Is That Voice Real? How to Protect Yourself From Deepfakes and Impersonation Scams

A familiar voice can immediately build trust. If a family member, coworker, company executive, or financial professional calls with an urgent request, your first instinct may be to help.

But what if the voice is not real?

Artificial intelligence can be used to create convincing audio, video, images, and written messages that imitate real people. These forms of manipulated or artificially generated content are often called deepfakes. Fraudsters may use them to pose as someone you recognize and pressure you into sharing sensitive information, transferring money, or taking another action before you have time to verify the request.

The technology may be new, but the strategy is familiar. Impersonation scams continue to rely on trust, urgency, and authority. Understanding how these schemes work can help you pause, verify the situation, and respond safely.

What Are Deepfakes and Voice Cloning?

A deepfake is artificially generated or manipulated audio, video, or imagery designed to make it appear that someone said or did something that never occurred.

Voice cloning is one example. Artificial intelligence may be used to generate speech that sounds like a particular person. The result may imitate the person’s tone, speaking style, or manner of expression.

These tools can have legitimate uses, but fraudsters may use synthetic audio or video to support an impersonation scam. CNB cybersecurity communications have previously warned employees that criminals may use fake voices or recordings to imitate leaders, coworkers, or family members.

A fraudulent request may appear to come from:

• A family member who claims to be in trouble
• A company executive requesting an urgent payment
• A coworker asking for confidential information
• A vendor providing revised payment instructions
• A bank or fraud representative discussing suspicious activity
• A government or law-enforcement official requesting information

The communication may arrive through a phone call, voicemail, video call, text message, email, social media platform, or messaging application.

Why Impersonation Scams Can Be Convincing

Fraudsters do not rely on technology alone. A convincing impersonation attempt may combine artificial intelligence with publicly available information, stolen data, social media content, and familiar business details.

The person contacting you may know a name, job title, company, vendor relationship, family connection, or recent event. That knowledge can make the communication feel legitimate, but knowing personal or business information does not prove that the person is authentic.

Fraudsters may also begin with a text or email before moving the conversation to a phone call, voice message, or another messaging platform. The FBI has warned about malicious actors using text messages and AI-generated voice messages to impersonate trusted authority figures and establish rapport before attempting to access accounts, information, or funds.

The most important question is not simply, “Does this sound real?” It is, “Can I verify this request through a separate, trusted channel?”

Warning Signs of an Impersonation Scam

1. The Request is Urgent or Secret

The caller may say immediate action is needed to prevent a loss, complete a transaction, help someone in danger, or address a confidential matter.

A request for secrecy is another warning sign. Be cautious if someone tells you not to contact another employee, family member, financial institution, or law-enforcement agency.

Urgency and secrecy are intended to limit the time you have to think and verify.

2. The Request Involves Money or Sensitive Information

Treat unexpected requests for payments, wire transfers, gift cards, cryptocurrency, account credentials, one-time passcodes, or personal data with caution.

For businesses, fraudsters may impersonate an executive and request an urgent invoice payment or financial action. An internal CNB security alert identified urgent financial requests, invoice references, unusual email addresses, secrecy, and attempts to move a conversation to another contact as warning signs of executive impersonation.

3. The Person Discourages Independent VBerification

A legitimate contact should not object to your confirming a request.

Be cautious if the person insists that you stay on the line, use a telephone number provided in the message, move to a different platform, or avoid contacting the individual or organization through established channels.

4. The Context Does Not Fit Normal Behavior

Consider whether the request matches what the person would ordinarily ask you to do.

An executive who does not normally approve transactions by text, a vendor unexpectedly changing payment instructions, or a family member asking for money through an unfamiliar account should prompt additional verification.

5. The Audio or Video Seems Unusual

Some manipulated content may contain an unnatural speaking cadence, mismatched audio, unexpected pauses, visual inconsistencies, or movements that do not appear synchronized.

However, synthetic content may not always show an obvious technical flaw. Do not make your decision based solely on whether the voice or video looks convincing.

How to Verify an Unexpected Request

When a communication involves money, credentials, sensitive information, or a change in payment instructions, stop and verify before taking action.

Use contact information you already trust

End the call or message and contact the person directly using a telephone number, email address, or internal directory you have used before. Do not rely on contact information provided in the suspicious communication.

Confirm through a second channel

If a request arrives by email, verify it by calling a known number. If it arrives by phone, contact the individual through an established email address or another trusted method.

Businesses should independently confirm payment requests and changes to vendor instructions according to existing approval procedures.

Ask a question only the real person would know

For personal communications, consider asking something that would be difficult for an impersonator to answer. Families may also establish a private verification word for urgent situations.

This should complement, not replace, independent verification through a trusted contact method.

Do not share authentication codes

Never provide your password, one-time passcode, secure access code, password-reset code, or multifactor authentication code in response to an unexpected request.

If someone claims such information is needed to protect your account, stop the interaction and contact the organization directly.

Report suspicious activity promptly

If you believe someone is impersonating a trusted contact or organization, report the communication through the appropriate channel. If financial or account information may have been compromised, contact your financial institution promptly and review your accounts for unfamiliar activity.

Trust the Relationship, but Verify the Request

A familiar voice, face, name, or telephone number is no longer enough to confirm a person’s identity.

The best defense against deepfake and impersonation scams is a consistent verification habit. Pause when a request involves urgency, money, authentication codes, confidential information, or unusual instructions. Then confirm the request using contact information and communication channels you already trust.

Taking an extra moment to verify can help protect your identity, accounts, business, and financial information.

Visit City National Bank’s Fraud Prevention & Security Center for additional resources and practical guidance to help protect yourself and your finances.

Please note: The content in this article comes from individual opinions and experiences. The content should not be taken as advice coming from City National Bank of Florida. City National Bank of Florida does not offer tax, legal or accounting advice. CNBFL Member FDIC.