Addaly is in open beta. Things will change, and AI answers can be wrong — check anything that matters.

Making Things With AI

Images, video, voice and music — how they work, where they break, who owns them.

Lesson 57 of 848 min

The fraud that already happens

Two patterns, both documented

The family emergency. A call from a relative's voice: an accident, an arrest, a hospital, an urgent need for money and a request not to tell anyone else. The voice is right. The details are right, because they are on social media. The caller is under time pressure and asks for a transfer, a gift card code, or a courier.

The corporate instruction. A call or video call from a senior colleague's voice authorising an urgent payment or a change of bank details. The largest reported cases of this kind have involved multi-million-pound transfers, including a widely reported incident in which an employee joined a video call populated entirely by synthetic colleagues and made a series of transfers.

Neither pattern is new. Both are decades-old confidence tricks. What has changed is the cost of making the voice convincing, which has fallen to nearly nothing, and the availability of samples, which is total.

The script, and why naming it helps

Every version of this contains four elements:

  1. Urgency. A deadline measured in minutes.
  2. Authority. Someone whose instruction you would not normally question.
  3. Secrecy. A reason not to check with anyone else — a confidential deal, an embarrassment, a legal restriction.
  4. An irreversible transfer. Bank transfer, cryptocurrency, gift cards, cash to a courier.

Teach those four to anyone you care about. Recognising the shape is more robust than recognising the voice, because the shape does not improve with the technology. Any request containing all four is fraudulent, whoever appears to be making it, and there is no legitimate business or family situation in which all four genuinely apply.

The four elements, and the control that defeats all of themUrgencyA deadline measured in minutes, so there is no roomto think.AuthorityA voice whose instruction you would not normallyquestion: a child, a chief executive.SecrecyA reason not to check with anyone else — aconfidential deal, an embarrassment, a legalrestriction.An irreversible transferBank transfer, cryptocurrency, gift card codes, cashto a courier.Call back on a number you already hadNot the number that called. This works whatever thevoice sounds like, which is the point: it makes theattacker's capability irrelevant instead of tryingto out-run it.Any request carrying all four is fraudulent, whoever appears to be making it. There is no legitimatefamily or business situation in which all four genuinely apply, and recognising the shape does notexpire the way recognising a voice does.
The four elements, and the control thatdefeats all of themUrgencyA deadline measured in minutes, so there is noroom to think.AuthorityA voice whose instruction you would not normallyquestion: a child, a chief executive.SecrecyA reason not to check with anyone else — aconfidential deal, an embarrassment, a legalrestriction.An irreversible transferBank transfer, cryptocurrency, gift card codes,cash to a courier.Call back on a number you already hadNot the number that called. This works whateverthe voice sounds like, which is the point: itmakes the attacker's capability irrelevantinstead of trying to out-run it.Any request carrying all four is fraudulent, whoeverappears to be making it. There is no legitimatefamily or business situation in which all fourgenuinely apply, and recognising the shape does notexpire the way recognising a voice does.

The controls, in order of value

A family safe word. Agreed in person, never shared electronically, never used except in this situation. It costs a two-minute conversation and it ends this attack completely for the people you love. Do it this week. Choose something a stranger could not guess and a relative under stress could still remember.

Call back on a known number. The single most effective control and the most frequently skipped, because hanging up on a distressed relative feels wrong. Say plainly: "I am going to call you straight back on your usual number." A genuine caller will wait. This is worth rehearsing as a sentence, because in the moment people find it hard to say.

Dual authorisation for payments. No single person can move money or change payee details on one contact. This is standard financial control and it defeats the corporate case outright.

A written policy that says voice and video are not authentication. Explicit, so that a junior member of staff refusing a chief executive's instruction is following policy rather than risking their job. This is the part organisations get wrong: the technical control exists and the social pressure defeats it. Make refusal the safe option.

Reduce the sample surface, marginally. Voicemail greetings in a generic voice, care with public video. This helps a little and it is not a defence, for the reasons the voice-print lesson gave. Do not mistake it for one.

For the people most at risk

Older relatives are targeted disproportionately and the reason is not gullibility. It is that the attack exploits exactly the impulse to help a grandchild in trouble, and that is not a defect.

The conversation that works is not "be careful of scams". It is concrete: agree the safe word, agree that you will always be able to call back, and agree in advance that hanging up to check is a normal thing to do and will never cause offence. Removing the social cost of checking is the whole intervention.

What to do if it happens

Stop the transfer immediately with the bank — recovery is sometimes possible in the first hours and rarely afterwards. Report it to the national fraud reporting body. Keep the call details and any recording. Tell other people, because the same attacker works through a contact list, and because the shame that stops people reporting is precisely what makes the pattern profitable.

The honest note to end on: none of this depends on anything about how these systems work. It is old advice, made newly urgent by a capability that is now cheap and cannot be recalled. The technical chapters of this course explain why detection will not save anyone. This lesson is the part that actually protects people, and it costs nothing to put in place.

The one thing to keep

Voice-impersonation fraud follows a fixed script — urgency, authority, secrecy, an irreversible payment — and the control that defeats it is an out-of-band check, which works regardless of how convincing the voice is.

Before you move on

Why does an out-of-band callback defeat voice-impersonation fraud regardless of how convincing the clone is?

Pick the one you would defend. Nobody sees your answer.

No ads. No data sale. No public scores on people. Ever.

© 2026 Addaly

The fraud that already happens · Making Things With AI · Addaly