AI Deepfake Voice Scam Epidemic: 1 in 4 Americans Targeted

One in four Americans — 25% — report receiving an AI-generated deepfake voice call in the past twelve months. Drawn from Hiya’s survey of more than 12,000 consumers, it is the first large-scale primary measurement of synthetic-voice fraud targeting ordinary Americans. ^[1] An additional 24% said they could not determine whether calls were AI-generated — meaning a combined 49% are either confirmed targets or functionally defenseless when they answer the phone. ^[14]

That figure is self-reported: respondents flagged calls as deepfakes on suspicion, not technical verification, and may conflate robotic voices or awkward pauses with AI. But the direction is independently validated by Pindrop’s technically measured contact-center data. ^[2] When Hiya asked whether carriers or scammers are winning, scammers won nearly two-to-one; 72% of Americans now support stronger government regulation of AI voice fraud — the clearest signal that voluntary, market-driven solutions have not answered the threat. ^[1][14]

Voice cloning crossed two thresholds at once in 2024–2025: quality and cost. On quality, University at Buffalo forensics director Siwei Lyu told Fortune that cloning has reached the “indistinguishable threshold,” generating audio with natural intonation, rhythm, emphasis, emotion, pauses, and breathing noise — describing software available today, not a future capability. ^[4]

On cost: in February 2025, Zyphra unveiled models that clone a voice from as little as five seconds of audio, and commercial tools now routinely clone from 3–15 seconds — audio harvestable from any public video, voicemail, or recorded call. ^[11] Some offer a free tier; paid plans start around $5/month, with no technical expertise required and phone-grade audio sufficient. The workflow is industrialized: find a target online, extract a sample, clone in seconds, and call their family or colleagues — major retailers report more than 1,000 AI-generated scam calls per day. ^[5] As Experian’s Kathleen Peters framed it, the old human-versus-bot binary has collapsed; the new problem is telling a malicious bot from a benign one in real time. ^[12] Deepfake volume online grew from an estimated 500,000 items in 2023 to roughly 8 million by the end of 2025 — near 900% annual growth. ^[4]

Pindrop analyzed over 1.2 billion calls through its deployed contact-center security platform — instrumented measurement, not survey data. ^[2] The headline: deepfake fraud attempts surged 1,300% between 2023 and 2024, from roughly one attempt per month to seven per day in monitored centers — one every 46 seconds. CEO Vijay Balasubramaniyan: “Voice fraud is no longer a future threat — it’s here, and it’s scaling at a rate no one could have predicted.” ^[2]

By sector, insurance led with a +475% increase in synthetic-voice attacks, banking +149%, and retail +107%, with 1 in every 127 calls now a fraud attempt. ^[15] The Pindrop figure is a known lower bound — it covers only Pindrop-monitored environments. Separate analysis by Infosecurity Magazine found AI-enabled voice and virtual-meeting fraud surged over 1,000% (1,210%) in 2025, versus a 195% rise in traditional fraud — the clearest sign that AI has become the dominant driver of fraud escalation. ^[15]

Voice deepfake fraud falls hardest on older Americans. The grandparent scam — cloning a relative’s voice to call an elderly family member in a fake emergency — has been transformed by AI from crude impersonation into an attack that defeats human detection. ^[6] Hiya found seniors (55+) lose an average of $1,298 per deepfake voice incident, roughly triple younger adults’ losses. ^[14] The FBI’s 2024 Internet Crime Report is starker: Americans 60 and older filed 147,127 complaints reporting nearly $4.9 billion in losses — up 43% from 2023 — with 7,500 victims each losing more than $100,000. ^[22] FTC data show losses among older adults quadrupled from $600 million in 2020 to $2.4 billion in 2024. ^[7]

The harm extends to enterprises. A Singapore finance director authorized a $499,000 wire transfer after joining a Zoom call in which every face and voice was AI-generated. ^[5] The benchmark case remains the 2024 Arup incident, in which the firm lost $25 million; average enterprise loss per deepfake incident runs near $500,000. ^[10] Vishing surged 442% in 2025 as tools hit commodity pricing, and adults 60+ account for 58% of tech-support scam losses — a category where voice social engineering is the primary vector. ^[23]

The most structurally significant finding is not the scale of the attack — it is the inadequacy of the defense. Human listeners achieve only about 24.5% accuracy identifying high-quality deepfake audio; only 0.1% of study participants correctly identified every fake and real sample. For high-quality synthetic voice, human detection performs worse than chance. ^[10]

The best free public tool — the DeepFake-o-Meter from Siwei Lyu’s University at Buffalo lab — reached 69.7% likelihood accuracy in Poynter’s independent test on the January 2024 New Hampshire Biden robocall, the highest of four free tools tested. ^[24] It returns results in under 60 seconds and has processed 6,300+ submissions since its November 2024 launch — but it requires a file upload and cannot intercept a live call. ^[24] So the best available public tool misses roughly 30 of every 100 deepfakes even in controlled conditions, and for a real-time phone call, no comparable consumer tool exists at all. Enterprise platforms like Pindrop’s apply real-time detection, but only inside institutions that deployed them; individuals on personal phones have essentially none. That asymmetry between attack accessibility and defense accessibility is the core structural problem. ^[4]

On February 8, 2024, the FCC ruled unanimously that AI-generated voices are “artificial” under the Telephone Consumer Protection Act, making AI voice robocalls illegal without prior consent — triggered partly by the New Hampshire cloned-Biden robocall telling voters to stay home. ^[19] A July 2024 proposal to require in-call AI disclosure remained in comment review as of March 2026. The FTC finalized its impersonation rule in April 2024 (penalties up to $53,088 per violation) and brought five enforcement cases in its first year, plus Operation AI Comply. ^[16] It also ran a competition seeding four technical countermeasures — none yet mandated at the carrier level — while a proposal to extend the rule to individuals stays pending. ^[17][18]

At the state level, Tennessee’s ELVIS Act (March 2024) was the first U.S. law to protect individual voices from AI cloning, passing 93–0 and 30–0. ^[25] By 2025 the Transparency Coalition counted 73 new AI laws across 27 states. ^[27] Congress has three tracks, none addressing real-time voice authentication at the carrier level: the TAKE IT DOWN Act (signed May 2025) covers intimate imagery, not voice fraud; the NO FAKES Act carries roughly a 5% enactment probability; and the Preventing Deep Fake Scams Act creates a study group, not a prohibition. ^[9][26]

The epidemic is real, measurable, actively accelerating, and structurally unaddressed. The statistics are not contested: a technically verified 1,300% surge in attempts, $12.5 billion in government-certified U.S. fraud losses in 2024, and a detection gap where the best public tool misses 30% while humans do worse than chance. The technology moved faster than the institutions built to contain it — what once required specialist hardware is now a consumer subscription. ^[7][17][19]

Researchers frame the fix clearly: shift defense from human judgment to infrastructure-level AI detection and cryptographic media provenance. Carriers already authenticate call origin at scale via STIR/SHAKEN — but that verifies origin, not content, and cannot detect AI audio inside an authenticated call. ^[8] The FBI’s advice to “listen closely” is, at 24.5% human accuracy, a ritual of false confidence, not a defense. ^[20] Deloitte projects $40 billion in annual AI-enabled fraud losses by 2027 — a 32% compound growth rate. Without infrastructure-level intervention, the question is not whether the epidemic worsens, but by how much before defenses catch up. ^[3][13]