Guides · Generative AI

Deepfake and AI Voice Clone Scams: How to Spot Them and What to Do (India Guide)

By Ravindra Bagale, trainer · LinkedIn · Published: 19 October 2026 · Last updated: 19 October 2026 · 9 min read

A deepfake scam uses AI to copy a real person's face or voice, usually a family member, your boss, a police officer or a celebrity, and then pushes you to send money or share an OTP urgently. The defence is a habit, not an app: stop, hang up, and call the person back on the number you already have saved, or ask a family code word. If you have lost money, call 1930 at once and report at cybercrime.gov.in. Report suspected fraud calls and messages on Sanchar Saathi.

1. Suppose our phone rings at 11 pm

Suppose we are Sunita, a teacher in Nagpur. At 11 pm we get a call from an unknown number. We hear our son Rohan's voice, crying:

"Aai, I had an accident on the highway. The police are here. Please send
₹40,000 on this number right now. Don't tell Baba, please, just send it."

The voice sounds exactly like Rohan. We panic. Our hand is already on the UPI app.

Now we stop for 10 seconds and follow one rule: hang up and call Rohan on his saved number. He answers from his hostel in Pune, half asleep. He is fine. The call was an AI voice clone made from his Instagram reels.

That one call-back saved the money. The rest of this guide explains why this works, and the other patterns to watch for.

2. What are deepfakes and voice clones?

• A voice clone is an AI copy of someone's voice. The tool learns from a short recording and can then "speak" any sentence in that voice.
• A deepfake is an AI-made or AI-changed video or photo that shows a real person doing or saying something they never did.

The same technology has good uses: dubbing films, helping people who lost their voice, making learning videos. Criminals use it because we trust faces and voices we know.

India's rules: the IT Rules amendment notified by MeitY in February 2026 (in force from 20 February 2026) requires platforms to stop deceptive deepfakes and to clearly label AI-made ("synthetically generated") content. Labels help, but a scammer calling you directly will not label anything. Your habit is the real protection.

3. Four scam patterns, step by step

Pattern 1: the "family emergency" voice call

1. A call from an unknown number, often late at night.
2. A loved one's voice: accident, arrest, hospital, lost phone.
3. Urgency and secrecy: "Send now", "Don't tell anyone".
4. Payment to a UPI ID or account that is not the person's own.

Your move: hang up, call the person on their saved number, or call someone who is with them.

Pattern 2: the "boss on a video call"

1. You are added to an urgent video call or sent a voice note by "your CEO" or "finance head".
2. The face and voice look right, but the camera is often blurry or "the network is bad".
3. The request: transfer money to a new vendor account, buy gift cards, or share a confidential file today.

This is not a theory. In 2024, the engineering firm Arup confirmed that an employee in its Hong Kong office was tricked into transferring about HK$200 million after a video call where the "colleagues" were deepfakes (widely reported, including by CNN and the Financial Times).

Your move: never act on a payment request from a call alone. Confirm on a known phone number or through your company's normal approval process.

Pattern 3: "digital arrest" by fake police

1. A video call from someone in a police, CBI, customs or court uniform, sometimes with a fake office background or a deepfake face.
2. They say your Aadhaar or a parcel is linked to a crime.
3. They say you are under "digital arrest", must stay on the call, and must transfer money "for verification".

Know this: there is no "digital arrest" in Indian law. The Indian Cybercrime Coordination Centre (I4C) has warned that real police and agencies do not arrest people over video calls or ask for money to "clear" a case. Hang up and call 1930.

Pattern 4: the celebrity or expert "investment" video

1. An ad or reel shows a famous businessperson, actor or news anchor recommending a trading app or "AI bot" with guaranteed returns.
2. The lips move a bit oddly, and the link goes to an unknown app or a WhatsApp group.
3. Small "profits" appear in the app at first, then you cannot withdraw.

Your move: real experts do not promise guaranteed returns. Invest only through registered brokers and apps from the official app stores, and check the broker's registration with SEBI.

4. Warning signs (helpful, but not proof)

If you see these signs, it is very likely a scam. If you do not see them, it can still be a scam.

5. Three habits to set up tonight

1. A family code word. Choose a word that is not on social media (not a pet's name you post about). Anyone asking for emergency money must say it.
2. The call-back rule. For any money or OTP request, hang up and call back on a number you saved, never the number that called you.
3. Lock down your voice and photos. Make your Instagram and Facebook accounts private if you can, and think before posting long voice notes or videos of children. Fewer public recordings make cloning harder.

Also:

• Never share OTPs, UPI PINs or card CVVs. Banks and police never ask for them.
• Turn on two-step verification on WhatsApp (Settings → Account → Two-step verification), so a scammer cannot take over your account and message your family as you.
• Teach the elders at home. Scammers often target parents and grandparents. Practise the call-back rule with them once, like a fire drill.

6. If you lost money: do this immediately

1. Call 1930, the national cyber crime helpline. Report quickly; faster reporting gives a better chance that the money can be frozen.
2. Report online at cybercrime.gov.in with the details.
3. Call your bank using the number on your card or the bank's official app, and block the card or UPI if needed.
4. Save the proof: screenshots of chats, the caller's number, the UPI ID, transaction IDs, date and time.
5. Do not pay anyone who promises to "recover" your money. That is often a second scam.

7. Where else to report

8. Beginner mistakes and quick fixes

9. Try at home

Recap

Set the family code word tonight. It takes two minutes, and it is the cheapest protection your family will ever have.

Related: AI Security: Defend Prompt Injection and Data Leakage · What Is Generative AI and How Does ChatGPT Work?

Ravindra Bagale, trainer: linkedin.com/in/ravindra-bagale. Sunita, Rohan and the call are made up for learning. The Arup case is a real, widely reported 2024 incident. Helpline numbers, reporting sites and the 2026 IT Rules amendment were checked on government pages (cybercrime.gov.in, sancharsaathi.gov.in, meity.gov.in) on 19 October 2026.