Deepfake & Voice-Clone Scams — When 'Family' Calls You for Money

"Papa, I'm in trouble — please send money now, I'll explain later." The voice is unmistakably your child's. Except it isn't. It's a clone, generated by AI from a few seconds of audio scraped from an Instagram reel or a WhatsApp status.

Voice-clone and deepfake fraud has exploded in India — researchers estimate deepfake content circulating online grew roughly nine-fold between 2023 and 2025, and it now powers everything from fake kidnapping calls to counterfeit celebrity investment ads. The technology will only get better. Your defences have to be things AI cannot fake.

The three scams to know

1. The family emergency call

You get a call — sometimes from an unknown number "because my phone was taken" — in the cloned voice of a child, spouse or parent: an accident, an arrest, a kidnapping. Panic and urgency do the rest. Some versions add a "police officer" who takes over the call and demands money for "settlement".

2. The fake boss or relative on WhatsApp

A display picture of your boss or a relative, a new number, and a request: "Stuck in a meeting, urgently pay this vendor / buy gift cards, will repay tonight." Corporate versions of this scam have cost Indian companies crores; family versions cost households their savings.

3. The celebrity endorsement

Videos of industrialists, cricketers and film stars "launching" trading apps or giveaway schemes flood social media ads. The faces are real; the words are synthetic. Treat every investment endorsement in a social-media ad as fake — genuine regulated products are never sold through celebrity DMs or giveaway links.

The one rule that beats AI: verify out-of-band

"Out-of-band" simply means: check through a different channel than the one the request came from.

1. Hang up and call the person back on their saved number — not the number that called you.
2. If unreachable, call another family member who would know where they are.
3. Agree on a family code word today — a random word ("imli", "platform 9") that any real emergency caller must say. AI can clone a voice; it cannot know your code word.
4. For money requests from a "boss" or "relative" on a new number: confirm on the old number or in person. No genuine emergency is ruined by a two-minute verification.

Spotting one in the moment

Verification beats detection every time — but when you are mid-call and have to make a judgement, these are the tells that still leak through.

On a voice call:

• The emotion never quite tracks the words. Cloned speech often carries a flat or oddly uniform tone under a supposedly frantic message.
• No natural interruption. Real distressed speakers stumble, backtrack, breathe unevenly. Synthetic audio tends to run clean.
• Unusual latency before answers. A pause before every reply can mean someone is generating or typing the response.
• They resist specifics. Ask something only the real person would know and has no reason to have posted online — not a birthday, but "what did we eat at Diwali?" Evasion, deflection, or urgency in response to a simple question is the strongest signal there is.
• The story blocks verification. "Don't tell Amma", "my phone is dead", "there's no time" — every version of this scam must stop you making one phone call.

On video:

• Watch the edges — hairline, glasses, jaw against a moving background — where blending artefacts persist.
• Blinking and teeth often render poorly, as does the inside of the mouth while speaking.
• Lighting mismatches between face and surroundings.
• Ask them to turn their head fully sideways or pass a hand across their face. Real-time deepfakes still struggle with profile views and occlusion.

Treat all of this as a tiebreaker, not a test. The technology improves every month; a call back to a saved number does not.

Lock down what feeds the clones

If it happens to you or family

1. Don't pay — verify first, every single time, no matter how real it sounds.
2. Report the number/account in-app (WhatsApp: long-press chat → Report; Instagram: profile → Report).
3. Report financial fraud on 1930 and cybercrime.gov.in immediately; report scam numbers on Chakshu at sancharsaathi.gov.in.
4. If your own face or voice is misused — including obscene deepfakes — file at cybercrime.gov.in (it has a dedicated category for such content); platforms are required to take down reported synthetic abuse content quickly under IT Rules.

If your own face or voice is the one being faked

This is its own kind of violation, and it has remedies. Act on all three tracks at once rather than in sequence.

Get it taken down. Report through the platform's own reporting flow first, and separately to its Grievance Officer, whose contact details every significant platform is required to publish. Under the IT Rules, content in the nature of impersonation — including morphed images and synthetic sexual content — must be acted on within a short, defined window once reported. If the platform ignores you or refuses, the Grievance Appellate Committee exists precisely for that escalation.

Report it as a crime. File at cybercrime.gov.in — it has dedicated categories, including one for obscene content involving women and children that can be filed anonymously. Impersonation using a computer resource and violation of privacy are separately punishable offences, and morphed sexual content attracts serious provisions. You can also go to your local cyber police station.

Preserve the evidence before it disappears. Screenshot the content, the profile, and the URL; note dates and times; record how many accounts are sharing it. Do not simply block and move on — blocking removes it from your view, not from the internet, and destroys your ability to prove what was posted.

Two things worth saying plainly. If the target is a woman or a minor, this is treated as a serious offence and there are helplines and legal aid specifically for it — you do not have to handle it alone or quietly. And if you are being extorted with such content, paying does not end it; report instead.

Frequently asked questions

How much audio does someone need to clone a voice?

Far less than people expect — a short clip of ordinary speech is enough for current tools, and the quality keeps improving. That clip does not have to come from a hack: a public Instagram reel, a WhatsApp status, a wedding video, a voice note forwarded through a group. This is why locking down social profiles matters more than it used to, particularly for children and elderly relatives.

Can I tell a deepfake just by looking or listening?

Sometimes, and less reliably every month. The tells above are real but they are a fallback, not a defence — betting your savings on your ability to hear a synthetic voice under stress is exactly the bet the scam is designed for. Verification through a channel the caller does not control is the only defence that keeps working as the technology improves.

Is a video call proof that I'm talking to the real person?

No. Real-time deepfakes exist and are being used. Treat a familiar face on video the same as a familiar voice on a call: reassuring, not conclusive. If money is being requested, hang up and call back on the saved number regardless of what you just saw.

What is a family code word, and does it really work?

It is a random word — meaningless, never posted, never shared in a chat — that any genuine emergency caller must be able to say. It works because it attacks the one thing AI cannot synthesise: private shared knowledge. Pick something arbitrary rather than a pet's name or a birthplace, and tell it to family in person rather than over a message.

The caller knew my address and my son's college. Doesn't that prove it's real?

No — it proves your data has leaked, which is now unremarkable. Breach data, social profiles and public records give scammers a convincing opening. Personal details establish that someone did their homework, never that they are who they claim to be.

My elderly parent already sent money. What do we do?

Call 1930 immediately, then file at cybercrime.gov.in, then their bank's fraud helpline. Speed determines whether the money can be frozen while it is still moving. Then, gently: most victims stay silent from embarrassment, and that silence costs far more than the first transfer. Make it clear no one is angry.

Should I take my family off social media entirely?

That is rarely necessary or realistic. Reducing exposure is enough for most people — private accounts, profile photos restricted to contacts, fewer public voice and video posts, and particular care with children's content. The bigger win is the verification habit: a family that always calls back is protected regardless of what is public.

The bottom line

AI has made identity fakeable — voice, face, even live video. So anchor trust in things that can't be generated: known numbers you call back, shared secrets, and the discipline of verifying before paying. The technology in these scams is new; the defence is as old as families — talk to each other first.