The Anatomy of a Voice-Cloning Scam
Artificial intelligence has made it alarmingly easy for scammers to replicate a person's voice. All they need is a small audio sample, which can be easily lifted from social media posts, public videos, or even a previous voice note. Using widely available
AI tools, they can generate a synthetic version of the voice that sounds shockingly realistic, complete with the original person's tone and speech patterns. Once the voice is cloned, the scammer can make it say anything they want. They often craft messages that create a sense of extreme urgency or distress. You might receive a voice note on WhatsApp from what sounds like your child, parent, or close friend, claiming they are in an accident, have been arrested, or are facing another emergency that requires immediate financial help. Because the voice sounds so familiar, the instinct to help is strong, and many people transfer money before they have a chance to think critically or verify the situation.
How 'Hijacking' Works on WhatsApp
The term 'hijack' can mean two different things in this context. The more common method does not involve taking over your account but rather 'hijacking' your trust. Scammers send the cloned voice message from an unknown number, impersonating someone you know to manipulate you into sending money or personal data. However, a more dangerous variation involves a full account takeover. In this scenario, criminals first trick you into handing over your six-digit WhatsApp verification code. They might call you, pretending to be from a support team, or a friend might message you (from their already-hacked account) asking you to forward a code they 'accidentally' sent to your number. Once they have this code, they can register your WhatsApp account on their own device, locking you out. From there, they have access to your contacts and past voice notes, which they can use to create even more convincing cloned-voice scams targeting your friends and family from your own number.
Step 1: Create a 'Digital Safeword'
One of the most effective ways to protect yourself against voice-cloning scams is to establish a secret 'safeword' or phrase with your close family and friends. This should be a unique word or inside joke that an outsider could never guess. Agree that in any situation where one of you requests money or help via a message or call, you must first confirm your identity by stating the safeword. If the person on the other end cannot provide it, you know it's a scam, no matter how convincing they sound. This simple but powerful technique creates a layer of verification that AI cannot break. Make sure this word is kept completely private and is changed periodically for added security.
Step 2: Scrutinise Your Digital Voiceprint
Scammers need raw material to create a voice clone, so limiting their access to your voice is a crucial preventative step. Be mindful of the audio and video content you post publicly on social media platforms like Instagram, Facebook, or YouTube. Consider making your accounts private so that only trusted followers can see your posts. It's also wise to avoid using a personalised voicemail greeting on your phone; the standard, automated greeting does not provide scammers with a clean sample of your voice. Think twice before answering calls from unknown numbers. If a scammer is trying to record your voice, even you saying a simple "Hello" can be enough for them to capture what they need. If the call is important, the person will leave a message.
Step 3: Verify, Secure, and Report
If you receive a suspicious or urgent request for money, even if it sounds like someone you know, always pause and verify. Hang up and call the person back on the phone number you have saved for them, or try a video call to see them face-to-face. Never rush into making a payment. Legitimate emergencies can withstand a few minutes of verification. Additionally, bolster your WhatsApp account's security by enabling Two-Step Verification. This feature requires a six-digit PIN when you register your phone number with WhatsApp again, which prevents someone from taking over your account even if they have your SMS verification code. Finally, if you identify a scam, block the number immediately and use WhatsApp's report function to alert the platform.
