AI-Generated Voice Impersonation in Financial Fraud: A Narrative Review and Proposed Payment Verification Protocol

Abstract

Objective: This narrative review examines how organisations can verify urgent payment requests when a familiar-sounding voice can no longer be treated as reliable evidence of the caller's identity. Methods: This is a structured narrative review. The literature search was run on 28 December 2025 and included only sources published on or before 30 November 2025, a cut-off set by the commissioned brief for this work (Section 2.1). Scholarly databases, technical repositories and primary guidance from law-enforcement and financial-regulatory agencies were consulted. Results: Two frequently cited incidents (the 2019 UK energy-firm case and the 2024 Arup case) are reported in the media as voice- or deepfake-enabled fraud, but neither has public forensic confirmation of synthetic voice; the Arup case additionally involved a video call rather than a voice-only channel. In laboratory experiments on human detection, Mai et al. (2023) found single-clip accuracy of about 73% for deepfake clips and 67.78% for genuine clips, above chance but well below the level required to authenticate a payment request; the clips came from one older text-to-speech system, and brief training raised confidence-weighted accuracy by only 3.84%. Barrington et al. (2025), using commercial ElevenLabs clones of 220 speakers, found that listeners judged a clone to be the same identity as the real speaker about 80% of the time and identified AI-generated voices correctly only about 60% of the time. Müller, Pizzi, et al. (2022) found that players and a detection model struggled with the same attacks, and Warren et al. (2024), with 1,212 participants, reported average accuracy of about 73%, with deepfakes accepted as human more often than genuine clips were rejected. None of these experiments tested listeners known to be familiar with the speaker. Automated detection systems achieve EER below 2% on the ASVspoof 2019 LA benchmark, but Müller, Czempin, et al. (2022) summarise the deterioration on in-the-wild audio as about 200–1,000%, with EERs of 34% to 91% across the configurations they tested (50% is chance). Models trained on clean ASVspoof 2019 data lost 10.7 to 20.5 EER points on telephony-encoded versions of the same attacks (Müller et al., 2024), although the best ASVspoof 2021 system, trained without matched data, still reached an EER of 1.32% on its telephony track (Yamagishi et al., 2021). These findings do not prove that every detector fails in every payment call, but they do argue against relying on detection or human listening alone. Conclusion: On the available evidence, voice similarity is not a reliable authentication factor for high-risk payment requests. The author proposes a four-step procedural protocol (pause the payment, call back on a pre-existing verified number, confirm any new bank details through a genuinely independent channel, and require a second approver above a risk-based threshold) as guidance drawn mainly from established anti-fraud principles and law-enforcement advice, informed by the detection evidence reviewed. The protocol has not been empirically tested as a combined intervention and no specific reduction in fraud is claimed.