AI Vishing and Voice Impersonation

AI vishing has made accessible attacks that previously required sophisticated capabilities. With a sample of 10-30 seconds —obtained from social networks, podcasts, commercial calls or interviews— current generative models produce a cloned voice capable of maintaining a credible telephone conversation. Typical victims are company employees (CEO fraud with urgent transfer order), elderly relatives (impersonation of child/grandchild in simulated emergency) and bank clients (false security alerts).

Voice Cloning Technology

Modern voice synthesis does not imitate timbre generically: it clones a specific person's voice from short samples. Commercial and open-source models reproduce not only tone, but intonation, accent and verbal tics, to the point of sustaining a spontaneous conversation. The technical barrier that once protected victims —the difficulty of forging a recognizable voice— has vanished. This turns any audio recording submitted to a process into potentially deceptive evidence: voice no longer guarantees the identity of the speaker. For this reason, any recording submitted as prosecution evidence must be capable of being subjected to expert contradiction, and not presumed authentic merely because it "sounds" like the accused.

AI Vishing Modus Operandi

The attack follows a recognizable pattern. (1) Sample collection: the attacker obtains audio of the person to be impersonated from social networks, interviews or prior calls. (2) Generation of the cloned voice with the chosen model. (3) Urgent call simulating the executive or relative and breaking the usual protocols: haste, confidentiality, avoidance of video call, change of the normal communication channels. (4) Immediate transfer to a mule account from which the money disperses in minutes. Technically reconstructing this sequence —sampling, generation, call, transfer— is essential both for the prosecution (to establish the fraud) and for the defense (to dispute the recording's authenticity or the diligence required of the victim).

Forensic Acoustic Expert Evidence

Synthetic voice detection relies on spectral and biometric-vocal analysis: identification of frequency fingerprints typical of generative models, inconsistencies in prosody and respiratory rhythm, absence of natural microvariations of human voice, and artifacts in phonetic transitions. Forensic acoustic experts with judicial experience can methodologically document the synthetic nature of audio with high certainty in most cases. When a recording is submitted as evidence of authorship, we seek contradictory acoustic expert evidence: the party submitting the audio bears the burden of establishing its authenticity and integrity.

Applicable Criminal Types

Vishing is, above all, a fraud. The core conduct constitutes the offense of fraud (Art. 248 CP) and, depending on the amount or the modus operandi, aggravated fraud (Art. 250 CP), with imprisonment of 1 to 6 years. When the attacker uses a third party's identity to the latter's detriment, identity impersonation (Art. 401 CP) may concur, punishable by imprisonment of 6 months to 3 years. And if the cloned voice serves to access communications, accounts or protected data, the discovery and disclosure of secrets (Art. 197 CP) comes into play. The exact qualification depends on the result and the means employed, and is frequently resolved as a concurrence of offenses.

Corporate and Personal Defense

The defense adjusts to the client's position. For the affected company or individual, we structure the prosecution, reconstruct the attack vector and analyze the liability of the banking entity: under PSD2 and strong authentication, the bank may respond if it did not apply reasonable controls for atypical operations. Urgent banking cooperation —activating the protocol against suspicious operations and requesting a recall if the transfer is recent— may recover funds. For the accused person, the axis is the contradictory acoustic expert evidence on the recordings and the analysis of the chain of custody. On the preventive plane, a corporate anti-vishing protocol (multichannel verification, double confirmation, keyword) also operates as proof of diligence.