Introduction
In recent years, WhatsApp has become one of the favorite channels for digital scammers. What used to be badly written messages asking for generic help has evolved into something far more sophisticated and alarming: voice messages that sound exactly like someone you know.
Yes, like your voice. But generated by artificial intelligence.
In this case, the victim was a woman close to me. Out of respect for her privacy and to protect her personal data, including her voice, I won’t share any evidence of what happened. The goal isn’t to expose her, but to understand how this kind of fraud works and how we can prevent it.
The case: a call, a code and a voice that wasn’t hers
One afternoon, this woman received a call from someone claiming to be from the support team at Mercado Pago.
The tone was friendly but urgent. They told her they had detected suspicious activity on her account and needed to verify her identity to “protect her”.
They asked her to read aloud a code she was about to receive on WhatsApp, and then to restart her phone. She did.
That code was the direct key to her WhatsApp account. By handing it over, without realizing it, she gave the cybercriminals full control. Restarting the phone was just a trick to cut off her immediate reaction.
Once inside, the attackers accessed her contacts, conversations and voice messages. But they didn’t stop at text. From her own number, friends and family started receiving audio messages asking for urgent transfers.
It sounded just like her: her tone, her rhythm, her way of speaking.
But it wasn’t her.
How they cloned her voice
The attackers used her previous audio messages — the kind we all send every day on WhatsApp — to train an AI model capable of replicating her voice.
Anatomy of AI-powered scams
This is the anatomy of AI-powered scams. Security companies like Group-IB have studied these attacks in detail. Their report The Anatomy of a Deepfake Voice Phishing Attack explains that today, with just a few seconds of recorded audio, it’s possible to generate realistic imitations that replicate the timbre, tone and speaking style of a voice.
Once cloned, the voice can be used in calls or audio messages to impersonate a relative, a colleague or an executive, creating urgency and exploiting trust to obtain money transfers or sensitive information.
According to Group-IB’s research, global losses from this kind of attack could reach USD 40 billion by 2027, and less than 5% of the stolen funds are ever recovered.
This wasn’t just an account takeover. It was an emotional impersonation, where the most valuable asset wasn’t the access itself, but the trust that voice could generate.
Why these scams work
These campaigns don’t rely primarily on technical vulnerabilities, but on human vulnerabilities. They work because:
- A familiar voice is powerful.
- They create emotional urgency.
- They exploit the channels we use every day.
- And, above all, many people still don’t know this is possible.
In regions where digital literacy isn’t yet part of everyday life, this type of attack is spreading fast.
How to protect yourself
The measures are simple, but very effective when applied consistently:
- Turn on two-step verification. It adds an extra PIN when WhatsApp is installed on a new device.
- Never share verification codes. No legitimate person or company will ever need you to send them.
- Always confirm through another channel. If someone you know asks you for money, call them first. Verify before acting.
- Talk about it and share what you know with your family and your trusted circle. Especially with older relatives, who are less familiar with these technologies.
- Use call blockers and spam-detection tools. Apps like Truecaller help filter unknown numbers or ones reported as fraudulent by other people, and reduce the risk of falling for pretexting attempts.
Final thoughts
This case isn’t an isolated incident. It’s a clear sign of where cybercrime is heading: a landscape where social engineering is amplified by artificial intelligence to undermine what we thought was untouchable — our identity, our emotions and our relationships of trust.
Fake voices don’t just impersonate identities; they erode the social contract that holds human communication together. If we can’t trust the voice speaking to us, the very core of digital interaction — and increasingly of human interaction — is called into question.
The combination of generative AI and psychological manipulation means traditional defenses are no longer enough. Firewalls and antivirus aren’t sufficient anymore; what we need is mass digital literacy, everyday verification protocols and a cultural shift that prepares us for a world where seeing and hearing no longer guarantee the truth.
The question isn’t whether AI will be used to scam: it already is. The real question is whether we’ll keep looking the other way.
Digital freedom isn’t granted: it’s built. It grows by learning, questioning and acting, before someone else decides for you.
Talking about cybersecurity in this context means talking about digital sovereignty: the right to control our identity, our communications and our voice. It’s not a niche topic reserved for specialists, but a central dimension of modern citizenship.
Originally published on Medium.
/ comments .
What did you think?
No account needed: leave your comment and your email, and you'll get a link to confirm it.