威胁之所以急迫，不仅仅是因为克隆技术可行，还因为实现它的工具廉价、丰富且几乎完全没有监管。2025年3月，《消费者报告》评估了六家公司的语音克隆产品——Descript、ElevenLabs、Lovo、PlayHT、Resemble AI 和 Speechify——并得出结论称，绝大多数产品缺乏任何有效的防止欺诈或滥用的保护措施。该机构发现，其中四款产品仅要求用户勾选一个方框，确认他们有合法权利克隆所涉及的语音。这四款产品中没有任何一款使用任何技术手段来确认发声者确已同意，或限制克隆仅用于用户自己的声音。六家公司中有四家仅需用户名或电子邮件地址即可开设账户。调查的直白结论，由NBC新闻和《注册报》放大报道，是该行业已经研发出一种能够模仿任何人的工具，而且只需用户自我声明勾选一个复选框即可使用。
第三个瓶颈——也是最有希望的——是银行。这是金钱实际流动的地方，因此也是拦截机制作用最强的地方。英国提供了最清晰的自然实验。2024年10月，支付系统监管机构（Payment Systems Regulator, PSR）要求对授权推送支付（APP）诈骗进行必需的赔偿：如果受害者被欺骗授权向欺诈者转账，汇出和接收银行现在必须对其进行赔偿，责任各承担一半，上限为85,000英镑，并在五个工作日内完成，同时明确禁止对弱势客户适用消费者疏忽例外条款。账户名称确认服务（Confirmation of Payee）现在在数十亿笔交易中运行。PSR自有的仪表盘显示，截至2025年12月底的15个月内，因这种诈骗损失的钱款中有89%——约2.43亿英镑——得到了赔偿，而在规则生效前，赔偿率为65%。
Sharon Brightwell heard her daughter crying down the line, and that was the end of any defence she might have mounted. The voice belonged to April, or so every instinct insisted: the same timbre, the same broken rhythm of a young woman in distress. The voice said she had been texting while driving, that she had hit a pregnant woman, that her phone had been seized by police. A man then took over the call, identifying himself as April's attorney, and explained that bail would cost fifteen thousand dollars in cash. He warned Brightwell not to tell the bank what the money was for, because it might damage her daughter's credit. Within the hour, the retiree from Dover, Florida had withdrawn the money and handed it to a courier she believed was connected to the courts. Only when she reached the real April, who had spent the morning at work and never been near a car accident, did she understand that her daughter had not made the call. No human had. The crying had been synthesised from a fragment of audio, and the daughter she thought she was rescuing existed only as a pattern of numbers in someone else's machine.
Brightwell's loss, reported across American local news in the summer of 2025, is now one of the most ordinary crimes in the United States. It is also one of the most technically advanced. The collision of those two facts — that a fraud requiring the absolute frontier of machine learning can be perpetrated against an ordinary grandmother in her kitchen, at scale, for the price of nothing — is the defining feature of a problem that law enforcement, banks, telecoms companies and regulators have spent two years failing to contain. The question is no longer whether the technology works. It works appallingly well. The question is what meaningful protection requires when the gap between the sophistication of the attack and the awareness of the target is measured not in months but in years.
In April 2026, the FBI's Internet Crime Complaint Center published its annual report on the previous year's online crime, and for the first time in the report's twenty-six-year history it broke out artificial-intelligence-enabled fraud as a distinct category. The numbers were stark. The bureau logged more than 22,000 complaints with an AI nexus and adjusted losses exceeding 893 million dollars. Of that sum, the report attributed 352 million dollars in losses to victims aged sixty and over, making older adults the single most heavily targeted demographic in AI-enabled financial crime. The AI figure sat inside a far larger total: cybercrime losses across the United States rose 26 per cent in a single year to 20.9 billion dollars, with Americans aged sixty and older accounting for 7.7 billion of that — a roughly 60 per cent jump on the previous year.
The FBI was candid that even these figures understate the problem. AI attribution in the report reflects only what victims recognised and reported, and most victims of a cloned-voice call never learn that a machine was involved at all. They believe, as Sharon Brightwell initially believed, that they spoke to their own child. The 893 million dollars is therefore best read as a floor, not a ceiling — the visible portion of a category that is, by its nature, designed to remain invisible to the people it harms. That the FBI felt compelled to create the category at all is itself a signal. Crime statistics are conservative instruments; agencies do not redraw twenty-six-year-old reporting taxonomies for a passing fashion. The new line in the ledger is an admission that a tool which barely existed in consumer form three years ago has become a mainstream instrument of theft.
Internationally, the picture is larger and worsening. In March 2026, INTERPOL published the second edition of its Global Financial Fraud Threat Assessment, estimating worldwide losses to financial fraud at 442 billion dollars in 2025 — a sum comparable to the entire annual economic output of Denmark. The organisation rated the threat trajectory as escalating and described what it called the “industrialisation of fraud”: the migration of scamming from opportunistic individuals to organised, transnational operations that intersect with human trafficking and cybercrime. Crucially, INTERPOL found that AI-enhanced fraud is roughly four and a half times more profitable than its traditional equivalent, and that so-called agentic AI systems can now autonomously plan and execute entire fraud campaigns, from reconnaissance through to the ransom demand. The economics, in other words, have inverted. For the first time, deception at industrial scale costs almost nothing to manufacture and returns a fortune.
The technical capability at the centre of the grandparent scam is brutally simple to describe. A modern AI voice-cloning system requires as little as three seconds of audio to produce a synthetic voice that is, for practical purposes, indistinguishable from the original. Three seconds is the length of a voicemail greeting, a snatch of a podcast, the audio under a birthday video posted to a public Instagram account. The raw material is not stolen from a secure database; it is volunteered, every day, by the ordinary act of living a recorded life. A grandchild who appears in a single TikTok clip has supplied everything a fraudster needs to manufacture their own kidnapping.
What makes the threat acute is not merely that the cloning works but that the tools to do it are cheap, abundant and almost entirely unpoliced. In March 2025, Consumer Reports assessed the voice-cloning products of six companies — Descript, ElevenLabs, Lovo, PlayHT, Resemble AI and Speechify — and concluded that a majority lacked any meaningful safeguard against fraud or misuse. Four of the products, the organisation found, required only that a user tick a box affirming they had the legal right to clone the voice in question. None of those four employed any technical mechanism to confirm that the speaker had actually consented, or to restrict cloning to the user's own voice. Four of the six companies required nothing more than a name or an email address to open an account. The investigation's blunt conclusion, amplified by NBC News and The Register, was that the industry had built a tool capable of impersonating anyone and then placed it behind a self-attestation checkbox.
ElevenLabs, one of the most prominent providers, points to a multi-layered safety programme: a prohibited-use policy that bans impersonation, a public AI speech classifier that can identify audio likely to have originated from its system, traceability that links generated content back to the account that produced it, and “no-go voices” safeguards that block the cloning of certain protected figures around election cycles. These are not trivial measures, and they are more than several competitors offer. But they share a structural weakness: almost all of them operate after the fact. They help investigators establish provenance once a fraud has already occurred and a victim has already lost their savings. They do very little to prevent the three-second clone from being generated in the first place, because the thing that would prevent it — robust, mandatory verification that the person being cloned has consented — is precisely the friction that a competitive, fast-moving market is reluctant to impose on itself. When a safeguard costs a company conversions and protects only the customers of its rivals, the market will not supply it voluntarily. It has not.
If there is a single moment that captures why detection-based defences are failing, it arrived in a New York Times profile published in June 2026. Its subject was Hany Farid, the University of California, Berkeley professor who is, by broad consensus, the world's foremost authority on deepfake forensics. For more than two decades Farid had built a career on the ability to separate the real from the synthetic, fielding requests from governments, human-rights organisations, journalists and law enforcement. Lately, the Times reported, he had begun failing his own tests. “I feel like I'm going blind,” he said. The man best equipped on Earth to distinguish a genuine recording from an AI-generated one could no longer reliably do so.
That admission ought to end a certain kind of conversation. For years, the implicit promise of the response to synthetic media has been that detection would keep pace with generation — that for every more convincing fake, there would be a more sensitive detector, and that the arms race, though uncomfortable, was at least winnable. Farid's confession is evidence that, in the audio domain at least, the race has been lost. When the foremost detector in the field is reduced to a coin-toss, the strategy of catching fakes after they have been made and circulated is not a strategy at all. It is a hope. And a fraud that depends on twenty minutes of panic does not give a victim, or their bank, twenty minutes to run a forensic analysis that even Hany Farid would no longer trust.
This is the first and most important thing that meaningful protection requires us to accept: detection cannot be the load-bearing defence. A grandmother on the phone with a sobbing voice cannot be expected to perform forensic analysis that the discipline's leading expert has effectively abandoned. Any plan that ultimately rests on the target, or anyone else, being able to tell the difference between a real voice and a cloned one is already obsolete. The implication runs deeper than telephone fraud. If the world's authority on detecting synthetic audio cannot trust his own judgement, then every downstream system that quietly assumes a human can serve as a fallback verifier — the bank teller who is told to “use discretion,” the relative urged to “listen carefully for anything off” — rests on a foundation that has already crumbled.
It is tempting, and wrong, to attribute the targeting of older adults to naivety. The brief that prompts this article identifies a more uncomfortable truth: the characteristics that make older people disproportionately vulnerable are not deficiencies of intelligence but features of a life well lived. They tend to hold higher average savings balances, the accumulated product of decades of work, which makes them efficient targets — a single successful call can yield far more than one aimed at a younger person. They were raised in, and still operate within, established patterns of trust-based communication, in which a phone call from a distressed relative is answered as a genuine emergency rather than interrogated as a potential attack. They are, through no fault of their own, relatively unfamiliar with the existence of AI voice synthesis, having spent most of their lives in a world where a voice on the line was definitionally a person on the line. And they are exposed, like every parent and grandparent, to the particular emotional architecture of the family-emergency scenario, in which the instinct to protect a child overrides every slower, more sceptical faculty.
Academic research has begun to formalise this. An arXiv paper published in June 2026 noted plainly that “older adults remain disproportionately vulnerable to AI-enhanced scams.” A separate study from a team led by Yixin Zou, also published in early 2026, examined fraud interventions designed specifically for older adults amid escalating AI sophistication, developing a role-based simulation tool called ROLESafe that improved participants' ability to identify fraud when they learned by playing the part of victim or helper rather than passive observer. And a third paper, from researchers at the firm Charm Security, proposed a Human Vulnerabilities and Exploits Framework — a structured catalogue, modelled on the software-security world's vulnerability databases, for classifying the cognitive and social mechanisms that fraud systems exploit. The framework's premise is itself a quiet indictment: the security industry has spent decades cataloguing and patching the weaknesses of machines while leaving the weaknesses of people undocumented and unmanaged. The grandparent scam succeeds because it attacks the one part of the system for which no patch has ever been written.
This is why awareness campaigns aimed at older adults, while necessary, cannot be sufficient. The emotional mechanism the scam exploits is not a gap in knowledge that a leaflet can fill; it is the love a person has for their grandchild, weaponised. You can tell someone a hundred times that voices can be faked, and in the moment a cloned voice screams for help, the knowledge will not arrive in time. The AFP wire story carried by The Straits Times and the Manila Times in June 2026 quoted Amit Gupta of the voice-security firm Pindrop putting the matter precisely: “The objective is not perfect voice replication. The objective is creating enough emotional uncertainty and urgency that the victim acts before verifying.” A defence built around the assumption that victims will verify is a defence built against the very weakness the attack is engineered to bypass.
The most chilling testimony in that wire story came not from an elderly victim but from a lawyer. Gary Schildhorn, a Philadelphia attorney who was himself targeted by a cloned-voice scam, said that even with hindsight and professional scepticism he could not shake the certainty of what he had heard: “I will go to my grave swearing that it was your voice.” That sentence ought to be read by anyone tempted to believe that vigilance is the answer. Schildhorn is a trained advocate, paid to interrogate evidence and disbelieve plausible stories, and the clone defeated him as completely as it defeated a panicked grandmother. The vulnerability the fraud exploits is not located only in the elderly, or the credulous, or the technologically illiterate. It is located in the human auditory system itself, which evolved over millennia to treat a recognised voice as proof of a recognised person — and which is now, for the first time in that long history, systematically and exploitably wrong.
The data on older adults reinforces rather than contradicts this reframing. The FTC's December 2025 report to Congress found that total fraud losses reported by people aged sixty and over had roughly quadrupled between 2020 and 2024, reaching about 2.4 billion dollars, with 68 per cent of that sum attributable to individual losses of 100,000 dollars or more. The agency's own estimate of the true annual cost, accounting for the chronic underreporting that shame and embarrassment guarantee, ranged as high as 81.5 billion dollars. These are not the numbers of a credulous minority being separated from pocket money. They are the numbers of a generation's accumulated savings being drained through a mechanism specifically calibrated to their patterns of trust, their financial position and their place at the emotional centre of a family.
Brian Long, the chief executive of the security firm Adaptive Security, distilled the new economics for AFP in a single sentence: “One guy in a room with a keyboard can make an infinite number of attackers.” That is the asymmetry in its purest form. On one side stands an automated system that can generate a convincing clone in seconds, dial thousands of numbers, and conduct each conversation with synthesised emotion, for a marginal cost approaching zero. On the other stands an individual human being, often elderly, alone, and given roughly the length of a panicked phone call to mount a defence that the world's leading forensic scientist could not.
The most widely circulated piece of advice, repeated by the FBI, the American Bankers Association and consumer advocates throughout 2026, is to agree a family “safe word” — a secret phrase known only to relatives, to be demanded in any emergency call. If the voice cannot produce it, hang up and call back on a known number. The advice is sound. It is also, as a systemic defence, hopelessly inadequate, and it is worth being clear about why.
A safe word works only if every member of a family adopts it, remembers it, and has the presence of mind to demand it in a moment engineered to obliterate presence of mind. It places the entire burden of defeating an industrial, automated, billion-dollar criminal apparatus on the cognitive discipline of a frightened individual at the worst moment of their week. It assumes that the eighty-year-old whose median reported loss, according to FTC data released in late 2025, exceeds 1,600 dollars will, while hearing her grandchild scream, calmly recall a protocol and execute it. Some will. Many, by design, will not. A defence that works only when the target performs flawlessly under maximum stress is not a defence; it is a way of allocating blame to the victim after the fact.
This is the deeper objection to placing protection in the hands of families and individuals. It transfers responsibility for a failure of the technological and financial system onto the people least equipped to bear it, and then, when they fail, treats their failure as a personal one. The voice-cloning tools were built and sold by companies. The calls are carried by telecommunications networks. The money moves through banks. Each of those parties operates at the chokepoints where the fraud could actually be interdicted at scale. The grandmother in her kitchen does not. Meaningful protection requires moving the burden from the end of the chain, where it currently sits, to the points in the middle where it belongs. A society that responds to an industrialised threat by issuing better advice to its most vulnerable members has confused the publication of guidance with the provision of protection.
Consider the three institutional chokepoints in turn, because each illustrates both the promise and the present failure of structural defence.
The third chokepoint — and the most promising — is the bank. This is where the money actually moves, and therefore where interdiction has the greatest mechanical leverage. The United Kingdom offers the clearest natural experiment. In October 2024, the Payment Systems Regulator made reimbursement for authorised push payment fraud mandatory: where a victim is tricked into authorising a transfer to a fraudster, the sending and receiving banks must now reimburse them, splitting the liability fifty-fifty, up to 85,000 pounds, within five business days, with the consumer-negligence exception explicitly barred for vulnerable customers. Confirmation of Payee, the account-name-checking service, now runs on billions of transactions. The PSR's own dashboard showed that in the fifteen months to the end of December 2025, 89 per cent of money lost to such scams — some 243 million pounds — was reimbursed, against a 65 per cent rate before the rules took effect.
Pull these threads together and a coherent picture emerges of what would actually work, as distinct from what merely sounds reassuring.
It requires, first, abandoning detection as the primary line of defence. Hany Farid's blindness is not a temporary setback to be solved by a better classifier; it is a permanent structural condition of a world in which generation has outrun discrimination. Any plan whose final safeguard is someone, somewhere, telling the real from the fake has already failed.
It requires, second, regulating the supply of the weapon. The Consumer Reports finding that voice-cloning tools sit behind a self-attestation checkbox is a policy choice, not a law of nature. Mandatory, verifiable consent before a voice can be cloned — of the kind Descript and Resemble AI have partially implemented and the others have not — is technically feasible and would not abolish the legitimate uses of the technology. The European Union's AI Act, whose obligations for general-purpose models began applying through 2025 and 2026, and state statutes such as Tennessee's ELVIS Act, which requires written consent to clone a voice, are early gestures towards treating voice synthesis as the regulated capability it has become. They remain far ahead of enforcement and far behind the threat.
It requires, third, placing the burden of interdiction on the institutions that occupy the chokepoints — and, where they will not act voluntarily, compelling them through liability. The British reimbursement regime is imperfect and incomplete, but it demonstrates the mechanism: when banks own the loss, banks build the friction. Telecoms carriers that profit from carrying calls should bear a corresponding duty to authenticate and, where possible, flag them. Platforms that sell cloning should bear a duty to verify consent. The common principle is that responsibility ought to sit with the party that has both the capability to prevent the harm and the commercial benefit from the activity that causes it — which, in every case, is an institution, and in no case is an eighty-year-old answering her phone.
It requires, fourth, treating the human vulnerability as a thing to be managed rather than a thing to be blamed. The Charm Security framework's insight — that the cognitive and emotional mechanisms exploited by fraud deserve the same systematic cataloguing as software flaws — should inform how banks design their interventions, how carriers design their warnings, and how public bodies design education that goes beyond leaflets to the kind of role-based rehearsal that the ROLESafe research found actually changes behaviour. Awareness campaigns and family safe words are not worthless. They are simply the last and weakest line, useful only as a backstop to structural defences that do the real work.
The deepest reason the defensive gap is measured in years rather than months is that the attack is a technology problem and the defence is an institutional one. Cloning a voice takes three seconds and improves monthly. Passing a reimbursement regulation, rewiring a banking system's fraud controls, mandating consent verification across an industry, and closing the non-IP loophole in a national telephone network take years, because they require law, coordination, money and the overcoming of every commercial interest that profits from the status quo. The asymmetry is not merely technical; it is the asymmetry between how fast a machine can be built and how slowly a society can respond.
Sharon Brightwell got some of her money back, eventually, through the diligence of investigators and her bank. Many do not. The 352 million dollars the FBI attributes to older victims of AI fraud, and the far larger sum it cannot see, represent a transfer of wealth from the people who can least afford to lose it to the most efficient criminal enterprise yet devised. Closing the gap will not come from teaching grandmothers to doubt the sound of their grandchildren's voices. It will come from deciding, as a matter of law and engineering, that the institutions standing between the clone and the cash are responsible for what passes through their hands. Until that decision is made, the three-second theft will remain the easiest serious crime in the world to commit, and the hardest for its victims to be believed about — because the evidence, by design, sounds exactly like someone they love.
Tim Green UK-based Systems Theorist & Independent Technology Writer
Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk：https://smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.
His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.
扫码直达文章详情