Your voice can be copied in 3 seconds; the FBI confirms that AI scams are surging: the blame lies with institutions, not the grandma

AI voice cloning can produce convincing fakes with just a 3-second recording. For the first time, the FBI has classified AI scams as a standalone category of crime. In one year, losses are nearly $900 million, and more than one-third of the victims are people aged 60 and over.
(Background context: Musk’s xAI launched “Extreme Speed Voice Cloning” — Custom Voices: natural speech in 1 minute to build a personalized Grok voice)
(Additional background: China’s AI scam cases—face swapping and voice-changing during video calls, stealing NT$15k in just 10 minutes)

Table of contents

Toggle

• Three seconds—one checkmark
• Don’t teach Grandma to doubt the grandson’s voice
• Make institutions hurt, and they’ll build walls

When the sobbing voice of her daughter came through the phone, Sharon Brightwell, a retired elderly woman in Dover, Florida, had already lost all her defenses. In the summer of 2025, she heard her daughter April crying, saying she had been in a car accident and was detained by the police; then a “lawyer” came online, demanding $15k for bail, and warning her not to tell the bank what the funds were for.

She did. Until she got in touch with her daughter, who was actually working and had never been in a car accident. Only then did she realize: the crying voice on the phone, the tone, the rhythm of breathing—everything came from a machine. And replicating all of it only required a 3-second recording.

In April this year, the FBI’s IC3 released its 2025 annual report. For the first time in 26 years, it categorized “AI-related scams” separately: more than 22,000 complaints and adjusted losses exceeding $893 million. Among those victims, $352 million were from the 60-and-over group. Internet crime losses in the U.S. surged by 26% in one year; and for the 60-and-over group, losses totaled $7.7 billion, up nearly 60% year-over-year.

Even the FBI admits this is “floor pricing,” because most victims don’t even know that the person they talked to was an algorithm. Interpol’s statistics are even more startling: in 2025, global financial fraud losses reached $442 billion—equivalent to Denmark’s entire annual GDP. With AI added, scams earn 4.5 times more than traditional methods.

Three seconds—one checkmark

The technical threshold is so low it’s almost zero. A voice mailbox message, a birthday video, a single TikTok—anything like that is enough to feed a voice cloning model.

Last year, Consumer Reports tested six tools: Descript, ElevenLabs, Lovo, PlayHT, Resemble AI, and Speechify. It found that most lacked meaningful anti-abuse mechanisms; among the six, four allow users to generate voices by simply ticking a box saying “I have the right to clone this voice,” with no verification required. ElevenLabs is relatively more rigorous, with multi-layer protections such as a classifier, traceable records, and blocking specific people’s voices—but these mechanisms are mostly detective controls after the fact. By the time protections kick in, the voice has already been copied and the call has already been placed.

Worse still, even human experts who specialize in detecting synthetic speech can’t keep up. Hany Farid, a professor at UC Berkeley and widely recognized as the world’s strongest deepfake forensics authority, admitted in a June interview with The New York Times that he couldn’t even pass his own tests: “I think I’m going blind.”

Don’t teach Grandma to doubt the grandson’s voice

The targets are the elderly—not because they’re dumb, but because they’re the most efficient target set: they have high account balances, they treat phone calls as an extension of the real world, they know almost nothing about voice-cloning technology, and their love for family is the one weakness this scam is trying to exploit.

Amit Gupta from voice security company Pindrop said plainly: “The goal isn’t to perfectly replicate a voice, but to create enough emotional uncertainty and urgency so the victim acts before verifying.” Philadelphia attorney Gary Schildhorn was also taken in. Afterward, he said, “I will swear until the day I die that it was your voice.” Even a trained attorney—someone whose job is to question evidence—was fooled. How could it be different for a grandmother who heard her grandson’s cries of “I’m being kidnapped”? In Liz Benz’s description in Buffalo, it was “a full twenty minutes of terror.”

A report from the FTC in December last year said scam losses reported by people aged 60 and over increased by nearly 4 times between 2020 and 2024, reaching about $2.4 billion. Of that, 68% came from individual losses exceeding $100k. If unreported “black numbers” are included, the FTC estimates the real annual losses could be as high as $81.5 billion.

The most common advice in the industry right now is for the whole family to agree on a safety code in advance: if the caller can’t produce it, hang up. The intent is good—but it effectively hands the responsibility for intercepting an entire industrialized scam supply chain to an elderly person who’s teetering on the edge of collapse.

Make institutions hurt, and they’ll build walls

That is the essence of asymmetry. Baoshu of Adaptive Security, CEO Bozhu, put it precisely: “One person typing on a keyboard can create unlimited attackers.” Automated systems can produce scam calls at near-zero cost. Meanwhile, the defender is just one frightened elderly person, and only has the time of a single phone call.

The only approach proven effective is the bank side. Since October 2024, the UK’s Payment Systems Regulator (PSR) has required banks to fully reimburse victims for authorized push payment fraud, with both the sending and receiving banks paying half each, capped at £85k. After the rule took effect, the reimbursement rate for scammed funds rose from 65% in the past to 89%. The logic is straightforward: once banks have to pay for fraud, they have incentives to block large cash withdrawals, impose cooling-off periods for older customers, and have tellers make an extra call to confirm.

EU AI Act-related obligations have begun taking effect from 2025 through 2026, and Tennessee’s ELVIS Act in the U.S. also requires written consent before voice cloning. Regulation always lags behind technology. Making institutions responsible for what they handle is the only solution that can stand up to verification.