Until recently, a cloned voice on the phone was a crude lure: its artificiality was recognisable. Generative models have removed that barrier, and voice fraud has become technically indistinguishable from an authentic voice. This changes the defensive strategy, but does not make it impossible.
How the voice scam works
The most common pattern has three phases: collecting voice material from the victim (voice messages, videos, social media), cloning it and using it in a call in the name of a relative or an official, with an urgent request for a bank transfer. The multi-channel frauds observed in 2026 combine voice, SMS and email to build a composite credibility.
Defence is no longer 'recognise the voice' but 'verify the request through an independent channel'. The rule is simple and must be applied without exception: if someone asks for an urgent transfer, call back on a number already known, not the one provided by the call.
The perpetrator's criminal liability
The criminal profile of whoever carries out the fraud has not changed in structure: it is fraud (Art. 640 c.c.) and, where there is unauthorised access to an information system, Art. 615-ter c.c. The deepfake is not a criminal offence: it is the means. It is the fraud, with its own features, that constitutes the wrongdoing.
On proof, however, the use of artificial intelligence introduces a specific burden: demonstrating that the perpetrator used a generative system. That is an element to be established through expert evidence, and it operates alongside proof of identity and of the subjective element.
The bank's liability: the framework of principles
On the civil side the already-consolidated framework for digital fraud applies: the burden of proof lies with the bank, which must demonstrate the technical regularity of the operation and the adoption of systems suitable for preventing or limiting fraudulent use of payment instruments. The client's gross negligence remains the only ground for excluding the bank's liability.
What voice fraud introduces is that the client's gross negligence is difficult to allege: the customer executed an authorised transfer, with code and authentication, because the voice was indistinguishable from the real one. The fraud does not hide in the account holder's negligence, but in the manipulation of a third party.
What to do concretely after the fraud
Report immediately to the Postal Police, which has jurisdiction over cyber fraud, with a report of theft or cloning of digital identity. Report to the bank, with a formal request for a block and payment/reporting, which must be made promptly. Notify the electronic signature certification body if signature tools were used. And, where the prerequisites are met, report to AGCOM for call-centre cases.
On the civil side, the compensation claim must be built on the decisive element: the reliability of the payment system and the absence of gross negligence by the client. This requires precise documentation of the facts in chronological order.
Prevention: the checklist
Always verify urgent requests through an independent channel. Report suspicious numbers and messages even if you are not the target: early reporting is one of the most effective tools for stopping campaigns. Never share authentication codes or selfies. Consider enabling advanced anti-fraud filters at your bank, which reduce the attack surface. When in doubt, do not make the transfer: the time that seems to be pressing is the time the adversary needs, not you.
Have you been a victim of a voice scam?
The first days are decisive: we act immediately on the report and the claim, building the case on the payment system rather than on negligence.
Talk to us now