Ghost Signal: AI Voice Cloning Threats and Protecting Your Family From Digital Fraud

Pace: On a Wednesday in July of last year, Sharon Brightwell picked up her phone in Dover, Florida and heard her daughter crying. She was hysterical. She said she'd been texting while driving and had hit a pregnant woman. The police had taken her phone, she was in serious trouble, and she needed help. And then a man came on the line. He said he was April's public defender. She was being held. Bail was $15,000. And it had to be cash. He gave Sharon very specific instructions, including this one. Do not tell the bank what the money is for, because it could affect your daughter's credit. So Sharon went to the bank, withdrew $15,000, and handed it to the courier who came to her house to pick it up. And then the phone rang again. The pregnant woman had lost her baby. The family of that woman, the caller said, was willing to drop their lawsuit, but it would cost another thirty thousand dollars cash. And that second call is where this whole thing came apart. Someone in the family sensed something was off. And they got the real April on the phone. She was at work. She had been at work the entire time. She had not been in an accident. She had not been arrested. And she had never made that call. Here's what Sharon told reporters after this incident. She said, there is nobody that could have convinced me that it wasn't her. I know my daughter's cry. And she was right, she did know her daughter's cry. And that's exactly what the attackers were counting on. The voice on the phone was an AI clone built from the kind of short audio clip most of us have sitting on social media accounts right now. Today we're talking about how AI broke one of the oldest trust signals that we have. The sound of a voice that you know. And the simple protocol that beats it for free. I am Alan Pace and this is the Opsec podcast. The threat that we're talking about today is called social engineering. Social engineering is as old as lying. Con artists, spies, and scammers have always worked the same angle. Get a person to trust you, then get them to act against their own best interests before they stop to think. What held that back was the skill involved in working the person. A convincing con took research, practice, and a good ear. Impersonating a specific person's voice was close to impossible. Writing a believable message in someone else's voice took real effort, and most scammers didn't bother. Which is why for years the advice was simple. Look for the typos, the strange grammar, the broken English, the stranger with an urgent request. AI has removed that skill requirement. The research, the writing, and the voice can all be automated now. And here's what that looks like in numbers. Back in 2023, McAfee's research found that three seconds of audio was enough to produce a voice clone with roughly an 85% match to the original. The same survey found that one in four adults had either experienced an AI voice scam or knew someone who had, and 70 percent. weren't confident that they could tell a cloned voice from the real thing. And the tools have only gotten better. In March of 2025, Consumer Reports tested six of the major commercial voice cloning services. Four of them had no meaningful technical check to confirm that the person whose voice was being cloned had agreed to it. In most cases, opening an account took a name and an email address. And even the FBI has taken notice. In April of this year, the Internet Crimes Complaint Center released its 2025 report. And for the first time in its roughly 25 year history, it included a section on artificial intelligence. More than 22,000 complaints tied to AI, And close to $893 million in reported losses. Americans over 60 lost $7.7 billion to online fraud last year across all categories, up 37% from the year before. And those are only crimes that got reported. A lot of victims never file because they're embarrassed. So the old advice about spotting typos is now dead. Worse, it's now dangerous because it teaches people to trust anything that looks polished. Now I want to talk through how one of these attacks actually comes together. Because once you see the assembly line, the defenses make a lot more sense. It starts with reconnaissance. The attacker needs to know three things. Who you are, who you trust, and what story would make a request from that trusted person believable. Most of that is sitting in the open. Your social media shows your family members, their names, their faces, and often their voices. People search sites, sell your phone number. your address, your relatives, and your age for just a few dollars. Data breaches supply your email addresses, personal information, and sometimes the answers to your security questions. What used to take a private investigator weeks now takes AI software a few minutes. And what comes out of this is a detailed profile of you and the people around you. Next comes the story. The attacker picks a pretext that fits the profile. For a retired couple, it's a grandchild in trouble. For someone who's posted about a new job, it's the HR department or IT onboarding for that company. For anyone with a bank account, which is everyone, it's the fraud department. An AI model writes the script in clean, natural language that sounds like a real person who knows your life. Next comes the voice. If the story needs someone you know, the attacker pulls audio from a public video, often a social media clip that seemed harmless at the time, and feeds it into a cloning tool. A few seconds of someone's voice gets them started. 30 seconds gets them something very hard to question, especially over a bad phone line. and especially when the person on the other end is hysterical or crying. Then they stack the channels. A text message arrives first to set the scene. A call follows. A second person comes on the line, a lawyer or a police officer or a bank investigator to add authority. When the same story reaches you through more than one channel, Your brain reads that consistency. as confirmation, even when it's one crew running two phones. And last is the pressure. Every one of these attacks has urgency inserted into it. Bail has to be paid now. The account will be frozen in an hour. Don't hang up. Don't tell anyone. That urgency is the load-bearing wall that the whole operation rests on. The attack only works if you stay inside the conversation that the attacker controls long enough to act before you verify. Hold on to that last point. Nearly every defense I'm going to give you is some version of stepping outside of that conversation. Let's talk about the three plays most people see. There are dozens of variations, but for everyday people, three plays do most of the damage. The first is the family emergency. And that's Sharon's story. And it's the old grandparent scam upgraded with a cloned voice. A son, a daughter, or a grandchild Calls in a panic about an accident, an arrest, or are in the hospital. Then a second voice takes over to handle the money because the family member is conveniently too upset to talk. The payment is almost always something hard to reverse. Cash handed to a courier, a wire transfer. bank cards or cryptocurrency. The courier is a detail worth noticing. In Sharon's case, somebody physically showed up to her house. These crews were organized enough to put people on the ground. The second is the call from your bank. Someone calls sounding exactly like a fraud department employee. They have your name, maybe the last four digits of your card or your social security number, maybe your address, all pulled from data breaches or people search websites, data brokers of some kind. They tell you that there's suspicious activity on your account, and to protect you, they need to verify your identity. So they're sending you a code with the instructions to please read it back to them. What's happening on their end is that they're logging into your account at that moment, and the code is your multi-factor authentication code. The second you read it to them, they have the keys. AI makes this play smoother because the caller can sound calm, professional, and local. The mechanics are old, though, so is the defense. Your bank will never call you and ask you to read a bank code they just sent you. No legitimate bank will ever do that. The third is the message that knows your life. It's a text or an email that uses your real name, mentions your real employer, your kid's real school, references something you actually posted, and asks you to click, pay, or log in. Researchers at Harvard tested this directly in a study released at the end of 2024. Phishing emails written entirely by AI, using information scraped from public sources about each person, got a 54% click rate. The generic emails in the control group got 12%. The AI performed as well as human experts. And the security training company, Know Before, reported last year that 82.6% of the phishing emails it analyzed over a six-month period showed signs of AI use. The message that used to give itself away with broken English now reads like it came from someone who knows you. And in a sense it did, because it was built from what you and the people around you put online. Voice is the most common weapon right now, but video is already in play and becoming more and more common. In January of 2024, an employee in the Hong Kong office of a company called ARUP, the British engineering firm, got an email that appeared to come from the company's chief financial officer in the UK. It asked for a confidential transaction. The employee was suspicious. It looked like fishing, and he was right. Then he was invited to a video call. The CFO was on it, along with several colleagues he recognized, faces and voices that he knew. Every one of them was a deep fake. Hong Kong police said afterwards that the attackers most likely took existing video from those people and used AI to add fake voices. Over that call, in the days that followed, the employee made 15 transfers to five different bank accounts, totaling over 25 million US dollars. It was roughly a week before he checked with headquarters and found out it was a scam. Take another look at that order of events. His instincts worked. He flagged the email as suspicious. What overrode those instincts was seeing familiar faces, and the video call was built specifically to kill his doubt. But this problem goes well beyond corporate money. In May of twenty twenty five, the FBI warned that attackers were sending texts and AI generated voice messages, impersonating senior US government officials. In July, Someone set up a signal account with the display name Rubio at state.gov and then used an AI clone of Secretary of State Marco Rubio's voice to contact three foreign ministers, a US governor, and a member of Congress. In December, the FBI warned that the campaign was still running. And in that warning, The FBI's advice to the public included this line. Create a secret word or phrase with your family members to verify their identities. Keep that in mind, because now I want to tell you about one that failed. In 2024, an executive at Ferrari started getting WhatsApp messages from someone claiming to be the CEO, Benedetto Vigna, about a big confidential acquisition. Then came the call. The voice had Vigna's Southern Italian accent and sounded right. But the executive picked up on something. a slight mechanical quality of the voice, and instead of going along with it, he said he needed to confirm who he was talking to. He asked about the book Vigna had recommended to him a few days earlier. The collar hung up. No detection software, no forensic analysis, one question the attacker couldn't answer because the answer had never been posted anywhere. That move is the heart of this episode, and the rest of it builds on that idea. Every attack I've described runs on raw material, and most of that raw material gets published voluntarily. McAfee found that more than half of adults share their voice online at least once a week. Think about what that means for your family. Your kids' TikToks, your dad's Facebook videos from the lake house, the birthday video where your mom says your name in her normal voice. Your own voicemail greeting, which anyone can hear just by calling your phone. Every one of those is a voice sample. The same goes for the story. A public post about a trip tells an attacker when you're away, where you went, and when a family emergency would be hardest for relatives to verify. Tagged photo of your grandparents connects them to you by name. A post celebrating your kid's new driver's license sets the car accident story almost word for word. There's nothing reckless about any of this. it's ordinary life lived in public, which is exactly why it works so well as actionable intelligence for attackers. In military and intelligence work, there's a discipline called emissions control. Every radio transmission and every signal that you put out can be detected, located, and exploited by whoever is listening. So you transmit only what you need to when you need to. You assume someone is always listening because someone usually is. The civilian version of this is simple. Everything you and your family post publicly is a transmission. You don't control who receives it, and you don't control what they build from it. That doesn't mean going dark. It means making deliberate choices about what goes out and paying special attention to the people in your life most likely to be targeted. Your parents. Grandparents, and the kids whose voices would be used against them. So what can you actually do? Most of it is behavioral and most of it is free. First, set up a family safe word this week. This is the single most effective defense against a cloned voice. And the FBI now recommends it by name. Pick a word or a short phrase with your immediate family. It should be something that has never appeared online, can't be guessed from anything public, and is simple enough to remember when you're scared. Agree on it in person, not by text or by email. The rule is absolute. Anyone calling about an emergency and asking for money or action gives the word first. No word, no action. AI can clone a voice from a video, but it can't clone a word that has never been recorded anywhere. If a safe word feels awkward for some relatives, use the Ferrari move instead and ask about a shared memory only the real person would know. Never a fact that sits in a public record or a security question. Next tactic is hang up and call back. Any call, text, or message involving money, codes, passwords, or a sense of urgency gets verified on a separate channel that you start. Hang up, then call the person back on the number you already have saved in your phone. For your bank, call the number on the back of your card. Don't use a number they gave you, don't reply to the text, and don't hit redial. This one habit breaks almost every attack in this episode because it takes you out of the conversation that the attacker controls. Next, treat urgency as the warning. Make a family rule and say it out loud to the people that you love. If anyone pressures you to act right now, that is the signal to slow down and verify. A real emergency survives two minutes of checking. Next, never read a code to someone who called you. no bank, no government agency, and no tech support line will ever call you and ask for a code that was just texted to you. If that happens, it is an attack. It is a scam. Hang up. Next, consider putting a hardware key on most of your important accounts. A code can be talked out of you. A hardware key, like a Yuba key, can't be read over the phone, and it confirms it's dealing with the real website before it works. Use one on your primary email, your password manager, and your financial accounts. Ubico's website walks you through the setup. Next, shrink your family's voice footprint. Set social media accounts to private, especially for older relatives and kids. Think twice before posting videos where someone speaks clearly for more than a few seconds. Swap your personalized voicemail greeting for the default system greeting. Post trips after you get home, not while you're gone. And finally, brief the people most likely to get these calls. Have the direct conversation with your parents and your grandparents or your children. Tell them Sharon's story. Tell them the scammer might sound exactly like you, might be crying or hysterical, might put a lawyer or a police officer on the phone. And then give them the rule. Ask for the word. Hang up. Call back. General warnings about scams tend to evaporate when the phone rings and the person on the other end is screaming or crying. A specific protocol holds up, or shameless plug, you can just listen to this episode with them so that you don't have to do all of the explaining. So let's close this out for today. Sharon Brightwell did what any loving parent would do. She heard her daughter crying, she believed that she was in a crisis, and she moved fast. The attackers designed the entire operation to get ahead of her judgment, and they did. For your whole life, a familiar voice has been proof of identity. a familiar face on a screen was even more verification. Anyone with a few seconds of audio and a cheap AI account can now fabricate both. That doesn't mean that you can't trust anyone. It means trust needs to have a protocol. In military operations, you don't accept an order over the radio because the voice sounds like your commander. You authenticate. There is a challenge and a response, and if the response is wrong, the transmission is treated as as hostile, no matter how familiar it sounds. A family safe word is the same idea brought into your everyday life. It doesn't depend on recognizing a voice or a face. It depends on a shared secret that lives in your head and in the heads of someone and in the heads of the people that you love and nowhere else. The Ferrari executive showed it works against a well-organized attack. Sharon's story shows what it costs. When it isn't there. So here's your assignment. This week, sit down with your family in person and pick a challenge word. Call your parents, walk them through the rule, then change your voicemail greeting while it's on your mind. takes about twenty minutes and it closes the door that three seconds of audio keeps open. All of the resources from this episode are in the show notes. Thank you for listening to the OPSEC Podcast. Don't forget to subscribe and follow us on socials. All of our links can be found on our website, OPsecPodcast.com. And if this episode earned its value, lock in the habit. Follow and subscribe wherever you're listening so that you never miss a drop. And sign up for our newsletter at opsecpodcast.com to get the latest tools and tradecraft straight to your inbox. Subscribing is one of the easiest ways to help this podcast succeed. And tell your friends and family members about us as well. We're not doing any sponsors or paid advertisements at this time, and we would like to keep it that way. So spread the word. I am Alan Pace and remember your privacy and your security is your responsibility.