The script, not the voice, is what makes AI voice phishing work
The call comes in at 4:40 on a Friday. The voice belongs to a senior manager, or sounds close enough, and she needs a password reset before a flight. She is polite, she is in a hurry, and she has the last four of the badge number.
Researchers at Harvard Kennedy School, Meta and elsewhere ran a version of that moment past 4,100 US adults, using six commercial voice systems and human callers as a control. The results land in an odd place for anyone buying deepfake detection.
The detection number is a mirage
Give people a synthetic voice and they’ll call it out most of the time. That 70.3% sounds like a defense that works. Watch what those same people did with the real callers. They flagged humans as machines two times out of three. What looks like a detection skill is really a room full of people who’ve decided everyone on the phone might be a robot. Suspicion is up. Accuracy has not moved.
Consumer exposure to AI bought nobody anything. People who use AI tools often scored about the same as people who had never touched one, and voice assistant users scored about the same as everyone else. Both differences landed inside noise.
That has an operational cost your fraud team is already paying. Every legitimate outbound call from a bank, a help desk or a security operations center now lands on a population primed to treat unfamiliar callers as synthetic. Callback verification gets harder in both directions.
Persuasion did the work
The study measured four things about each caller: sentiment, persuasiveness, trustworthiness and human-likeness. Then it checked which ones predicted whether someone would go along with the request.
What moved people was persuasiveness. Each step up the scale raised the odds of compliance by a factor of 2.58. How human the voice sounded stopped mattering once the other measures were accounted for. The one thing every detection vendor sells against did none of the independent work.
Detected AI voices still persuaded people. A caller can sound synthetic, get pegged as synthetic, and still walk away with a credit card security code, because the script is doing the persuading.
Participants in the qualitative interviews said as much. One described a caller as “like a software that’s just reinforcing what the programmer gave it” and kept engaging anyway. Others heard rapid, uneven speech and read it as a nervous call center worker.
Read the compliance figures carefully
Across all five scams, about 16.5% of people said they’d go along with it. The fake-relative-in-trouble version got up to 36.1%, and that’s the number every headline is going to grab.
Here’s the catch. Both of those numbers lump together the people who said “yes” and the people who said “maybe.” Pull the clone scenario apart and only 6.5% actually said yes. Everyone else just hesitated.
Hesitation still matters in a scam. A caller who keeps you on the line gets a second attempt. Treating a third of the population as ready to hand over money misreads what was measured.
Two more caveats belong in any internal briefing built on this work. Participants rated recordings of somebody else’s phone call, with no ringing phone and no adrenaline. The cloned voice belonged to a researcher none of them knew, which leaves the nightmare scenario, a clone of your own daughter, untested.
The team also edited the recordings, stripping model refusals, disclaimers and turn-taking beeps. Open-weight systems behave that way already. Locked-down commercial APIs put more friction in an attacker’s path than these clips suggest.
The economics argument needs a footnote
The paper prices human-operated vishing against a $34.55 hourly US wage and finds it a money loser, with AI models penciling out at a few dollars an hour of profit. That framing assumes attackers pay American wages.
Industrial scam operations in Southeast Asia have run voice fraud at volume for years on labor costs nowhere near that. Vishing was economical before any of this. The change AI brings is the removal of language, staffing and geography as constraints, which is a different claim and a more defensible one.
The profit margins in the paper are thin enough that small changes to the assumed conversion rate flip the sign. Treat the direction as sound and the decimal places as decoration.
Where the controls go
Awareness training that teaches people to listen for robotic artifacts trains a skill they lack and a skill that would fail them anyway. The evidence points somewhere else.
Out-of-band verification does the work here. Callbacks to numbers the organization already holds, family code words for relative-in-distress scams, help desk identity proofing that runs on something other than voice recognition, and procedures written so that an inbound caller alone can never trigger a reset, a wire or a credential change.