Threat news

AI voice cloning attacks: what has actually happened and how to defend

Yes, but the best-documented voice attacks so far have relied on persuasion more than on cloned voices. The clearest cloned-voice case is the 2024 Arup deepfake video call, which cost about US$25 million, while reporting on the 2023 MGM breach describes a help desk call with no synthetic voice at all. The defenses are the same for both: verify through a channel you already trust and harden the help desk.

By . Published . Last updated .

Key takeaways

  • The Arup case (about US$25 million) was a deepfake video call, and the strongest evidence of cloned-voice fraud we found.
  • Some of the costliest voice attacks, such as the MGM breach, relied on persuading a help desk, not on a synthetic voice.
  • The FBI has warned about AI voice messages impersonating senior US officials since 2025.
  • Verify through a channel you already trust, use code words for high-risk requests and never share MFA codes on a call.
  • Harden help desk resets and use phishing-resistant MFA, then test whether staff follow the rules under pressure.

This post sticks to well-documented cases and says where the evidence is thin.

What happened in the Arup deepfake video call?

In 2024 the engineering firm Arup confirmed it had lost about US$25 million after a Hong Kong finance employee joined a video call with what appeared to be the company's CFO and other colleagues. They were deepfakes. The employee made 15 transfers totaling HK$200 million, about US$25.6 million. Arup told Fortune that "fake voices and images were used" and that none of its internal systems were compromised.

The lesson: this was a video call, not a phone call, but it shows what happens when face and voice are both convincing. "I recognized them" stops being a safe way to verify a request for money.

What have regulators said about AI-cloned voices?

In February 2024 the FCC ruled that AI-generated voices in robocalls are "artificial" under the Telephone Consumer Protection Act, which means calls that use them need the called party's prior consent unless an exemption applies (FCC news release). The ruling followed a fake Joe Biden robocall sent to New Hampshire voters before the January 2024 primary. The consultant behind it was fined $6 million by the FCC in September 2024, though a New Hampshire jury acquitted him of the criminal charges in June 2025 (NEPM and AP).

The FBI on AI voice impersonation

In May 2025 the FBI warned that since April of that year, criminals had been sending texts and AI-generated voice messages that pretended to come from senior US officials, to build rapport and then move targets to another platform through a malicious link (IC3 alert I-051525-PSA). A December 2025 update said the activity goes back to at least 2023 and now also targets officials' family members, asking for wire transfers, personal documents and authentication codes (IC3 alert I-121925-PSA).

Do vishing attacks need a cloned voice?

The most damaging voice attacks in recent years relied on persuasion, not synthetic speech.

  • MGM Resorts, 2023. Reporting says attackers called the IT help desk while posing as an employee. MGM later disclosed a hit of about $100 million to its third-quarter results and said operations ran manually for about ten days (Insurance Journal).
  • Scattered Spider. A CISA and FBI advisory, updated in July 2025, describes actors who pose as employees to get help desks to reset passwords and move MFA to devices the attackers control, often after researching the target and calling more than once (CISA AA23-320A).
  • Salesforce-related vishing, 2025. Google's threat intelligence team described a campaign in which callers impersonated IT support and talked employees into authorizing a malicious connected app, which was then used to pull data out of Salesforce (Google Cloud).

CrowdStrike's 2025 Global Threat Report reported a 442% rise in vishing between the first and second half of 2024 (Security Magazine). That figure measures growth between two half-year periods and does not say how much of it involved AI voices.

What this means

We did not find a well-documented case of a cloned-voice phone call defrauding a company, beyond the Arup video call. That does not mean it is not happening, and the technology is cheap enough that you should plan as if it is. It does mean the first problem for most organizations is simpler: callers who sound plausible get past verification steps that are weak or not followed.

How do you defend against voice cloning and vishing?

  1. Verify through a channel you already trust. Hang up and call back on a number from your own directory, not one the caller gives you (FBI advice).
  2. Use a code word for high-risk requests, among executives and finance teams as well as families (FBI advice).
  3. Never share MFA codes or send money because of a call, text or voice message alone.
  4. Harden the help desk. Require a verification step for password and MFA resets that a caller cannot pass with public information, and have a rule for what happens when verification fails (CISA advice).
  5. Use phishing-resistant MFA, such as FIDO2 or WebAuthn, instead of SMS codes or push approvals (CISA advice).
  6. Limit who can authorize connected apps in your SaaS platforms (Google advice).

Listening for robotic artifacts is a weak control. The FBI itself notes clones can sound nearly identical to the real person.

Test it before an attacker does

Policies only matter if people follow them under pressure. A vishing simulation tests exactly that: whether employees verify the caller, hold the line when pushed and report the call. vishin.ai uses AI voice agents to place realistic calls, and records and scores each one. We use stock voices from a library. We do not clone real people's voices. If you want to run an assessment, start with this guide.

Sources