{"id":102940,"date":"2026-09-03T12:14:50","date_gmt":"2026-09-03T10:14:50","guid":{"rendered":"https:\/\/eiposgrados.com\/?p=102940"},"modified":"2026-09-03T12:44:30","modified_gmt":"2026-09-03T10:44:30","slug":"your-voice-is-no-longer-enough-this-is-how-ai-fraud-works-impersonating-family-members-and-executives","status":"publish","type":"post","link":"https:\/\/eiposgrados.com\/eng\/blog\/tu-voz-ya-no-basta-asi-funciona-el-fraude-con-ia-que-suplanta-a-familiares-y-directivos\/","title":{"rendered":"Your voice is no longer enough: this is how AI fraud works to impersonate family members and executives"},"content":{"rendered":"<p class=\"wp-block-paragraph\">For decades, recognizing a voice on the other end of the phone was enough to know who we were talking to. Artificial intelligence has shattered that certainty.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Today, a criminal can mimic another person&#039;s tone, accent, and pauses to impersonate a family member, financial manager, or executive. If that call comes after an alarming message and presents an urgent decision, the deception can be completed before the victim has time to verify what&#039;s happening.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The National Cybersecurity Institute (INCIBE) has documented several frauds of this type in Spain during the first months of 2026. In one case, attackers cloned the voice of the head of a company in the retail sector to divert payments to accounts under their control. In another, they used the voice of a family member to lend credibility to the scam.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This isn&#039;t just a new form of impersonation. It&#039;s a sign that the voice is no longer a reliable proof of identity.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is a hybrid scam and why is it so convincing?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">INCIBE uses the expression <strong>hybrid scam<\/strong> to describe frauds that link several resources in a single operation. The pattern can develop as follows:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>The victim receives an SMS that appears to be from their bank, a well-known company, or a trusted person.<\/li>\n\n\n\n<li>Seconds or minutes later, he receives a call confirming the supposed problem.<\/li>\n\n\n\n<li>The voice on the other end seems to belong to a family member, a colleague, or a manager.<\/li>\n\n\n\n<li>During the conversation, bank details, verification codes, or immediate authorization for a transfer are requested.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Anything can happen in less than ten minutes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The effectiveness of the method depends not only on the quality of the synthetic voice, but also on the order in which the stimuli appear. An isolated text message can raise suspicions. So can an unexpected phone call. However, when both channels reinforce each other, the message justifies the call, and the call makes the message seem authentic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fraud, therefore, does not eliminate the victim&#039;s verification process: it imitates and manipulates it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What has changed with the blocking of fraudulent SMS messages?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Since June 7, 2026, the blocking obligations provided for in Order TDF\/149\/2025 have been in force. In addition, there is the circular approved by the National Commission of Markets and Competition to regulate the registration of aliases used as SMS senders.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These measures make it more difficult for a fraudulent message to reach a phone by displaying the name of a legitimate entity, such as a bank. This is a significant step forward in the fight against fraud. <em>smishing<\/em>, But it does not by itself solve the cloned voice fraud.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The calls operate through a different channel and are not covered in the same way by the regulations. When one channel becomes less accessible, criminals adapt their methods and shift the pressure to other channels. In this case, they exploit one where the user has few clues to distinguish a real caller from a fake.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Can they clone your voice just by saying &quot;hello&quot;?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most widespread messages on social media claims that simply answering a call and saying a word is enough for criminals to capture your voice and create a convincing copy. This claim is unsubstantiated and conflates synthetic voice fraud with old warnings about the so-called &quot;yes&quot; scam.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The real risk is different. Attackers can obtain voice samples from materials that are already available or circulating among third parties:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Videos posted on social media.<\/li>\n\n\n\n<li>Interviews and podcasts.<\/li>\n\n\n\n<li>Seminars, meetings or recorded events.<\/li>\n\n\n\n<li>Forwarded audio messages.<\/li>\n\n\n\n<li>Presentations and public appearances.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, individuals with greater exposure and those with the authority to authorize payments are particularly attractive targets. So are their family members and closest associates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The difference is significant: avoiding saying &quot;hello&quot; doesn&#039;t offer effective protection. Changing verification procedures does.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to protect yourself against a call with a cloned voice<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The first rule is simple: <strong>A recognizable voice should not be considered proof of identity.<\/strong>. From there, both families and businesses can reduce the risk with concrete measures.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">In the personal sphere<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Agree on a security word or question that does not appear on social media.<\/li>\n\n\n\n<li>Hang up and call back using a previously saved number.<\/li>\n\n\n\n<li>Confirm the situation through another channel before sending money or sharing data.<\/li>\n\n\n\n<li>Be wary of any request that combines urgency, secrecy, and emotional pressure.<\/li>\n\n\n\n<li>Limit the indiscriminate publication of audio and video recordings, especially of minors and family members.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">In companies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prohibit a transfer from being authorized solely through a phone call or voice note.<\/li>\n\n\n\n<li>Apply double approval to sensitive payments or payments outside of normal patterns.<\/li>\n\n\n\n<li>Verify any bank account changes with a previously validated contact.<\/li>\n\n\n\n<li>Establish alternative and known channels to confirm urgent requests.<\/li>\n\n\n\n<li>Train the staff with simulations that include <em>smishing<\/em>, social engineering and synthetic voice.<\/li>\n\n\n\n<li>Define a response procedure that allows for blocking payments, preserving evidence, and quickly reporting the incident.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The key is to maintain protocol even when the caller appears to be exactly who they claim to be. Effective control relies not on employee intuition, but on a process that can withstand pressure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What legal consequences can voice impersonation have?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Voice cloning fraud can lead to several criminal charges simultaneously. According to criminal lawyer Juan Antonio Signes Garc\u00eda, partner at Sanahuja Abogados Penalistas and member of the European Criminal Bar Association, these cases may involve fraud under Article 248 of the Spanish Penal Code, identity theft under Article 401, and the discovery and disclosure of secrets under Article 197.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When the amount defrauded exceeds \u20ac50,000, the penalty can reach six years in prison. However, for an organization, the legal response comes after the damage has already been done. The priority should be preventing identity theft from becoming a valid order within its processes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The other risk: there is a lack of professionals capable of anticipating problems.<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Reviewing payment controls, analyzing risks, adapting procedures to regulations, and preparing incident responses require professionals who combine technical, legal, and organizational knowledge. This talent is in short supply.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During the presentation of <em>Study on the cybersecurity industry in Spain 2025<\/em>, prepared by INCIBE and CONETIC, the president of the latter, Jos\u00e9 Luis Pancorbo, pointed out that the <strong>76 % of the cybersecurity vacancies offered remain unfilled<\/strong> due to the gap between companies&#039; needs and the available professionals. INCIBE provides another significant statistic: only two out of every ten positions are filled with internal talent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Demand in the sector is growing, but mastering defensive tools is no longer enough. Organizations need specialists who can understand how technology, social engineering, regulatory compliance, and internal processes intersect.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Training for cybersecurity that has already changed<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Voice cloning fraud perfectly encapsulates the current challenge: the threat uses artificial intelligence but exploits human decisions and organizational failures. Therefore, the solution requires professionals with a holistic perspective.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">He <a href=\"https:\/\/eiposgrados.com\/eng\/programs\/master-in-cybersecurity\/?source=medio-notaprensa\">Master&#039;s Degree in Cybersecurity from EIP International Business School<\/a> It covers areas such as fraud prevention, identity verification, regulatory compliance, and incident response. Furthermore, it offers preparation for certifications such as OSCP and CCSP, which are highly valued in industry recruitment processes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a market where three out of four vacancies remain unfilled, specializing in cybersecurity not only provides access to an area with growing demand, but also prepares individuals to solve problems that are already affecting businesses and individuals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/eiposgrados.com\/eng\/programs\/master-in-cybersecurity\/?source=medio-notaprensa\"><strong>Check out the Master&#039;s in Cybersecurity program and discover its career opportunities<\/strong><\/a><strong>.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For decades, recognizing a voice on the other end of the phone was enough to know who we were talking to. Artificial intelligence has shattered that certainty.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Today, a criminal can mimic another person&#039;s tone, accent, and pauses to impersonate a family member, financial manager, or executive. If that call comes after an alarming message and presents an urgent decision, the deception can be completed before the victim has time to verify what&#039;s happening.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The National Cybersecurity Institute (INCIBE) has documented several frauds of this type in Spain during the first months of 2026. In one case, attackers cloned the voice of the head of a company in the retail sector to divert payments to accounts under their control. In another, they used the voice of a family member to lend credibility to the scam.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This isn&#039;t just a new form of impersonation. It&#039;s a sign that the voice is no longer a reliable proof of identity.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is a hybrid scam and why is it so convincing?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">INCIBE uses the expression <strong>hybrid scam<\/strong> to describe frauds that link several resources in a single operation. The pattern can develop as follows:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>The victim receives an SMS that appears to be from their bank, a well-known company, or a trusted person.<\/li>\n\n\n\n<li>Seconds or minutes later, he receives a call confirming the supposed problem.<\/li>\n\n\n\n<li>The voice on the other end seems to belong to a family member, a colleague, or a manager.<\/li>\n\n\n\n<li>During the conversation, bank details, verification codes, or immediate authorization for a transfer are requested.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Anything can happen in less than ten minutes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The effectiveness of the method depends not only on the quality of the synthetic voice, but also on the order in which the stimuli appear. An isolated text message can raise suspicions. So can an unexpected phone call. However, when both channels reinforce each other, the message justifies the call, and the call makes the message seem authentic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fraud, therefore, does not eliminate the victim&#039;s verification process: it imitates and manipulates it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What has changed with the blocking of fraudulent SMS messages?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Since June 7, 2026, the blocking obligations provided for in Order TDF\/149\/2025 have been in force. In addition, there is the circular approved by the National Commission of Markets and Competition to regulate the registration of aliases used as SMS senders.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These measures make it more difficult for a fraudulent message to reach a phone by displaying the name of a legitimate entity, such as a bank. This is a significant step forward in the fight against fraud. <em>smishing<\/em>, But it does not by itself solve the cloned voice fraud.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The calls operate through a different channel and are not covered in the same way by the regulations. When one channel becomes less accessible, criminals adapt their methods and shift the pressure to other channels. In this case, they exploit one where the user has few clues to distinguish a real caller from a fake.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Can they clone your voice just by saying &quot;hello&quot;?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most widespread messages on social media claims that simply answering a call and saying a word is enough for criminals to capture your voice and create a convincing copy. This claim is unsubstantiated and conflates synthetic voice fraud with old warnings about the so-called &quot;yes&quot; scam.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The real risk is different. Attackers can obtain voice samples from materials that are already available or circulating among third parties:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Videos posted on social media.<\/li>\n\n\n\n<li>Interviews and podcasts.<\/li>\n\n\n\n<li>Seminars, meetings or recorded events.<\/li>\n\n\n\n<li>Forwarded audio messages.<\/li>\n\n\n\n<li>Presentations and public appearances.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, individuals with greater exposure and those with the authority to authorize payments are particularly attractive targets. So are their family members and closest associates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The difference is significant: avoiding saying &quot;hello&quot; doesn&#039;t offer effective protection. Changing verification procedures does.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to protect yourself against a call with a cloned voice<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The first rule is simple: <strong>A recognizable voice should not be considered proof of identity.<\/strong>. From there, both families and businesses can reduce the risk with concrete measures.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">In the personal sphere<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Agree on a security word or question that does not appear on social media.<\/li>\n\n\n\n<li>Hang up and call back using a previously saved number.<\/li>\n\n\n\n<li>Confirm the situation through another channel before sending money or sharing data.<\/li>\n\n\n\n<li>Be wary of any request that combines urgency, secrecy, and emotional pressure.<\/li>\n\n\n\n<li>Limit the indiscriminate publication of audio and video recordings, especially of minors and family members.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">In companies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prohibit a transfer from being authorized solely through a phone call or voice note.<\/li>\n\n\n\n<li>Apply double approval to sensitive payments or payments outside of normal patterns.<\/li>\n\n\n\n<li>Verify any bank account changes with a previously validated contact.<\/li>\n\n\n\n<li>Establish alternative and known channels to confirm urgent requests.<\/li>\n\n\n\n<li>Train the staff with simulations that include <em>smishing<\/em>, social engineering and synthetic voice.<\/li>\n\n\n\n<li>Define a response procedure that allows for blocking payments, preserving evidence, and quickly reporting the incident.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The key is to maintain protocol even when the caller appears to be exactly who they claim to be. Effective control relies not on employee intuition, but on a process that can withstand pressure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What legal consequences can voice impersonation have?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Voice cloning fraud can lead to several criminal charges simultaneously. According to criminal lawyer Juan Antonio Signes Garc\u00eda, partner at Sanahuja Abogados Penalistas and member of the European Criminal Bar Association, these cases may involve fraud under Article 248 of the Spanish Penal Code, identity theft under Article 401, and the discovery and disclosure of secrets under Article 197.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When the amount defrauded exceeds \u20ac50,000, the penalty can reach six years in prison. However, for an organization, the legal response comes after the damage has already been done. The priority should be preventing identity theft from becoming a valid order within its processes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The other risk: there is a lack of professionals capable of anticipating problems.<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Reviewing payment controls, analyzing risks, adapting procedures to regulations, and preparing incident responses require professionals who combine technical, legal, and organizational knowledge. This talent is in short supply.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During the presentation of <em>Study on the cybersecurity industry in Spain 2025<\/em>, prepared by INCIBE and CONETIC, the president of the latter, Jos\u00e9 Luis Pancorbo, pointed out that the <strong>76 % of the cybersecurity vacancies offered remain unfilled<\/strong> due to the gap between companies&#039; needs and the available professionals. INCIBE provides another significant statistic: only two out of every ten positions are filled with internal talent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Demand in the sector is growing, but mastering defensive tools is no longer enough. Organizations need specialists who can understand how technology, social engineering, regulatory compliance, and internal processes intersect.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Training for cybersecurity that has already changed<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Voice cloning fraud perfectly encapsulates the current challenge: the threat uses artificial intelligence but exploits human decisions and organizational failures. Therefore, the solution requires professionals with a holistic perspective.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">He <a href=\"https:\/\/eiposgrados.com\/eng\/programs\/master-in-cybersecurity\/?source=medio-notaprensa\">Master&#039;s Degree in Cybersecurity from EIP International Business School<\/a> It covers areas such as fraud prevention, identity verification, regulatory compliance, and incident response. Furthermore, it offers preparation for certifications such as OSCP and CCSP, which are highly valued in industry recruitment processes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a market where three out of four vacancies remain unfilled, specializing in cybersecurity not only provides access to an area with growing demand, but also prepares individuals to solve problems that are already affecting businesses and individuals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><a href=\"https:\/\/eiposgrados.com\/eng\/programs\/master-in-cybersecurity\/\" data-type=\"link\" data-id=\"https:\/\/eiposgrados.com\/programas\/master-en-ciberseguridad\/\">Check out the Master&#039;s program in Cybersecurity and discover its career opportunities.<\/a><\/strong><\/p>","protected":false},"excerpt":{"rendered":"<p>For decades, recognizing a voice on the other end of the phone was enough to know who we were talking to. Artificial intelligence has shattered that certainty. Today, \u2026 <a title=\"Your voice is no longer enough: this is how AI fraud works to impersonate family members and executives\" class=\"read-more\" href=\"https:\/\/eiposgrados.com\/eng\/blog\/tu-voz-ya-no-basta-asi-funciona-el-fraude-con-ia-que-suplanta-a-familiares-y-directivos\/\" aria-label=\"Read more about Your voice is no longer enough: this is how AI fraud works that impersonates family members and executives\">Read more<\/a><\/p>","protected":false},"author":4544,"featured_media":102941,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[142],"tags":[1525],"class_list":["post-102940","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-ciberseguridad"],"acf":[],"_links":{"self":[{"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/posts\/102940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/users\/4544"}],"replies":[{"embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/comments?post=102940"}],"version-history":[{"count":0,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/posts\/102940\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/media\/102941"}],"wp:attachment":[{"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/media?parent=102940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/categories?post=102940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eiposgrados.com\/eng\/wp-json\/wp\/v2\/tags?post=102940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}