acting. A scammer running a voice clone has no way to know it.
Call back before transferring anything. No legitimate emergency requires money before you can speak to the person on their actual number.
Limit public audio. Keep WhatsApp Status posts visible to contacts only. Avoid long voice clips on public social accounts. The scammer needs raw audio — limiting what is publicly available raises the barrier.
Brief your family. Older relatives are the primary targets. A five-minute conversation about how these calls work, and about the code word, is meaningful protection. For a full playbook, see protecting elderly relatives from AI voice scams.
Treat urgency as a red flag. Every element of this scam is designed to prevent you from thinking clearly. A caller who insists you cannot pause, cannot verify, cannot wait even one minute — that insistence is the manipulation.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.