The signal

Regulatory attention on deepfakes has so far focused on video onboarding and identity checks: FINMA, for example, recommends technical means to detect deepfakes when accounts are opened online. The phone line has had far less attention, yet it is where many wealth management clients still move large sums. An instruction given by phone to an adviser usually falls outside the in-app confirmation that protects online payments. What protects it instead is a call-back to a registered number and an adviser who recognises the client’s voice.

Cloning a voice no longer takes studio recordings. Microsoft Research showed a model cloning a voice from a 3-second recording as early as 2023. The US regulator FinCEN has reported an increase in suspicious-activity reports describing suspected deepfake media, and warns that deepfake audio can be used to impersonate people. A voicemail greeting or a conference clip can be enough.

That changes two things a bank relies on. A client calling in is no longer proof of the client. And a call that seems to come from the bank is no longer proof of the bank. In-app confirmation does not always help here: the fraudster talks the client into approving the payment themselves.

What banks are asking

In our conversations with banks, nobody questions whether voice fraud is real anymore. The question is which detection approach works best.

1 Is this really my client?

Wealth managers need to confirm who is on the line before a large instruction is executed.

2 Is this really us?

Fraudsters now call clients pretending to be bank staff. The bank needs to be able to prove their identity to the client too.

Regulators are moving the cost to the bank

None of the rules below prescribes a specific voice control. What they are doing, market by market, is making impersonation fraud the bank’s problem: either through refunds, through risk-management expectations, and/or by pulling telcos into the chain.

What founders are building

Startups are attacking the problem from four angles. None is complete on its own, which is why the strongest setups combine more than one.

1 Synthetic-voice detection

How it works
Models listen to the audio stream and look for traces that generated speech leaves behind: unnatural spectral patterns, missing breath and room noise, timing that is too even. Each call gets a live risk score.

Where it fits
Inbound calls to the bank, scored while the call is live.

Ask a vendor
Whether it works on compressed phone audio and in the languages and dialects clients actually speak.

Watch out for
It is an arms race. A detector that is not retrained continuously loses ground with every new cloning model.

2 Voice biometrics with liveness

How it works
The bank enrols a client’s voiceprint, often passively during normal calls, and matches every new call against it. Liveness checks then test whether a live person is speaking rather than a recording or a synthetic voice.

Where it fits
Authenticating known clients on inbound calls, replacing or reinforcing security questions.

Ask a vendor
Enrolment rates, and how client consent is captured and stored.

Watch out for
A voiceprint alone is increasingly attackable: in a widely reported 2023 case, a journalist got into his own Lloyds account through its voice ID using an AI clone of his voice and his date of birth. In the EU, biometric data used to identify a person is special-category data under the GDPR, usually requiring explicit consent; in Switzerland, the data protection authority treats voiceprints as sensitive personal data.

3 Network-side signals

How it works
Telcos see what banks cannot: whether a caller ID is spoofed, where a call really originates, whether a SIM was swapped recently. Banks can query some of these signals through telco APIs in real time; one UK bank ran 3.1 million SIM-swap checks through such an API in March 2024 alone.

Where it fits
Before a sensitive call is accepted, and before a large payment is released.

Ask a provider
Which telcos and countries are covered; latency; how the data is shared lawfully.

Watch out for
Coverage depends on bilateral telco agreements and is patchy across borders. Singapore’s framework makes telcos share liability for digital phishing losses, and the agreed EU PSR text is expected to give telcos fraud-prevention duties, which should make this easier over time.

4 Verified calls and in-app confirmation

How it works
The banking app shows whether the bank is really on the line. Monzo launched this in 2023: a banner in the app confirms when a Monzo employee is on a call with the client, and tells the client to hang up if no one is.

Where it fits
Staff-impersonation scams, the type the EU PSR is expected to make banks refund once adopted.

Ask a vendor
How the client sees the verification; how it works when the client is abroad or on another network.

Watch out for
It only covers calls the bank makes. Clients must learn to check the app, which takes communication, not just technology.

The numbers: 17% of cases and 28% of losses

In UK Finance’s Annual Fraud Report 2026, authorised push payment fraud cases that began via telecommunications were 17% of cases in 2025 but 28% of losses. UK Finance notes these are usually higher-value cases such as impersonation scams, and that the split is based on a subset of cases and not definitive. Online sources accounted for 66% of cases and 32% of losses.

What it means for banks

Whether a bank operates under refund rules today (UK), soon (EU), or under supervisory expectations (Switzerland), three things stand out:

1 Impersonation is becoming a liability line
In the UK, banks already reimburse most scam victims. Once the EU PSR is adopted, they are expected to refund bank-impersonation fraud and carry losses where their fraud controls fall short. What used to be a customer-service issue is moving onto the balance sheet.

2 “Is this really us?” is the less developed half
To check that a caller really is their client, many banks already use voice biometrics, although cloning now undermines them, and synthetic-voice detection is in early deployment. Banks have far fewer ways to show a client that a call really comes from the bank. Verified calls help, but only for calls the bank makes, and only if clients know to check. Most staff impersonation needs no voice clone: a spoofed number and a convincing script are enough. In wealth management, though, clients know their adviser’s voice, and a clone can make a fraudulent call sound like someone they trust. This is also the fraud the EU PSR is expected to make banks refund. A call-back rule for large instructions remains the baseline either way.

3 The telco sees it first
A swapped SIM or a spoofed caller ID shows up on the network before it shows up in the bank. Some of these checks are already available through telco APIs: one UK bank ran 3.1 million SIM-swap checks in a single month. Singapore already makes telcos share liability for digital phishing losses, and the agreed EU PSR text is expected to give them fraud-prevention duties.