Gmail users started getting account recovery calls that sounded exactly like Google support. They were not Google. They were AI-cloned voices running a scam script, and plenty of people handed over their credentials.
How the scam worked
The attackers spoofed caller ID to show a Google number, then played a cloned voice walking the victim through recovery. The voice was calm, professional, patient. It asked for verification codes. Victims read out the 2FA codes from their phones, and the scammers walked straight into their accounts.
Voice cloning killed the old advice about listening for accents. The scammers even handled objections smoothly, because the script anticipated them. If you have ever wondered how to detect deepfake voice calls, the uncomfortable answer starts here: you often cannot, by ear alone. That is why the detector matters more than your instincts.
Detection angle
Voice deepfake detection analyses call audio for synthetic artefacts in real time. A deepfake voice detector checks for the acoustic fingerprints of cloning: too-perfect cadence, missing micro-pauses, spectral oddities. The tools to detect fake voice are moving into call-screening apps.
Simple rule: Google will never call you about account recovery. Hang up, open the app yourself, check there. No legitimate support flow starts with an inbound call asking for codes. Tell your parents about this one specifically. Older users are the prime targets, and they grew up trusting a professional-sounding voice.
Never read out a code to a caller. Ever. Scammers count on politeness and panic in equal measure. Be rude, hang up, check the app yourself. Try the AI Detector on suspicious call audio.
Incident facts
- Date: 2024-01-01
- Company / actor: Not disclosed
- Harm type: privacy breach
- Severity: medium
- Source: AIAAIC Repository
