Brand Voice Cloning: Deepfake Liability

The most useful evidence is not a single dramatic percentage. It is the convergence of incidents, fraud reporting, and falling production costs. The FBI told Congress that reported losses connected to fraud schemes involving AI reached $893 million in 2025, according to a summary of the FBI's testimony and reporting. The same reporting notes that fewer than 5% of victims may report. That number covers more than voice cloning, so it should not be presented as a voice-only statistic. It does show the size of the wider AI-enabled fraud environment in which cloned voices operate.

A separate Shufti Pro Identity Fraud Index report covered by ASIS recorded a 495% increase in reported AI identity fraud between 2024 and 2025. Again, identity fraud is broader than voice. The value of the figure is directional: synthetic identity signals are moving from an unusual edge case into a volume problem.

The earlier benchmark is smaller but easier to understand. In 2019, a UK energy company paid roughly $243,000 after a fraudster used a synthetic version of the parent company chief executive's voice to pressure an executive into making a transfer. Forbes reported the incident. The amount matters less than the control failure: voice recognition was treated as authorization even though money was moving.

New Zealand reporting gives the pattern a more recent operational shape. B2B News reported Westpac's warning that deepfake fraud had cost New Zealand firms around NZ$2.2 million per incident in the cases described. The article is not a universal average and should not be used as one. It is a reminder that the consequence is not limited to reputational embarrassment. A voice can become the last convincing signal before a payment leaves.

Put those sources together and the operating conclusion is straightforward: a brand cannot treat a familiar voice as proof of identity when the action attached to that voice has a material consequence. The voice can be authentic, cloned, replayed, or combined with a real recording. The approval still needs an independent path.

The technology no longer requires a specialist lab. Commercial products have made high-quality text-to-speech and voice cloning part of ordinary creative software. A 2026 comparison of consumer tools found that ElevenLabs and Descript offered accessible voice-cloning workflows. Pricing and product features change quickly, but the important point is stable: a bad actor can test a convincing synthetic voice without building a model from scratch.

That does not mean every clone is perfect. Background noise, emotional range, turn-taking, accent, and the natural irregularities of a real conversation still create clues. The mistake is assuming the attacker needs perfection. On a rushed call, a short voicemail, or a message that arrives after an executive is expected to be travelling, a plausible voice plus a plausible context can do the work.

Public audio is now a reusable attack surface. Earnings calls, conference panels, podcasts, training videos, webinars, customer-service recordings, and social clips provide samples. A brand may remove one recording and still leave dozens of others available. The practical response is not to erase every public appearance. It is to stop treating public voice as a credential.

There is also an important distinction between a research model and a public product. Microsoft's VALL-E work demonstrated few-shot voice synthesis as a research direction, but a research paper is not evidence that a particular service is available to the public. Keep that distinction in the article, the incident report, and the board conversation. Precise language builds a better control decision than a more dramatic claim.

A detection tool can be useful for triage. It can help a trust team prioritize an audio file, a newsroom investigate a suspicious clip, or an incident responder compare a message with known material. It cannot answer the question that matters most in a high-consequence workflow: should this person be allowed to authorize the action?

Human listeners are not reliable detectors either. A 2025 study in Scientific Reports examined how people distinguish real and synthetic speech and found that performance depends on the audio, the listener, and the conditions. Even if a listener is unusually good in a test, a live call has pressure, context, bad connections, and a reason to comply. Those are not laboratory conditions.

The right design is layered. Read-only voice content can have one threshold. A customer-service conversation that reveals no sensitive information can have another. A request to change a bank account, release a credential, approve a refund, publish a statement, or move money needs an independent channel, even if the voice is unmistakably real.

This is the same logic that should govern AI search claims and other synthetic content: the system needs a traceable source, a clear owner, and a way to challenge the output. A voice model can make speech. It cannot grant permission.

There is no single US voice-cloning law that resolves every brand scenario. The exposure depends on what was cloned, who owned the voice, why it was used, where the person and audience were located, and what the output caused. Right-of-publicity claims can apply when a person's identity is used commercially without permission. Privacy and biometric laws can apply to the collection or processing of voice data. Consumer-protection, employment, copyright, contract, and fraud theories can sit alongside them.

Congress has been considering a federal response. Billboard reported on the NO FAKES Act as it advanced through Congress. The proposal is relevant because it frames unauthorized digital replicas as a distinct rights problem, but a proposal is not the same as enacted law. Do not tell a reader that a bill creates a current duty unless the bill has actually become law in the relevant form.

State law already matters. A Blank Rome analysis of New York publicity law explains how the right of publicity intersects with synthetic media. Illinois is another important jurisdiction because its biometric privacy law has been used in disputes involving voice data. Bloomberg Law described the state-law path and the uncertainty around how existing statutes apply to voice cloning.

The signal from talent and public figures is also changing the commercial expectation. Reuters reported Taylor Swift's 2026 trademark filing covering voice and likeness. A filing does not decide every dispute, but it shows that voice and identity are being treated as assets worth protecting before a synthetic replica becomes the default public version.

For a brand, the conservative rule is simple: get specific permission for synthetic use, name the purpose, limit the duration and channels, explain whether the output can be used to take action, and retain a record of the approval. Consent to record a meeting is not automatically consent to train a voice model. Consent to use a voice in a fictional ad is not automatically consent to use it in customer service. The wording has to match the use.

Many organizations assume a cyber policy will absorb a voice-cloning loss. That assumption may fail because a voice scam can look like social engineering, fraud, funds transfer, impersonation, or a communications event rather than a conventional network intrusion. The policy language and facts control. An Embroker discussion of deepfake fraud insurance gaps describes why exclusions, sublimits, authentication requirements, and causation questions can leave a company with less coverage than it expects.

The useful exercise is not asking, "Are we covered for deepfakes?" Ask the insurer and broker a specific scenario. What happens if a cloned executive voice requests a transfer? What if an employee voice is used in a customer-facing agent? What if a fake recording causes a customer to disclose information? What evidence must the company retain? Which policy responds first, and what control failure would reduce coverage?

Run that exercise before an incident. Once money has moved or a false recording is public, the organization is trying to reconstruct permissions, prompts, approvals, call logs, and vendor settings while also explaining what happened. That is when an informal control becomes an expensive evidentiary gap.

The first step is an inventory, not a vendor demo. List the voice assets the organization controls or has permission to use: executive interviews, employee recordings, customer-service prompts, endorsements, product demos, training data, synthetic agents, and third-party libraries. For each asset, record the person, permission, purpose, market, retention period, and whether the voice can trigger a transaction or public statement.

Next, map the high-consequence moments. The highest-risk path is usually not the brand film. It is the moment a familiar voice asks somebody to bypass a normal control. Mark every workflow where voice can change a payment detail, reset access, approve a refund, release data, authorize a campaign, or make a market-facing claim. Put independent verification at those points.

Then test the controls with a human exercise. Give a finance lead a plausible synthetic voicemail that asks for a change. Give customer support a fake call that sounds like an employee. Give communications a fabricated executive quote. The test is not whether someone can identify the audio. The test is whether the organization pauses, verifies, records, and responds without relying on confidence.

Finally, keep the policy readable. Employees do not need a lecture on neural vocoders. They need a short rule: no voice alone authorizes a high-consequence action. If the request matters, use the known channel, ask a challenge question that is not in the recording, and log the decision. That is a small operational change with a much larger effect than asking everyone to become an audio forensic analyst.

The broader lesson belongs next to other AI trust work, including the evidence problem in AI search and the customer readiness gap. Synthetic output becomes dangerous when a plausible signal is allowed to skip the evidence and permission layer underneath it.