AI voice cloning scam what it is and how it works

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Digital evidence

An AI voice cloning scam is a telephone fraud in which the caller plays, or speaks through, a synthetic copy of a real person's voice. The person copied is usually someone the victim knows and trusts: a son or daughter, a nephew, a business partner, a manager or a doctor. The voice asks for money urgently, for a hospital deposit, a stuck consignment, an accident settlement or a tax demand, and it asks the victim to transfer funds to an account the real person does not own.

The legal character of the act is not in doubt. Inducing a person to part with money by pretending to be someone else is cheating by personation under Section 319 of the Bharatiya Nyaya Sanhita, 2023, and the underlying deception is cheating under Section 318. Because the impersonation is carried out with a computer resource and a communication device, Section 66D of the Information Technology Act, 2000 applies as well, and Section 66C applies where the cloned voice is used to obtain another person's credentials or identification data.

What voice cloning actually is

Voice cloning is a form of speech synthesis. A model is trained on recordings of a target voice and then generates new speech in that voice from typed text. The training material does not need to be a studio recording. A voicemail greeting, a video on a public profile, a podcast segment, a wedding speech uploaded to a family group, or a recorded customer-service call can all supply enough audio. Once the model is trained, the fraudster types a script and the output sounds like the real person reading it.

What the clone can do is narrow but sufficient. It reproduces timbre and accent well, and it handles short sentences convincingly. It struggles with long, unscripted conversation, with unusual names, and with emotional nuance over an extended call. That is why the scripts are short, why the caller creates a reason to get off the phone quickly, and why the call often ends with an instruction to transfer money and a promise to call back. The technology is good enough for thirty seconds of pressure, not for a ten-minute discussion.

Software that claims to detect a cloned voice should not be relied on. Detectors work on specific models and specific artefacts, and each new model changes the artefacts. A detector that reports a file as synthetic is useful evidence, but a detector that reports a file as genuine proves little, because it may simply be testing a model it has not seen. The practical protection is procedural, not technological.

This is also why the fraud is cheap to run. A single cloned voice can be reused across many targets, and a call centre can run dozens of these calls at once. The economics explain the volume of complaints far better than any claim about how sophisticated the tools are.

Why this scam is spreading

Three things have changed at once. Large volumes of personal audio are now published voluntarily, because people record greetings, post videos and join group calls that capture their voice. Cheap computing has made training a model routine rather than a research project. And instant payment rails move money in seconds, so a victim who acts on an emotional instruction has often completed the transfer before doubt arrives.

The fraud also feeds on the way families and offices communicate. A parent who receives a call from a child in distress does not run a verification checklist; a junior employee who receives an instruction from a manager does not ask the manager to prove identity. The scam does not defeat security systems. It borrows the trust that people have already placed in a relationship, and it uses the phone network to deliver that borrowed trust instantly.

How the scam runs, stage by stage

1. Collection. The fraudster gathers audio of the target from public videos, social media, voicemail or an earlier recorded call. The same exercise collects the victim's name, relationship and daily routine from the same profiles.
2. Selection. The victim is chosen because a transfer from that person would look ordinary: a parent sending money to a child, an assistant paying a supplier, a junior employee following a manager's instruction.
3. The call. A spoofed number or an unknown number is used. The cloned voice opens with a familiar greeting and a plausible crisis, and refuses to answer detailed questions on the ground that the line is bad or the person is in a hurry.
4. The instruction. The victim is given an account number, a UPI ID or a request to install an app. The urgency is designed to prevent a call-back to the real person.
5. The transfer. The money moves to a mule account and is split within minutes. The fraudster may ask for a second transfer with a fresh excuse.
6. The silence. The number stops answering. The real person, when finally reached, knows nothing about the call.

The tells that survive the cloning

No single test is reliable, but a cluster of small oddities usually appears:

• The voice is recognisable but the rhythm is slightly flat, with pauses in unexpected places.
• The caller avoids saying your name in the way the real person normally would.
• Background sound is either absent or loops in a way that sounds recorded.
• The caller refuses a video call or an instant call-back, citing network trouble.
• The request is for an urgent transfer to a new account, or through an app you have never used for that person.
• The conversation cannot survive a question only the real person could answer.

The single most effective countermeasure is procedural rather than technical: end the call and dial the person back on the number already saved in your phone. A cloned voice cannot answer that number. Fraudsters know this, which is why the script insists on secrecy and speed.

What the law says

Under the Information Technology Act, 2000, Section 66 covers computer-related offences, Section 66C covers identity theft, Section 66D covers cheating by personation using a computer resource or communication device, and Section 66E covers violation of privacy where a private image or recording is captured and transmitted without consent. Where the cloned voice is used to obtain a password or an OTP, Sections 66C and 66D are both engaged.

Under the Bharatiya Nyaya Sanhita, 2023, the relevant sections are cheating under Section 318, cheating by personation under Section 319, criminal breach of trust under Section 316 where a person entrusted with property betrays that trust, forgery under Section 336 where a false document or record is created, and criminal intimidation under Section 351 where a threat accompanies the demand. Where a cloned voice is used to defame, Section 356 applies.

On procedure, the Bharatiya Nagarik Suraksha Sanhita, 2023 governs. Section 173 provides for the FIR, including an electronic FIR and a zero FIR. Section 175(3) allows a Magistrate to direct an investigation where the police decline. Section 35 requires notice of appearance before arrest in offences punishable with less than seven years, and Section 482 preserves the High Court's inherent powers. The audio file and the call detail record are electronic records under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023.

The banking layer is the Reserve Bank of India's directions on limiting customer liability in unauthorised electronic transactions. A transfer that the customer keyed in is not automatically the customer's loss, because the inducement is the cause. Prompt written reporting is what keeps the customer's share of the loss low.

Where the money goes

Voice cloning scams follow the standard mule chain. The first account belongs to a recruited account holder, often a student or a small trader who has rented out the account for a commission. From there the funds are split across second-layer accounts and withdrawn or converted. The freeze request from 1930 has to reach the first account before that split happens, which is measured in minutes rather than days.

What each stage looks like to the victim

What decides the outcome

Whether money comes back depends on how fast the freeze is requested and how much of the chain is still intact. Whether a prosecution succeeds depends on linking the receiving account to a person and linking the call to that person. The audio file is useful, but a cloned voice is not a voiceprint of the accused, so investigators rely more on the account trail, the device identifiers and the messaging accounts used to send instructions.

For the victim, the practical question is what to preserve. The call detail record gives the number, the duration and the time, and it survives even if the phone is reset. The audio file, if recorded, should be kept in its original format. The bank statement gives the receiving account and the reference number. Together these three documents let an investigator move without needing the victim to remember details under pressure.

The bank's decision turns on the same question as in other authorised-push frauds: did the customer's own conduct cause the loss? A customer who transferred money after a call was deceived, not negligent in the ordinary banking sense. But a customer who ignored an in-app warning about a first-time payee gives the bank an argument. The strength of that argument varies with what the app displayed at the moment of payment.

One point is genuinely unsettled. Whether a telecom operator or a platform bears any liability for carrying a spoofed call is not resolved in Indian law, and complaints usually proceed against the account holders and the persons behind them rather than against the carrier.

Common mistakes

• Calling back on the same number instead of the saved contact, which reconnects to the fraudster.
• Deleting the call log before noting the number and the time.
• Transferring a second amount because the first was described as insufficient.
• Reporting to the bank days later, after the mule account has been emptied.
• Assuming a voice recording is proof on its own, and not preserving the call detail record.
• Keeping the incident secret from family, which allows the same model to be used on them.

When to involve a lawyer

The first report does not need a lawyer. Legal help becomes useful when the bank disputes the claim, when the police do not register the FIR, when a Section 175(3) direction is needed, or when the money must be recovered through a civil suit. A cyber crime lawyer in Kolkata can prepare the complaint, the bank representation and the recovery plaint as one consistent record. If a complaint has been filed against you instead, read our page on criminal defence, and for the wider picture see the cyber law blog.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Mutual fund scam: what it is and how the fraud runs
• KYC Update Scam: What It Is and How It Works in India
• How to recover money lost to an AI voice cloning scam
• Fake website scam: what it is and how it works

Cyber crime lawyer in your city · Bank account freeze help · Contact