The Rise of Fake Voices: How AI Is Tricking Ordinary People and Big Companies?

In the 21st century, the simple act of answering a phone call from a loved one crying out for help has become a dangerous gamble. If someone receives a call in the exact voice of their family member begging for financial support, their natural instinct is to help. Later, that instinct turns into bitter regret. Hackers are no longer just breaching firewalls; they are running software that can mirror anyone’s voice to break into personal accounts, confidential documents, and corporate networks. Voice is no longer trust or authentication. Artificial intelligence has transformed our human voices into digital keys that criminals can copy as easily as a duplicate car key.

A person’s voice used to be an unmistakable mark of identity and trust. Today, an attacker needs as little as 30 seconds of audio scraped from a social media video to create a startlingly realistic voice clone. Relying on voice alone for identity verification is no longer a viable option.

While technical exploits remain the primary vector for system breaches, Mandiant reports that highly interactive voice phishing or “vishing” recently surged to become the second most observed intrusion vector, accounting for 11% of all corporate breaches. The rise in voice phishing attacks and their terrifying efficacy is a direct result of rapid advancements in AI voice cloning. In April 2026, the cybercriminal group Shiny Hunters used a sophisticated vishing scam to breach Charter Communications and compromise 4.9 million records. The scam tricked an employee into granting the attackers access to a Microsoft Entra account, which served as the master key to Charter’s internal systems.

Most victims—whether everyday citizens or multinational conglomerates—get hacked the moment they start trusting. Over Easter weekend in 2025, the IT help desk for Marks & Spencer received a routine call from someone claiming to be an employee who needed their credentials reset. The caller was convincing, and the help desk operator, managed by third-party provider Tata Consultancy Services, obliged. The attackers were inside before anyone realized what had happened.

The breach went undetected for months. By the time M&S suspended online orders on April 25, ransomware had encrypted critical systems across 1,049 stores. The consequences were catastrophic: an estimated £300 million loss in annual profit, a market capitalization drop of over £500 million, and an online sales outage that lasted 46 days. There was no zero-day exploit and no malicious email attachment—just a single phone call to an unprepared help desk agent.

Vishing has rapidly escalated into the fastest-growing cyber threat in the modern landscape. CrowdStrike reports reveal that phone-based reconnaissance scans have surged by over 400% in recent years, while fake voice fraud attempts have skyrocketed by a massive 1,300%. Criminal syndicates like Scattered Spider are deploying these exact human-centric tactics to siphon millions from global enterprise targets.

This environment has left everyday people vulnerable to fake bank representatives and government impostors, while phone lines are inundated with roughly 150 million unwanted spam calls every single day. The sophistication of these operations was starkly demonstrated when a finance worker at Arup approved a $25 million wire transfer following a video call. The CFO was on the screen, alongside several senior executives. Every face and every voice was a deepfake, rendering the deception completely invisible to the employee. Fortune’s 2026 analysis confirmed the core reality behind that incident: the average human listener can no longer reliably distinguish a cloned voice from a real one.

Regulatory and security frameworks are scrambling to adapt. In February 2026, New York’s Department of Financial Services issued the first state-level regulatory advisory specifically addressing voice phishing as a distinct, regulated risk category rather than a mere subcategory of general phishing. This followed a formal FBI advisory highlighting AI-generated voice messages targeting U.S. government officials, while Mandiant’s M-Trends 2026 executive edition explicitly called for standalone defensive strategies dedicated to help desk vishing.

Today, organizations are spending millions of dollars building defenses for the wrong battlefield. While companies flood money into training employees to spot fake emails, hackers have moved on to voice cloning. They hack through trust because they know it remains the ultimate back door into any system.

Moving forward, whenever a person receives an urgent call demanding help, money, or access, no matter how familiar the voice sounds, the only safe response is to hang up and verify the claim through a trusted, independent contact channel. In an era where AI can imitate anyone, unverified trust is a liability that can no longer be afforded.

The opinions shared in a piece of writing are the author’s own and do not necessarily reflect the views of any organization.

The author is a student at the Cyber Security Program, Institute of Regional Studies, Islamabad

Advertisement