Tag Archives: voice

Scamming Your Contacts: Testing Free Voice Deepfakes

If someone is intent on scamming your contacts with a voice deepfake, they don’t need expensive tools. They can scam them for free.

Testing free software for voice deepfakes

Charlie Osborne of ZDNET wanted to conduct a deepfake scam test. But because she didn’t have consent to clone soneone else’s voice, she cloned her own with FREE software. She then used FREE software to have the cloned voice recite a scam script.

  • She found her own Spotify podcast interviews, then (to simulate acquired voice quality) downloaded then as compressed WAV files. She “wanted to use audio samples of a similar quality to those you could rip from the average Facebook, Instagram, or TikTok content that could be exploited by scam artists.”
  • Within three minutes, Osborne had Claude write “a short script for a phone-based scam, emphasizing urgency, panic, and a few deliberate pauses for a conversational effect.”

Here’s an excerpt:

“I can’t get into my banking without my phone, and I don’t want to worry anyone else. [pause 1s] Please don’t say anything, I feel so stupid.”

Note that the “please don’t say anything” line is VERY effective in ensuring that the recipient doesn’t question the scam.

  • She then experimented with six free voice cloning apps to have them read the scam script in a voice created from her WAV samples. However, one was too professional and the others had a flat voice, which did NOT sound like a frightened woman.
  • She tried a seventh that promised emotional control, but it produced a voice with “a strangely breathy, husky whisper.”
  • She then went back and selected one of the original six, Voicebox.

Testing the scam

After Osborne created the recording, she tried it on five of her contacts. She didn’t fool four, but did fool one.

“Because she was of an older generation and slightly hard of hearing, it was harder for her to distinguish the familiar clues in a voice that make someone recognizable and trustworthy. (This wasn’t necessarily fair, I know, but it was a scam scenario that could realistically play out, and I was swiftly forgiven.)”

Now you could say that Osborne only had a 20% success rate, but remember that she was only using FREE tools. If she had spent some money, maybe she could have pulled it off.

Which emphasizes the importance of checking any communication you receive, and possibly setting up a phrase of four safe words (not one).

And no, I don’t encourage you to start scamming your contacts.

The Attack of the Realistic Fraud Bots

Realistic fraud bots are the new threat. The days of obviously spotting a deepfake have long since passed us by.

Pymnts reported on this in “When Fraud Becomes the Customer: The Next Battlefront for Issuers.”

In the past, enterprises defended themselves by analyzing voices (voice identification/speaker recognition and liveness detection), faces (facial recognition and liveness detection), and behaviors (behavioral biometrics).

But what happens when the fraud bots are able to convincingly fake voices, faces, and behaviors?

Realistic fraud bots. Google Gemini.
Realistic fraud bots. Google Gemini.

Or when attempts to detect fraud become so onerous that the real customers run away due to the increased friction?

One expert claims that voice identification is already useless.

“Tim Joslyn, Chief Technology Officer of Paymentology, told PYMNTS Intelligence that voice authentication has already reached the point of vulnerability. In his view, financial institutions that continue to rely heavily on this method could already be exposed. ‘I think voice has already failed,’ he said. ‘If you’re a bank and you’re aligned on voice, then potentially you’re already in trouble.'”

Not sure how the voice biometrics vendors would react to that….Actually, I do know. Here’s what Pindrop says:

“A person’s voice has distinct characteristics that deepfake AI struggles to replicate with 100% accuracy. By focusing on these unique aspects, voice authentication systems can differentiate between real human voices and AI-generated fakes.”

But is it good enough…and will it be good enough in the future?

And if you’re a biometric company, how do you convince your prospects of your solution’s value?

By partnering with a biometric product marketing expert. Find out more about Bredemarket’s capabilities at https://bredemarket.com/watch-book/.

Revised 10/28/2026.

Move Along Now (Biometric Product Marketing Expert)

John E. Bredehoft, Biometric Product Marketing Expert.

I ONLY want my hungry people to view this latest Biometric Product Marketing Expert short.

  • If you don’t care about biometrics, MOVE ALONG NOW.
  • If your company only hires “fresh perspective” (code word for young) people, MOVE ALONG NOW.
  • If your company believes that any use of AI is evil, MOVE ALONG NOW.
  • If your company conversely believes in surrendering your brain to whatever the AI god says, MOVE ALONG NOW.

Good. Now that they’re all gone, let’s talk about how a Biometric Product Marketing Expert can help your company.

Don’t tell anyone I said this, but LinkedIn dot com slash in slash jbredehoft.

Sneak Peek (Correctly Spelled) at Biometric Modality Audio

I’m working on a non-Bredemarket video.

Remember the pictures I shared on Thursday? (Try not to remember that the blog post was originally entitled “Sneak Peak.”)

Well, here’s the audio.

“The Sheriff’s Warning.” Google Lyria. Public Domain.

See you…Saturday?

Google Gemini.

Sneak Peek at Biometric Modality Pictures

I’m working on another personal non-Bredemarket video, and it includes these pictures representing five biometric modalities: finger, face, iris, voice, and DNA.

Finger.
Face.
Iris.
Voice.
DNA.

Plus this blooper.

Make the microphone bigger.

All images Google Gemini.

Rich On Tech Almost Got It Right Regarding Safe Words

But his heart was in the right place in this post.

“The BBC highlighted a case where a mother got a terrifying call that sounded exactly like her teenage son, supposedly saying he was in danger. It wasn’t him. Scammers had cloned his voice.

“That’s where a family code word can help. If someone calls claiming a loved one has been hurt, arrested or needs money urgently, ask for the code word. A scammer may be able to fake a voice, but they probably don’t know your family secret.”

Good, but as I previously noted, not great.

“While password length requirements sometimes become ridiculous, they have a purpose. A longer password is harder to guess than a shorter one.

“Similarly, four safe words are harder to guess than a single one.

“Provided the words are unrelated. “The quick brown fox” is a terrible safe phrase.”

Oh, and a note on monetization. Originally I simply planned to comment on Rich DeMuro’s original post, but only paid subscribers could comment. Therefore I’m posting my thoughts on my own platform.

People reading Bredemarket are more interested in knowledge-based authentication (KBA) anyway.

And if your firm provides KBA and other identity factors—there are six factors, you know—then perhaps Bredemarket can help your firm with content-proposal-analysis services.

CPA

Bredemarket Biometric Clients: Are You Next?

Your firm markets products that identify people based on who they are. Their friction ridges. Their faces. Their irises. Their voices. Their DNA.

Your firm needs marketing content (such as case studies), winning proposals, and strategic analyses.

Your firm needs outside help.

Biometric product marketing expert.

Your firm needs the biometric product marketing expert.

Talk to Bredemarket.

Stop losing prospects! Use Bredemarket content for tech marketers

The “Safe Word” KBA is as Vulnerable as Other KBAs

Why knowledge-based authentication? Because, in theory, it’s something you know that no one else knows.

“Safe words” are a form of KBA.

  • You get a call from your son, who says he’s in jail and won’t be released unless you send money now. The voice sounds like your son, so you send the money. Of course, it isn’t your son, but a deepfake engineered to scam you of your money..
  • But if your son volunteers the “safe words” that the two of you previously selected, you have a much higher assurance that the voice on the phone is your son.

But, as Secrets of Privacy notes, safe words are also vulnerable. Some of their tips:

Safe words, not safe word

While password length requirements sometimes become ridiculous, they have a purpose. A longer password is harder to guess than a shorter one.

Similarly, four safe words are harder to guess than a single one.

Provided the words are unrelated. “The quick brown fox” is a terrible safe phrase.

That no one else knows

If someone can read your safe phrase online, it’s unsafe. I cannot use “California State University Fullerton” (on my LinkedIn profile) or “biometric product marketing expert” (all over this website).

Established together, preferably in person

Don’t rely on online establishment. People see things.

“Don’t text the safe phrase (even via Signal), never email it and don’t save it somewhere like in a cloud document or note app.”

And one more thing

If your purported son calls you, he’s the one to use the safe phrase…not you.

“Eva Velasquez, CEO of the Identity Theft Resource Center, sees this mistake constantly. A family sets up a safe word, and then in the panic of an actual emergency call, the intended victim blurts it out themselves trying to be helpful or trying to speed things along. A scammer who hears “wait, is this about our safe word, it’s soggy trombone” now owns your safe word. The rule has to run one direction only. Whoever is asking for money says the phrase unprompted, or the call gets treated as fraud, no exceptions.”

Admittedly the victim is under extreme pressure, but try to remember this. Blurting out the safe word is the equivalent of leaving your house keys in your front door lock, with a red arrow labeled “For burglars.”

When done right, safe phrases work

But don’t let this scare you away from safe phrases.

“The reason a safe phrase beats even a flawless voice clone is that it doesn’t rely on the voice being fake or real. It relies on information the scammer physically cannot have.”