Voice deepfakes in 2026: what detection can do, and what actually stops the money leaving

In July 2025, Sam Altman told a Federal Reserve conference that voiceprint authentication was finished, “AI has fully defeated that”, and that banks still relying on it were doing “a crazy thing.” He was late. A journalist had broken into his own bank account with a cloned voice two and a half years earlier.

This is the state of synthetic speech in 2026: the attack is commoditised, the detection is genuinely hard, and the controls that actually stop losses have almost nothing to do with detection.

We build Truthring, a voice deepfake detector, which is currently pre-launch. We have not published accuracy figures because we do not yet have figures we would defend in the conditions described below, and this article is partly an explanation of why that bar is higher than the industry’s marketing implies.

The losses are real and specific

The pattern is consistent enough that the cases teach a curriculum.

Note which ones failed. Neither WPP nor Ferrari was saved by detection software. Both were saved by a person asking a question the attacker could not answer, and by a culture in which a junior employee felt able to challenge a chief executive.

The Ferrari case in particular has become the canonical worked example, and it deserves its status. The executive noticed something faintly wrong in the intonation, and rather than accusing anyone, asked what book Benedetto Vigna had recommended to him recently. The impersonator had scraped enough public audio to clone a voice. He had not scraped a private conversation. The call ended.

What the aggregate numbers say

The FBI’s IC3 report for 2025, published in April 2026, contained the first dedicated AI section in the centre’s roughly twenty-five year history: 22,364 AI-related complaints and around $893 million in reported losses, against a total of over a million complaints and $17.7 billion in cyber-enabled fraud. The FBI states plainly that the AI figure is almost certainly an undercount, because most victims never learn whether AI was involved.

The FTC reported in June 2026 that US consumers lost a record $16 billion to fraud in 2025, roughly a quarter more than 2024, with imposter scams alone at $3.5 billion and accounting for close to one in three fraud reports. Losses among victims aged sixty and over rose sharply, with average per-victim losses in the tens of thousands.

A note on statistics you will see quoted elsewhere. A widely circulated figure of a 442% rise in vishing comes from CrowdStrike and refers to voice phishing and callback phishing as a category, and CrowdStrike does not attribute it to AI voice cloning. A frequently quoted “deepfake attack every five minutes” statistic comes from identity-document and selfie verification data, not voice. And figures from deepfake detection vendors reporting enormous growth in detected attacks cannot separate rising incidence from their own improving detection. Treat all three with suspicion.

How synthetic speech detection works

Four families of signal, in rough order of how the field developed.

Spectral artefacts. Handcrafted front-ends such as MFCC, LFCC and CQCC, looking for time-frequency inconsistencies that synthesis leaves behind. These were the long-running baselines in the ASVspoof challenge series and they are largely superseded.

Raw waveform models. RawNet2 and AASIST removed handcrafted feature extraction, learning directly from the waveform via sinc-filter convolutions or spectro-temporal graph attention.

Self-supervised front-ends. wav2vec2, XLS-R, WavLM, HuBERT. These now dominate every leaderboard, and the reason is generalisation: they degrade least when moved to conditions they were not trained on. In the most recent ASVspoof, the gap between a self-supervised system and a conventional one on the same team’s submissions was roughly four and a half times in equal error rate.

Physiological and prosodic cues. The most interesting recent direction. A University of Florida group built a detector around breathing: detecting breath events and scoring breaths per minute, breath duration and spacing. Synthesised speech frequently gets breathing wrong or omits it. On their test set this approach performed near-perfectly, while a self-supervised spectral detector failed almost completely on the same samples, at 0.99 equal error rate. That is not near-chance. That is getting almost every call the wrong way round.

Why lab accuracy does not survive a phone call

This is the central problem in the field and the reason we have not published a number for Truthring.

The foundational result came from Fraunhofer AISEC in 2022. They built an “In-the-Wild” dataset, around 38 hours of real and deepfaked audio from 58 public figures, and ran detectors that scored superbly on the ASVspoof benchmark against it. RawGAT-ST went from 1.2% equal error rate to 37.2%. RawNet2 went from 3.2% to 37.8%. Some models degraded to essentially random guessing.

The field had overfitted to its own benchmark. Later analysis of ASVspoof 2021 showed part of the problem concretely: removing non-speech segments from the audio caused median error to more than double, meaning systems had been substantially reading silence and database artefacts rather than evidence of spoofing.

The Speech DF Arena benchmark, maintained by researchers across several institutions, now evaluates systems across fourteen datasets spanning clean lab audio to real telephony. The best open-source system on it, XLSR+SLS, averages 13.84% equal error rate (15.68% pooled). The best proprietary entry manages about 3%. Those are one to two orders of magnitude worse than headline ASVspoof numbers. No single model wins across all fourteen datasets. Reverberation alone raises error by around half.

Here is the specific list of why a live fraud call is nothing like a benchmark:

• Narrowband audio. Telephony discards the high frequencies where most vocoder artefacts live. You are detecting a fingerprint with the fingerprint’s detail removed.
• Lossy codecs. AMR, Opus, SILK, G.711 each impose their own synthesis artefacts, which swamp the generator’s. Neural codecs are worse still. In the most recent ASVspoof, neural encoding was the single hardest condition tested.
• Packet loss and jitter. Systematically studied for the first time in 2025 work presented at EUSIPCO across six codecs and packet loss up to 20%. Every baseline degraded significantly.
• Room acoustics. Roughly 50% relative error increase from reverberation alone.
• Unseen generators. The operative condition in every real attack. Nobody commits fraud with last year’s open-source model when a better one shipped in March.
• Calibration. A threshold tuned in the lab is the wrong threshold live. One system on the Speech DF Arena scored 5.76% averaged across datasets and 11.29% pooled. Same model, differently aggregated, because its scores do not mean the same thing in different domains.

Humans are not a fallback. A UCL study in PLOS ONE in 2023 tested 529 participants in English and Mandarin: around 73% accuracy in both languages, meaning better than a quarter of deepfakes went undetected, and training listeners on what to listen for improved things only slightly.

How to read a vendor’s accuracy claim

Every “99% accurate” claim in this market originates with a vendor. Some are more defensible than others, but the number alone is uninterpretable without four accompanying facts: the operating threshold, the false positive rate at that threshold, the audio condition, and whether the test set contained generators the model had never seen.

The clearest illustration is ElevenLabs’ own classifier, which claims very high accuracy on unedited ElevenLabs-generated audio. That is a true and useful claim with a scope of exactly one generator. It says nothing about anything else, and it demonstrates precisely how “99% accurate” can be honest and worthless at the same time.

The false-positive side matters more than vendors admit. At contact-centre volumes, a 1% false positive rate means accusing thousands of legitimate customers per day of being synthetic. A benchmark reporting false positive and false negative rates separately is worth ten reporting accuracy.

Two sources deserve more trust than the rest: ASVspoof, which is academic and rigorous but whose data is not phone-channel fraud audio, and the Speech DF Arena leaderboard, which is multi-institution, covers fourteen datasets, and is live, meaning any claim of a top ranking needs a date attached, because the ordering has changed more than once within a quarter.

What actually stops losses

Detection helps. It is not the control. The organisations that avoided losses used process, and the process is cheap.

• A shared secret the internet does not have. The Ferrari method. Ask something only the real person knows and that is not in any public record. Costs nothing, works instantly, defeats a real-time clone.
• A family safe phrase. Starling Bank ran a public campaign for this in September 2024, and the FBI’s December 2025 advisory recommends establishing a secret verification phrase with family members. Their survey found 28% of UK adults had been targeted by a voice-cloning scam in the preceding year and 46% did not know the scam type existed.
• Callback on a number you already had. Never a number supplied during the call. Caller ID was spoofed in both the 2019 energy-firm loss and the Italian minister case. The inbound number is not evidence of anything.
• Out-of-band confirmation. A request arriving by voice or video gets confirmed through a different channel. Both the Arup loss and the WPP attempt deliberately crossed channels into WhatsApp and video calls precisely to escape controlled systems.
• Payment controls that do not depend on identifying anyone. Mandatory second approver for new payees, a delay window on first payments to a new beneficiary, hard value thresholds requiring in-person sign-off, and a standing rule that no new beneficiary is created on the same call that authorises a payment.
• An explicit no-penalty rule for refusing. Write it down: no employee will ever face consequences for declining to act on an unverified request, however senior the caller appears. Both documented saves came from someone junior feeling free to push back.
• Never share authentication codes, and never accept a move to an attacker-chosen app. Both are named FBI indicators; the app pivot is the signature move of the campaign impersonating senior officials that has run since at least 2023.

The Arup loss was not a detection failure. It was a process failure. Twenty-five million dollars left because a payment could be authorised inside a single conversation, and no amount of classifier accuracy fixes that.

Where regulation has landed

The FCC ruled on 8 February 2024 that AI-generated voices count as “artificial” under the Telephone Consumer Protection Act, so AI voice robocalls to mobile and residential lines require prior express written consent. Enforcement followed: the carrier that transmitted the AI Biden robocalls in New Hampshire settled with a $1 million civil penalty. The consultant who made them was acquitted by a New Hampshire jury in June 2025, a useful reminder that the regulatory deterrent is considerably stronger than the criminal one.

On likeness, Tennessee’s ELVIS Act took effect on 1 July 2024, the first US state law to extend right of publicity explicitly to AI voice simulation, with criminal as well as civil liability. Montana, Washington, Pennsylvania, Illinois, New Hampshire, New Jersey and others have followed with voice-specific provisions. Federally, the NO FAKES Act was advanced unanimously by the Senate Judiciary Committee in June 2026 and remains pending.

In the EU, Article 50 of the AI Act became applicable on 2 August 2026. Providers of generative systems must mark synthetic audio in machine-readable form; deployers must disclose deepfakes to affected people at first exposure, in a way that is clear and distinguishable: a visible or audible label, not a machine-readable mark alone. Penalties reach €15 million or 3% of worldwide turnover.

Notice the direction. The regulatory answer to synthetic voice is not better detection; it is marking at source and mandatory disclosure. The winners of the FTC’s Voice Cloning Challenge pointed the same way. One entry adds imperceptible distortions to audio to impede cloning in the first place, another authenticates a living human at the microphone using biosignals.

What we think happens next

Voice biometrics as a standalone authenticator is over, and the industry has quietly accepted it. What replaced it is not a better voiceprint but defence in depth: the voice match demoted to one risk signal, fused with device fingerprint, carrier metadata, behavioural analytics and a dedicated anti-spoofing layer, with step-up verification required for anything that moves money.

Detection’s real job in that architecture is not to render verdicts. It is to raise the cost of an attack and to flag calls for the human controls that actually stop losses, which means it needs to run in a couple of seconds on streaming audio at the edge of a live call, not as post-hoc file analysis after the money has gone.

That is the problem we are building Truthring for, and it is why we would rather ship late with a defensible number than early with a marketing one.