You appear to be offline. Lookups will resume automatically when your connection returns.
IFSCBank Guide
Englishবাংলাहिन्दी
Fraud defence 10 min read Checked 1 November 2026

AI voice-cloning scams: check the caller before you send money

A short clip of someone’s voice is enough for an AI tool to copy it. Scammers then call as your son, your boss or a bank officer and ask for money in a hurry. You can no longer trust the voice, but you can still check the facts. This page gives you a 60-second check, a family code-word plan, what the RBI’s rules say about refunds, and a checklist for bank staff.

By Ayan Mandal

How the scam works

An AI voice tool needs only a short recording of someone talking: a reel, a YouTube video or a voice note forwarded in a group. From it, the tool makes a copy of the voice that can be made to say anything. CERT-In, the government’s cyber security agency, warns that scammers use such fakes to pose as family members or company bosses and ask for money transfers.

  1. They copy a voice. From a public video, a reel or a forwarded voice note.
  2. They build a story. An accident, an arrest, a hospital bill, or a boss who needs a supplier paid today.
  3. They make it urgent and secret. “Don’t tell Papa.” “I’ll explain later.” “Pay in ten minutes.”
  4. They ask for money to a new account. A “friend’s” UPI ID, a “hospital” account or a QR code, never the person’s own account.

The voice is the only part that sounds real. The new number, the hurry, the secrecy and the stranger’s account are what give the scam away.

An invented example, based on CERT-In’s warning

Two habits saved her money: a code word that had never been typed into any chat, and a call back on the number she already had.

Before you pay: a 60-second check

Tick everything that is true about the call or message. Nothing you tick leaves your device.

About the call or message

One warning sign is enough to stop and check. A real family member or a real officer can wait five minutes while you call back.

Your family plan: a code word and a call back

  • Agree a code word face to face. Pick a word or a question only your family knows. Never put it in WhatsApp, SMS, email or social media, because anything written down can leak.
  • Hang up and call back. Use the number already saved in your phone. If it does not connect, call someone who is with the person: a roommate, a colleague, the hostel office.
  • Ask what a stranger cannot know. Not a birthday or a pet’s name, which are often online. Ask about something that happened at home last week.
  • Make checking normal. Tell your children and parents: “If I ever call for money in a hurry, I will not mind if you call me back first.”
  • Post less of your voice. CERT-In advises limiting the personal photos and videos you share online and using privacy settings, so there is less to copy.
  • Sit with the elders. Older parents and grandparents are often targeted. Spend five minutes going through this page with them.

Our family rule for money calls

  1. Hang up. Even if the voice sounds exactly right.
  2. Call back on the number already saved in the phone.
  3. Ask our code word. Write it here by hand, never online:
  4. Never share an OTP, UPI PIN or card details, and never install an app a caller asks for.

Scammed? Call 1930 now, then the bank. Report at cybercrime.gov.in.

If the caller says they are from a bank or the police

A copied voice can also sound like an official. These facts hold whatever the voice says:

  • Bank calls come from 1600 numbers. The RBI has told banks to make service and transaction calls only from the 1600 series, and promotional calls from the 140 series. Under a TRAI direction of 19 November 2025, commercial banks had to move by 1 January 2026, and co-operative banks, regional rural banks and smaller lenders by 1 March 2026. A “bank” calling about your account from an ordinary 10-digit mobile number is a warning sign.
  • Nobody official asks for your OTP or PIN. No bank, police officer or RBI official needs your OTP, UPI PIN or card details, and none of them will ask you to install an app or share your screen.
  • Bank websites end in .bank.in. Under an RBI circular of 22 April 2025, Indian banks have moved their websites to the .bank.in domain, which only regulated banks can register.
  • There is no “digital arrest”. Police do not arrest anyone over a video call, or ask you to move money to “verify” it. Read how digital arrest hoaxes work.
  • Report the number. If you got a suspected fraud call but lost no money, report it on Chakshu at sancharsaathi.gov.in. Chakshu is not for money already lost: for that, call 1930.

If you already paid

  1. Call 1930 now, or report at cybercrime.gov.in. The sooner you report, the better the chance that the money is held before it leaves the account it went to. Keep the acknowledgement number.
  2. Tell your bank on its 24x7 number, or through the fraud-reporting link in its app, and ask for a complaint number. Have the UTR (the transaction reference), the amount and the time ready.
  3. Save the evidence: the caller’s number, the call log, chat screenshots and the UPI ID or account you paid.
  4. Warn the family. The copied voice is still out there, and the same people may call someone else next.

For the full list, read the first 24 hours after cyber fraud.

Will the bank give the money back?

It depends on when the payment was made and how the bank classifies your case.

  • Payments made up to 31 December 2026. The RBI’s current rules limit your loss for unauthorised transactions, the ones you did not approve. A payment you approved yourself, even because of a fake voice, is usually not covered. A fast report to 1930 is your best chance, because it can get the money held in the account it went to.
  • Payments made from 1 January 2027. The RBI’s revised directions (RBI/2026-27/167, 24 June 2026) cover a wider set of “fraudulent electronic banking transactions”, including payments a customer approves under coercion or duress from someone else. The bank must examine the complaint and reply within 45 calendar days.
  • Small-value compensation from 1 January 2027. If the bank finds the loss genuine but holds you responsible, an individual who lost up to ₹50,000 can still be paid 85% of the net loss, up to ₹25,000, once in a lifetime. The fraud must be reported to the bank and to 1930 or cybercrime.gov.in within five calendar days. This covers frauds in the first year of the new rules.
  • Listen to your bank’s warning. Under the new rules, ignoring a specific, clear warning from your bank that a payment is likely a scam counts as negligence on your part.

For bank staff: the counter checklist

Many of these payments are made at a branch, sometimes by a customer who is still on the phone with the “relative” while standing at the counter. One calm question can stop one.

  • Watch for the pattern: an urgent transfer to a new beneficiary, an anxious customer, a call still running, “my son needs it now”.
  • Ask kindly: “Have you called him back on the number you already have?” Offer a quiet seat and a few minutes to do it.
  • If your system flags the payment as a likely scam, tell the customer clearly, specifically and in their own language, and record that you did. From 1 January 2027 a customer who ignores such a warning is treated as negligent, so a vague warning helps no one.
  • When a customer reports a fraud, register it as a complaint at once and give the complaint number with the date and time. Act to stop further debits, and advise a report on 1930 or cybercrime.gov.in. The RBI’s rules from 1 January 2027 spell this out (paragraphs 76G to 76J).
  • Write the UTR, the amount, the time and the receiving account or UPI ID on the complaint. These details help the receiving bank hold the money.
  • For frauds from 1 January 2027, tell the customer about the five-calendar-day window for the small-value compensation, and give the application form (Annex II(1)) once the bank finds the case genuine.
  • Call customers only from your bank’s registered 1600-series numbers, never from a personal mobile, so that they learn a 10-digit “bank” call is a warning sign.
  • Put a notice at the counter: “Voices can be copied. Call back before you pay.”

Questions people ask

Can AI really copy someone’s voice from a short clip?

Yes. Voice tools need only a short recording, and reels, videos and voice notes provide one. CERT-In warns that deepfake audio is becoming more convincing and harder to detect. Treat a familiar voice as unproven until you have called the person back.

How can I tell a cloned voice?

Often you cannot. CERT-In lists signs such as a robotic-sounding voice, or lip-sync problems and odd movements in a video, but a good fake may show none of them. Rely on the call back and the code word, not on your ear.

Is a video call proof that it is really them?

No. Deepfakes can copy a face as well as a voice. A video call helps only when you place it yourself, to the number you already have, and ask something only that person knows.

I already paid. What do I do first?

Call 1930 or report at cybercrime.gov.in at once, then tell your bank and note the UTR, the amount and the time. Speed matters more than anything else.

Will my bank refund the money?

For payments up to 31 December 2026, a payment you approved yourself is usually not covered by the RBI’s liability rules. From 1 January 2027 the rules also cover payments approved under coercion or duress, and an individual can get 85% of a loss of up to ₹50,000, capped at ₹25,000, once in a lifetime, if the fraud is reported to the bank and to 1930 or cybercrime.gov.in within five calendar days and the bank finds the loss genuine.

Where do I report a suspicious call if I have not lost money?

Use Chakshu on sancharsaathi.gov.in. If you have lost money, Chakshu is the wrong place: call 1930 or report at cybercrime.gov.in.

Is it a crime to use a fake voice to cheat someone?

Yes. The IT Act punishes identity theft (section 66C) and cheating by impersonation using a computer resource (section 66D), and the IT Rules were amended on 10 February 2026 to cover AI-generated content, including impersonation.

Where this comes from

This guide is general information, not legal advice. The facts come from these public sources:

Rules, limits and phone numbers change. Confirm the current details at cybercrime.gov.in, rbi.org.in or with your bank before you act.

All guides Back to top

More guides