AI scams: cloned voices, fake relatives, how to stay safe
How AI voice-cloning scams work based on real cases handled by Spain’s INCIBE, the warning signs, the “family code word” and what to do if it happens (017 in Spain).
AI has made old scams more convincing. The most common by phone: a voice identical to a relative’s asking for urgent money. It’s not science fiction: Spain’s INCIBE 017 helpline has published several real cases.
How it works (real INCIBE cases, in Spanish)
- Fake medical emergency. A woman got a call from someone claiming to be medical staff: her daughter needed urgent surgery. Then they “put her daughter on”, with an identical, crying voice. Before paying she called her daughter’s real number and learned it was a lie (INCIBE case).
- A few seconds are enough. INCIBE explains AI tools need only a few seconds of recording to imitate a voice, for instance captured during silent calls (case).
- Against businesses. A shop’s customers got calls in the owner’s voice asking them to pay into a different bank account (case).
Warning signs
- Rush and fear: “right now”, “don’t tell anyone”.
- Unknown number or different from usual.
- Unusual payment: instant transfer, new account, gift cards, crypto.
- Silent calls in the days before.
What to do (INCIBE guidance)
- Don’t follow instructions. Hang up and call the usual number yourself.
- Don’t give personal or bank details to strangers.
- Family code word: agree a password for emergencies.
- Block and report the number to the police.
- In Spain, call 017: free, confidential, 8:00–23:00 every day (Tu Ayuda en Ciberseguridad).
If you’ve already paid, call your bank immediately and report it. For fake videos and images, see how to spot deepfakes.
Frequently asked questions
How much voice do they need to clone it?
INCIBE explains that with AI tools a few seconds of recording are enough to generate audio impersonating a voice.
What is 017?
INCIBE’s “Tu Ayuda en Ciberseguridad”: Spain’s free, confidential national helpline, daily from 8:00 to 23:00, also on WhatsApp (900 116 117) and Telegram (@INCIBE017).
What if they impersonate my business’s voice to customers?
INCIBE recommends warning customers, asking them to block and report the number, keeping evidence, filing a police report and, if personal data is affected, considering notifying the data protection authority (AEPD).
Glossary · Safety and good use
Keep reading
Sources
Change log
- : First published with INCIBE’s real cases as checked that day.
Educational content, prepared with the help of AI tools, with sources cited. It is not a substitute for professional advice. Tools change fast: if you spot something out of date, write to us at contacto@cognenza.com. How we work.