Listen to this article
Jump to a section
In this article
Executive Summary
On 22 July 2025, Sam Altman was on stage at the Federal Reserve in Washington, talking with Vice Chair for Supervision Michelle Bowman. He said he was surprised that some financial institutions still accept a voiceprint, a spoken challenge phrase, to authorise a large transfer, and that AI “has fully defeated” that kind of check. He added that he was “very nervous” about an impending fraud crisis. The evidence since backs him up. A finance employee in Hong Kong was talked into 15 transfers by a video call in which every other attendee was synthetic. The FBI has told families to agree a secret word. Consumer Reports found that four of six popular voice-cloning products had no meaningful technical safeguard against cloning someone without consent. The practical response is to stop treating a voice or a face as proof of identity, and to build verification that does not depend on recognising anyone.
15
transfers, about US$25.6 million, made by an Arup employee in Hong Kong after a video call with synthetic colleagues, reported May 2024
4 of 6
popular voice-cloning products Consumer Reports found without meaningful technical safeguards against non-consensual cloning, March 2025
3 Dec
2024, when the FBI advised families to create a secret word or phrase to verify a caller’s identity
2
FBI-advised checks that need no recognition of a voice: a family secret word, and hanging up to call back on a number you hold
Core conclusions
- A voice, a face on a call and a selfie are now things an attacker can produce. A check that accepts any of them as sole proof of identity is a weak check, whatever it cost to build.
- The control that still works is to leave the channel the attacker controls: hang up and call back on a number you already hold, or ask for something that was never public.
- Every institution that moves money, and every family, should decide this week which instructions they will not act on from a voice alone.
The argument, in ten slides
Save it, or send it to the person in your organisation who approves payments.
What Altman said at the Federal Reserve
On Tuesday 22 July 2025, Sam Altman appeared at a Federal Reserve conference in Washington, in conversation with Michelle Bowman, the Fed’s Vice Chair for Supervision. Talk turned to fraud. He said:
“Apparently there are still some financial institutions that will accept a voice print as authentication, for you to move a lot of money or do something else. You say a challenge phrase and they just do it. That is a crazy thing to still be doing. AI has fully defeated most of the ways that people authenticate currently, other than passwords.”
He went on to say he was “very nervous that we have an impending, significant fraud crisis”, and that OpenAI and others in the industry had warned that withholding a technology does not keep it from existing: “Some bad actor is going to release it. This is not a super difficult thing to do.”
He then pointed past the telephone. A voice call, he said, is where this starts. “Soon, it’s going to be a video, FaceTime, indistinguishable from reality.” His conclusion was that people will have to change how they verify who they are dealing with. Bowman’s reply was that the Fed could consider partnering with industry on spotting synthetic voices and deliberate impersonation, and she added that she was the parent of two teenagers. I could find no report of a specific Fed action that followed.
I want to take his warning seriously and test it against the record, because a chief executive of an AI company has reasons to talk about AI’s power. The evidence is better than I expected.
Why a voiceprint fails
A voiceprint check compares the sound of a caller’s voice to a stored sample. It was built to be hard for a person to imitate. It was never built for a world where software can produce a close copy from a short recording.
Voice-cloning tools are widely sold, and they are cheap. In March 2025, Consumer Reports assessed six of them: Descript, ElevenLabs, Lovo, PlayHT, Resemble AI and Speechify. For four of the six it found no meaningful technical barrier to cloning a voice without the speaker’s consent. Most relied on a user ticking a box to confirm they had the right. Its researchers built clones from publicly available audio. Recordings of people speaking on podcasts, conference panels and social video are easy to find, and executives, politicians and anyone with a public profile leave a great deal of them.
The study was small, and the providers have changed their controls since. The direction is clear all the same. The cost of producing a convincing voice has fallen to nearly nothing, and the check that depended on that cost being high has lost its protection.
Four of six common checks can be supplied by an attacker.
Against a cloning tool, the first four can be supplied by the attacker. The last two still stand because they do not depend on recognising anyone.
Schematic. Grading follows the post: the Altman remarks at the Federal Reserve, 22 July 2025, the Arup case and FBI alert I-120324-PSA. The held-device row is my recommendation.
Altman made a second point that is easy to miss. He said AI has defeated “most of the ways people authenticate”, other than passwords. That includes a selfie, a wave at the camera and a spoken phrase. These checks share an assumption: that a convincing face or voice is hard to produce. Each time that assumption fails, a check that looked like a strong second factor reduces to something an attacker can supply.
What a convincing fake has already cost
The clearest case is Arup, the British engineering firm. An employee in its Hong Kong office was drawn into a video call with what appeared to be several colleagues. According to Hong Kong police, as reported by RTHK and CNN, every other attendee was a synthetic recreation. The employee went on to make 15 transfers totalling HK$200 million, about US$25.6 million. Arup confirmed to CNN in May 2024 that it had told Hong Kong police in January and that fake voices and images were used.
I would not call that negligence. It is what most of us would do when people we recognise appear on a video call and speak.
The same technique reaches ordinary households. The FBI has warned that criminals generate short audio clips of a loved one’s voice and use them to pose as a relative in crisis, demanding urgent money or a ransom. Altman described it in the same conversation: “There’s obviously some reports now of these sort of ransom attacks where people have the voice of your kid or your parent and they make this urgent call. That is going to get so compelling.”
What these cases share is that the fraud never touches a system. Nothing is hacked. A person is persuaded by a sound or an image they have every reason to trust, and the person authorises the loss themselves. Technical controls on the bank’s side only help if the bank has decided not to rely on the same sound or image.
What a clone cannot do
A cloned voice copies how someone sounds. It does not hold what they know. That gap is where verification now has to live.
A clone cannot answer a question whose answer was never spoken or posted where a model could learn it. It cannot call back from a number the real person controls. It cannot approve a payment from a device the real person holds. Three controls follow from these limits, and none of them depends on anyone recognising a voice.
A shared secret. The FBI’s December 2024 advice to families is to create a secret word or phrase to verify a person’s identity. It works because the attacker has nothing to copy. The word must never be said in a recorded call, written in a message, or posted.
A call-back on a known channel. The FBI also advises hanging up and calling the person back directly, on a number you already hold. The attacker controls the incoming call. They do not control your address book.
A thing the person holds. For institutions, approval tied to a device or key the customer holds, such as a passkey, moves proof from “sounds like them” to “has what only they have”. This is my own recommendation, not a quotation from either speaker.
Leaving the channel breaks the fraud.
Calling back: the attacker controls only the first call. The second goes to the real person, who knows nothing of the request, and the fraud stops.
Schematic. The hang-up and call-back advice follows FBI alert I-120324-PSA, 3 December 2024.
Five controls to put in place
I would put these in front of any bank, payments team, hospital or family. They cost far less than one successful fraud.
| Control | What to do | What it stops |
|---|---|---|
| Retire the voiceprint as a sole factor | Treat a voice match as a hint that raises or lowers scrutiny, never as the authority to move money or change details | The challenge-phrase attack Altman described |
| Call back on a known number | For any payment instruction, change of bank details or unusual request received by voice or video, end the contact and call the person on a number from your own records | Live impersonation by voice or video |
| Two people, one approval | Require a second named approver for transfers above a threshold, who verifies through a different channel from the first | A single employee persuaded on a call, as at Arup |
| Tie approval to something held | Use passkeys or hardware keys for high-value approvals, so a convincing voice has nothing to unlock | Cloned voice, cloned face and cloned selfie |
| Agree a family secret word | Pick it face to face, never write it down in a message, and use it for any urgent request involving money or safety | The fake ransom or emergency call |
Controls are my own synthesis. The call-back and secret-word advice follows FBI alert I-120324-PSA, 3 December 2024; the rest is my recommendation.
Two points on doing this well. First, say out loud that a refusal is not rudeness. Staff will not hang up on a chief executive unless the organisation has told them it is expected. Write the rule down, and make the chief executive the first to say it applies to them. Second, test it. Run a call in which a colleague plays an urgent senior caller and see whether the process holds under pressure. A control that has never been tested usually fails on the first real attempt.
What I would change first
For a bank, it is the voiceprint. Find every telephone channel that accepts a spoken phrase as authority to move money or change contact details, and remove that authority this quarter. That is the exact practice Altman called “crazy”, and it is cheap to stop.
For a company, it is the payment-change process. Most large fraud begins with a request to change who gets paid. Put the call-back and the second approver on that process before anything else.
For a family, it is the secret word. It takes ten minutes at a dinner table. Set one up with yours, including with parents and older relatives who are most often targeted.
The wider adjustment is harder. Altman said that people are going to have to change the way they verify. For my whole working life, hearing a familiar voice or seeing a familiar face was good enough evidence of who I was dealing with. That evidence is gone. What replaces it is the habit of checking the channel instead of the person: who contacted whom, on which number, through which device, and whether the answer to my question was ever public. It is a small change in practice and a large one in how we trust.
Evidence & Methodology
The Fed quotations are from the conversation as reported and from a transcript I was given. The Arup case, the Consumer Reports study and the FBI alert are on the public record and cited below. The five controls are my own recommendations. Here is which is which.
| Claim | Source | Grade |
|---|---|---|
| On 22 July 2025 Altman, in conversation with Fed Vice Chair Michelle Bowman, said some institutions still accept voiceprints and AI “has fully defeated” that; he was “very nervous” about an impending fraud crisis | Fortune and other coverage of the Federal Reserve conference, 22 to 23 July 2025; transcript supplied | Measured, reported quotation |
| Altman said voice calls would give way to video “indistinguishable from reality” | Same conversation | Reported |
| An Arup employee in Hong Kong made 15 transfers totalling HK$200 million, about US$25.6 million, after a video call with synthetic colleagues | CNN, 16 May 2024, citing Arup and Hong Kong police via RTHK | Reported, company confirmed |
| Four of six voice-cloning products assessed had no meaningful technical safeguard against non-consensual cloning | Consumer Reports, March 2025; small sample, self-reported provider information | Measured, small sample |
| The FBI advises creating a secret word or phrase and hanging up to verify a caller through a number you hold | FBI Internet Crime Complaint Center, alert I-120324-PSA, 3 December 2024 | Measured, primary source |
| A clone cannot recover a secret that was never spoken or published where a model could learn from it | Follows from how cloning works; no study tested here | My call |
| Passkeys or hardware keys for high-value approvals remove the value of a cloned voice or face | My own recommendation, not tested in this post | My call |
| Five controls to deploy | My own synthesis | My framework |
Sources
- Fortune. (2025, July 23). Sam Altman on the AI impersonation fraud crisis in finance. Federal Reserve conference, 22 July 2025.
- PYMNTS. (2025, July 22). Sam Altman says AI has defeated bank voice ID protections.
- Magramo, K. (2024, May 16). British engineering giant Arup revealed as $25 million deepfake scam victim. CNN.
- Consumer Reports. (2025, March). Do these 6 AI voice cloning companies do enough to prevent misuse?
- FBI Internet Crime Complaint Center. (2024, December 3). Criminals use generative artificial intelligence to facilitate financial fraud. Alert I-120324-PSA.
Voice AI Has Reached Its Inflection Point
Why conversation is becoming infrastructure, and what that means for the systems that rely on it.
AI Cyberdefense: Why It Matters Now
How attackers use AI at scale and what defenders can do about it.
Build the Part of AI That Nobody Sees
Why the invisible controls decide whether a system can be trusted.
If your organisation takes payments or approves transfers by phone or video, a short verification review is one of the most useful things my executive programme can help you run.
Cite or quote this article
Was this useful?
