Phone Social Engineering:
The Numbers

Global estimate of total annual losses attributable to voice-based fraud, including vishing, voice-assisted BEC, and deepfake-enabled wire fraud attacks.

A UAE bank transferred $35 million after employees received calls from what appeared to be their company director — later confirmed to be a deepfake voice clone.

A UK-based energy firm transferred £201,000 (~$243,000) to a fraudster after an executive received a call mimicking his parent company's CEO voice with AI voice cloning.

The FBI's 2023 IC3 report documented $2.9 billion in real estate wire fraud, a category increasingly dependent on voice-assisted social engineering to authorize fraudulent transfers.

Business email compromise incidents that include a voice component — where fraudsters call to "confirm" wire transfers — average $125,000 in losses per reported event.

Voice-assisted business email compromise attacks — where a phone call reinforces fraudulent email instructions — have grown 350% since AI voice tools became widely publicly accessible.

An estimated 3.1 billion deepfake or AI-synthesized voice calls were placed globally in 2024, a figure that grew rapidly as commercial voice cloning APIs became cheap and accessible.

Voice cloning attack volume grew 2,400% from 2022 to 2024 — driven by the public release of commercial voice AI tools, free online cloning services, and falling cost of entry.

McAfee's 2023 research found that 25% of US adults reported receiving or experiencing an AI voice scam — calls from what appeared to be a known contact turned out to be synthetically generated audio.

Of those who fell for an AI voice scam in McAfee's 2023 survey, 77% lost money. The median reported loss was over $1,000, with a significant share reporting losses in the $5,000–$15,000 range.

Vishing — voice phishing conducted by phone — now accounts for 26% of all social engineering attacks globally, making it one of the dominant attack channels alongside email and SMS.

Consumer-grade voice cloning tools available in 2024 can produce a convincing voice clone in under 10 minutes using audio scraped from social media, voicemail greetings, or public video.

41% of legal and law firms report experiencing phone-based social engineering attempts annually, targeting trust accounts, wire authorizations, and closing call confirmations.

The FBI documents $4.7 billion lost to wire fraud in financial services annually, with a growing proportion tied to voice-authenticated transfer requests that bypass digital authorization controls.

Real estate closings represent a prime target because large wire transfers are routine, under time pressure, and authorized verbally. The FBI's 2023 IC3 report pegged this sector's losses at $2.9 billion.

Healthcare organizations have seen a 180% increase in voice-based fraud incidents since 2021, as attackers impersonate executives, insurers, and vendors to redirect payments and access PHI.

34% of US federal agencies have reported vishing attempts targeting personnel — calls impersonating colleagues, leadership, or government contractors to harvest credentials or authorize actions.

61% of colleges and universities experienced social engineering attacks in 2023, including phone-based impersonation of financial aid officers, executives, and IT staff to redirect wire transfers and payroll.

Even trained security professionals correctly identify AI-generated voice audio only 5–10% of the time in blind testing. Untrained individuals perform at near-random accuracy when trying to distinguish real from synthetic voices.

On-device AI detection systems — running locally on CoreML (iOS) or ONNX (Android) — achieve 90–95% detection accuracy on current voice cloning models, validated on real device hardware.

Without dedicated voice fraud detection technology, fraudulent calls are almost never caught in real time. Detection occurs post-facto — after wire transfers have been sent and instructions acted upon.

Vicall's on-device detection model processes incoming audio and returns a synthetic-voice verdict in under one second — before a fraudulent instruction can be confirmed or a transfer authorized.

73% of organizations have no technology in place specifically designed to detect fraudulent or synthetic voice calls. Email security, endpoint protection, and MFA do not address the voice attack surface.

Only 12% of businesses have formal, documented policies specifically governing voice-based wire authorizations — leaving 88% reliant on informal trust, caller ID, or human intuition when approving phone-authorized transfers.

As of 2024, more than 40 consumer-grade voice cloning tools are publicly accessible — including fully free, browser-based options requiring no technical background to operate.

In 2019, producing a convincing voice clone required custom ML engineering, proprietary training data, and GPU compute time — a process costing $10,000 or more and weeks of work.

Multiple voice cloning services in 2024 offer free tiers with no registration requirements. The economic barrier to voice fraud has effectively collapsed, putting voice impersonation tools in reach of any bad actor.

State-of-the-art voice cloning models in 2024 require as little as 3 seconds of reference audio to generate a convincing voice clone — obtainable from a voicemail greeting, social media video, or recorded phone call.

Reported deepfake audio incidents in enterprise environments — including executive impersonation calls, vendor fraud, and voice-authenticated system access — have grown 600% since 2022.

The Federal Trade Commission named voice clone scams the fastest-growing fraud category in 2023, surpassing traditional phone fraud, romance scams, and IRS impersonation in reported volume growth rate.