The takeaway: In July 2024, a Ferrari executive took a call from a voice that matched his chief executive's southern-Italian accent almost perfectly. He asked one question only the real Benedetto Vigna could answer — about a book he'd recently recommended — and the scammer hung up. That's this explainer in one story: voice cloning is now genuinely good enough to fool your ear — peer-reviewed research says listeners can no longer reliably tell clones from real voices — but the defences that beat it are simple, human, and free. Here's what's actually possible in 2026, what the UK numbers do and don't show, and the five-step defence kit.

What's actually possible now

You'll often read that scammers "only need three seconds of your voice". That figure has a real origin — a 2023 Microsoft research demo and a security vendor's lab test — but it describes producing a clone, not a convincing one. The consumer tools that matter say the quiet part themselves: ElevenLabs' own documentation recommends "1-2 minutes of clear audio" for its instant cloning. A minute or two of clean speech — a voice note, a wedding toast on Instagram, a podcast appearance — is the realistic bar.

What matters more is how good the result now is. A Queen Mary University of London study, published in PLOS One last September, built clones from about four minutes of audio per speaker and found listeners rated the clones "human" almost exactly as often as they rated actual humans human. The line has been crossed: your ear is no longer a reliable test.

Two things are genuinely new since the 2023 wave. First, the scam call can now be a conversation — researchers demonstrated last year fully automated scam agents that hold multi-turn dialogue in a lifelike synthetic voice and adapt to what you say — pair that with cloning and the pipeline is complete. Second, the consent gates are thin: when Consumer Reports tested six voice-cloning products last March, four of them required nothing more than ticking a box to affirm you had the right to clone the voice.

How the calls arrive

The patterns are well documented. The family-emergency call: the FBI's advisory describes criminals using "short audio clips containing a loved one's voice to impersonate a close relative in a crisis situation, asking for immediate financial assistance or demanding a ransom". The corporate version took £20m-plus from the engineering firm Arup in 2024 — though that famous case used deepfake video and voice on a conference call, not a phone call alone. And the freshest UK mechanism is quieter: National Trading Standards warned in February that criminals are harvesting voices through fake "lifestyle survey" calls, then using the clones to "simulate consent" for direct debits. Add caller-ID spoofing — Ofcom's standing advice is to never "rely upon the Caller ID as the sole means of identification" — and the incoming call can look and sound entirely real.

What the numbers honestly show

Here's the part the panic content skips. Britain's definitive fraud dataset — UK Finance's 2026 annual report — records a genuine record: £1.28bn stolen across more than four million cases in 2025, eight people defrauded every minute. But the phrase "voice cloning" appears nowhere in its 52 pages, and the impersonation-scam categories where a cloned-voice fraud would land actually fell to record lows — police-and-bank impersonation losses down 18%, cases down 23%.

The prevalence stats you've seen deserve the same scrutiny. Starling Bank's widely-quoted figure is that 28% of UK adults think they've been targeted by an AI voice-cloning scam — a belief survey, from the same release that found 46% of adults didn't know the scam type existed. We could find no named UK victim, court case or ombudsman decision confirmed to involve a cloned voice in 2025–26. That doesn't mean it isn't happening — nobody officially counts it, which is its own problem — but the honest summary is: the capability is proven and cheap; the epidemic is not yet in the data. Be alert, not alarmed.

The defence kit

1. Agree a safe phrase. A pre-agreed phrase your family uses to verify it's really you — recommended by Starling and the Home Office's fraud campaign, and by the FBI: "Create a secret word or phrase with your family to verify their identity." Share it in person, never by message. One honest caveat from deepfake researcher Hany Farid: it only works if you remember to use it — it's a layer, not a silver bullet.
2. Hang up and call back on a number you already have. The single strongest defence. No urgency is real enough to survive a two-minute call-back — and a genuine relative or bank won't mind.
3. Never trust caller ID, and never move money on instruction. Your bank and the police will never ask you to transfer funds to a "safe account" or to share a one-time passcode. Those two rules defeat most scripts regardless of how good the voice is.
4. For anything claiming to be your bank: hang up and dial 159. The anti-fraud line run by Stop Scams UK connects you securely to your own bank and now covers more than 99% of UK current accounts.
5. If you've been hit: report and claim. The national reporting service is now Report Fraud — it replaced Action Fraud in December — on 0300 123 2040 or reportfraud.police.uk (Scotland: call Police Scotland on 101). And since October 2024, banks must reimburse most authorised push-payment scam victims up to £85,000 — deception by a cloned voice is deception.

One question for your bank

Several UK banks still run "my voice is my password" phone authentication — HSBC's page still says fraudsters "can't replicate your voice" — despite journalists having demonstrated clone bypasses of UK bank voice ID as far back as 2023. Banks say the systems have layered defences, and no UK bank has dropped voice biometrics over cloning risk. If that trade-off makes you uncomfortable, you can opt out of voice ID and use other authentication — a phone call to your bank (or 159) is all it takes.

The government's new fraud strategy now names voice cloning explicitly, and detection frameworks are being built. Until they arrive, the Ferrari executive's move is still the state of the art: ask the question only the real person can answer.

Disclosure: On The Wire runs on AI models — the same technology family that powers both voice cloning and its detection. We flag it every time.

This guide was fully updated on 11 July 2026 with the latest research, fraud data and reporting routes.