Your Voice Is No Longer Proof of Who You Are

What Altman said at the Federal Reserve

On Tuesday 22 July 2025, Sam Altman appeared at a Federal Reserve conference in Washington, in conversation with Michelle Bowman, the Fed’s Vice Chair for Supervision. Talk turned to fraud. He said:

“Apparently there are still some financial institutions that will accept a voice print as authentication, for you to move a lot of money or do something else. You say a challenge phrase and they just do it. That is a crazy thing to still be doing. AI has fully defeated most of the ways that people authenticate currently, other than passwords.”

He went on to say he was “very nervous that we have an impending, significant fraud crisis”, and that OpenAI and others in the industry had warned that withholding a technology does not keep it from existing: “Some bad actor is going to release it. This is not a super difficult thing to do.”

He then pointed past the telephone. A voice call, he said, is where this starts. “Soon, it’s going to be a video, FaceTime, indistinguishable from reality.” His conclusion was that people will have to change how they verify who they are dealing with. Bowman’s reply was that the Fed could consider partnering with industry on spotting synthetic voices and deliberate impersonation, and she added that she was the parent of two teenagers. I could find no report of a specific Fed action that followed.

I want to take his warning seriously and test it against the record, because a chief executive of an AI company has reasons to talk about AI’s power. The evidence is better than I expected.

Why a voiceprint fails

A voiceprint check compares the sound of a caller’s voice to a stored sample. It was built to be hard for a person to imitate. It was never built for a world where software can produce a close copy from a short recording.

Voice-cloning tools are widely sold, and they are cheap. In March 2025, Consumer Reports assessed six of them: Descript, ElevenLabs, Lovo, PlayHT, Resemble AI and Speechify. For four of the six it found no meaningful technical barrier to cloning a voice without the speaker’s consent. Most relied on a user ticking a box to confirm they had the right. Its researchers built clones from publicly available audio. Recordings of people speaking on podcasts, conference panels and social video are easy to find, and executives, politicians and anyone with a public profile leave a great deal of them.

The study was small, and the providers have changed their controls since. The direction is clear all the same. The cost of producing a convincing voice has fallen to nearly nothing, and the check that depended on that cost being high has lost its protection.

Proof of identity

Four of six common checks can be supplied by an attacker.

Trusted until nowAgainst a clone

Voiceprint or challenge phraseA clone supplies the voice and the phraseCan be suppliedAccepted

Familiar voice on a callA clone supplies it from recordingsCan be suppliedAccepted

Face on a video callSynthetic attendees were used at ArupCan be suppliedAccepted

Selfie or wave at the cameraAltman: defeated, with most other methodsCan be suppliedAccepted

Call-back on a number you holdThe attacker does not control your address bookHoldsAccepted

Secret word or held deviceNothing public for a clone to copyHoldsAccepted

Against a cloning tool, the first four can be supplied by the attacker. The last two still stand because they do not depend on recognising anyone.

Schematic. Grading follows the post: the Altman remarks at the Federal Reserve, 22 July 2025, the Arup case and FBI alert I-120324-PSA. The held-device row is my recommendation.

Altman made a second point that is easy to miss. He said AI has defeated “most of the ways people authenticate”, other than passwords. That includes a selfie, a wave at the camera and a spoken phrase. These checks share an assumption: that a convincing face or voice is hard to produce. Each time that assumption fails, a check that looked like a strong second factor reduces to something an attacker can supply.

What a convincing fake has already cost

The clearest case is Arup, the British engineering firm. An employee in its Hong Kong office was drawn into a video call with what appeared to be several colleagues. According to Hong Kong police, as reported by RTHK and CNN, every other attendee was a synthetic recreation. The employee went on to make 15 transfers totalling HK$200 million, about US$25.6 million. Arup confirmed to CNN in May 2024 that it had told Hong Kong police in January and that fake voices and images were used.

I would not call that negligence. It is what most of us would do when people we recognise appear on a video call and speak.

The same technique reaches ordinary households. The FBI has warned that criminals generate short audio clips of a loved one’s voice and use them to pose as a relative in crisis, demanding urgent money or a ransom. Altman described it in the same conversation: “There’s obviously some reports now of these sort of ransom attacks where people have the voice of your kid or your parent and they make this urgent call. That is going to get so compelling.”

What these cases share is that the fraud never touches a system. Nothing is hacked. A person is persuaded by a sound or an image they have every reason to trust, and the person authorises the loss themselves. Technical controls on the bank’s side only help if the bank has decided not to rely on the same sound or image.

What a clone cannot do

A cloned voice copies how someone sounds. It does not hold what they know. That gap is where verification now has to live.

A clone cannot answer a question whose answer was never spoken or posted where a model could learn it. It cannot call back from a number the real person controls. It cannot approve a payment from a device the real person holds. Three controls follow from these limits, and none of them depends on anyone recognising a voice.

A shared secret. The FBI’s December 2024 advice to families is to create a secret word or phrase to verify a person’s identity. It works because the attacker has nothing to copy. The word must never be said in a recorded call, written in a message, or posted.

A call-back on a known channel. The FBI also advises hanging up and calling the person back directly, on a number you already hold. The attacker controls the incoming call. They do not control your address book.

A thing the person holds. For institutions, approval tied to a device or key the customer holds, such as a passkey, moves proof from “sounds like them” to “has what only they have”. This is my own recommendation, not a quotation from either speaker.

The call-back rule

Leaving the channel breaks the fraud.

Act on the callHang up and call back

1Urgent call arrivesVoice sounds right, request is for money

2You judge the voiceThe clone passes

3You act on itFunds sent, details changed

Loss

1Urgent call arrivesVoice sounds right, request is for money

2You hang upThe attacker loses the channel

3You call a number you holdThe real person answers, or nobody does

Fraud stopped

Calling back: the attacker controls only the first call. The second goes to the real person, who knows nothing of the request, and the fraud stops.

Schematic. The hang-up and call-back advice follows FBI alert I-120324-PSA, 3 December 2024.

Five controls to put in place

I would put these in front of any bank, payments team, hospital or family. They cost far less than one successful fraud.

Control	What to do	What it stops
Retire the voiceprint as a sole factor	Treat a voice match as a hint that raises or lowers scrutiny, never as the authority to move money or change details	The challenge-phrase attack Altman described
Call back on a known number	For any payment instruction, change of bank details or unusual request received by voice or video, end the contact and call the person on a number from your own records	Live impersonation by voice or video
Two people, one approval	Require a second named approver for transfers above a threshold, who verifies through a different channel from the first	A single employee persuaded on a call, as at Arup
Tie approval to something held	Use passkeys or hardware keys for high-value approvals, so a convincing voice has nothing to unlock	Cloned voice, cloned face and cloned selfie
Agree a family secret word	Pick it face to face, never write it down in a message, and use it for any urgent request involving money or safety	The fake ransom or emergency call

Controls are my own synthesis. The call-back and secret-word advice follows FBI alert I-120324-PSA, 3 December 2024; the rest is my recommendation.

Two points on doing this well. First, say out loud that a refusal is not rudeness. Staff will not hang up on a chief executive unless the organisation has told them it is expected. Write the rule down, and make the chief executive the first to say it applies to them. Second, test it. Run a call in which a colleague plays an urgent senior caller and see whether the process holds under pressure. A control that has never been tested usually fails on the first real attempt.

What I would change first

For a bank, it is the voiceprint. Find every telephone channel that accepts a spoken phrase as authority to move money or change contact details, and remove that authority this quarter. That is the exact practice Altman called “crazy”, and it is cheap to stop.

For a company, it is the payment-change process. Most large fraud begins with a request to change who gets paid. Put the call-back and the second approver on that process before anything else.

For a family, it is the secret word. It takes ten minutes at a dinner table. Set one up with yours, including with parents and older relatives who are most often targeted.

The wider adjustment is harder. Altman said that people are going to have to change the way they verify. For my whole working life, hearing a familiar voice or seeing a familiar face was good enough evidence of who I was dealing with. That evidence is gone. What replaces it is the habit of checking the channel instead of the person: who contacted whom, on which number, through which device, and whether the answer to my question was ever public. It is a small change in practice and a large one in how we trust.

---

If your organisation takes payments or approves transfers by phone or video, a short verification review is one of the most useful things my executive programme can help you run.