How three seconds of your voice could let a scammer clean out your account, and how to stop it

A relative’s panicked voice on the phone, begging for money to fix some crisis abroad, used to be difficult to fake convincingly, but Spain’s national cybersecurity agency says criminals can now clone that same voice from as little as three seconds of audio lifted from an old Instagram or TikTok video.

How three seconds of a voice becomes a working clone

The Instituto Nacional de Ciberseguridad (INCIBE), Spain’s national cybersecurity agency, published new guidance on Monday September 14 on so-called deepfake calls, where artificial intelligence rebuilds someone’s voice, including their accent, pauses and even their breathing, well enough to fool close family.

Older warnings about this scam suggested criminals needed around 10 seconds of clear audio to work with. INCIBE’s latest guide puts that figure at just three seconds, lifted from any video already sitting in public view on Instagram, TikTok or any other social media platform. 

The old trick to catch a scammer no longer works

Previous advice for spotting a cloned voice was to ask an unexpected personal question, on the assumption a scammer could only play back a pre-recorded script. INCIBE said the newer tools can now improvise answers in real time, following the conversation rather than reciting fixed lines.

The clearest warning sign left is behaviour rather than the voice itself. INCIBE points to a manufactured sense of urgency, most often a supposed accident, a lost wallet or legal trouble in another country, along with calls that conveniently cut out the moment questions get harder to answer.

More than 135 million suspicious calls blocked this year alone

More than 135 million fraudulent calls have already been blocked across Spain in 2026, according to the guide, and INCIBE estimates that roughly one in three relied on some form of cloned or AI-generated voice.

Anyone who does lose money to the scam loses an average of €577, INCIBE said, and fewer than one in three victims are believed to ever formally report what happened, suggesting the real toll is higher again.

Why the scam lands especially hard for families living apart

For anyone whose parents, children or siblings live in a different country, an unfamiliar-sounding call about a relative in trouble abroad already carries a grim plausibility, exactly the gap the scam is built to exploit. A slightly muffled line or an unrecognised foreign number becomes just another reason not to ask too many questions.

INCIBE’s basic advice, however, is still to hang up the moment pressure builds, and call the relative back only on a number already saved, never one read out by the caller. Families are also encouraged to agree a private word or phrase in advance, something specific and unusual enough that it could not be guessed from anything posted online.

Where to get help if a call feels wrong

INCIBE runs a free helpline, 017, staffed daily from 8am to 11pm and reachable by phone, WhatsApp or Telegram, for anyone unsure whether a call was genuine or wanting to report one. Evidence such as call recordings or messages should be kept rather than deleted, in case a report is needed later.

Technology may soon offer some help of its own. Google is testing extra verification steps inside its Phone app, and the European Union is drawing up rules that would require AI-generated audio and video to carry a clear label, though neither is yet in force.