An AI voice cloning scam in India usually starts with a call that sounds exactly like someone you know: a son stuck at a police station, a colleague who needs a payment cleared before a meeting, a relative in a hospital. The voice is synthetic, built from clips taken from videos or voice notes, and the request is always urgent and always about money.
The government’s cyber security agency, CERT-In, has warned about this use of AI twice in its advisories. Its November 2024 advisory on deepfakes lists financial fraud first among the threats: “Scammers use deepfake technology to impersonate individuals, such as company executives or family members, to request money transfers or sensitive financial information.” It also describes scammers “impersonating a loved one in distress” to extract personal information or money.
This explainer sets out what Indian agencies advise, which laws apply and where to report a call.
How the scam works
CERT-In’s advisory, CIAD-2024-0060 of 27 November 2024, rates the deepfake threat “High” and describes deepfakes as synthetic media created with AI “to generate or manipulate realistic images, videos, and audio”. It notes that the technology is “becoming increasingly sophisticated” and harder to detect.
The pattern it describes has three parts:
- A borrowed identity. The caller impersonates a family member or a senior person at work.
- Pressure. The story leaves no time to think: an accident, an arrest, a deal about to close.
- A transfer. The goal is money or details such as an OTP, a card number or a login.
A second advisory, CIAD-2026-0020 of 26 April 2026, on AI-driven cyber risks, lists “AI-generated phishing and impersonation attacks, including highly convincing multilingual social engineering content” among the capabilities attackers can now use. For a country where a scam call can come in Hindi, Tamil or Bengali, the multilingual point matters.
What CERT-In tells individuals to do
The 2026 advisory’s advice for individuals is direct: “Verify the authenticity of voice calls, video messages and urgent requests, particularly those involving financial transactions or sensitive information, as AI-generated deepfakes and impersonation attempts may be highly convincing.”
Put into practice, the advisories point to a few habits:
- Hang up and call back. Use the number you already have saved, not the one that called you. CERT-In’s 2024 advisory recommends “callback procedures for sensitive transactions” for organisations; the same works at home.
- Be sceptical of unsolicited requests. The 2024 advisory says to check that a message comes from a trustworthy source before acting on it.
- Listen for tells, but do not rely on them. CERT-In lists “robotic-sounding voices” among the signs of manipulation, while warning that deepfakes “can be extremely convincing and difficult to detect”.
- Share less raw material. It advises limiting personal data posted online, especially high-resolution photos and videos, and tightening privacy settings on social media.
- Protect accounts with multi-factor authentication, so that a voice alone cannot unlock them.
A family code word, agreed in advance and never posted online, is a simple way to apply the callback idea when a relative claims to be in trouble.
What the law says
There is no separate offence for voice cloning, but existing laws cover the conduct. The Ministry of Electronics and Information Technology set out the framework in a statement to Parliament on 6 August 2026:
| Law | Provision | What it covers |
|---|---|---|
| IT Act, 2000 | Section 66C | Identity theft |
| IT Act, 2000 | Section 66D | Cheating by personation using a computer resource |
| Bharatiya Nyaya Sanhita, 2023 | Section 319 | Cheating by personation |
| Bharatiya Nyaya Sanhita, 2023 | Section 336 | Forgery, including false electronic records made to cheat |
| Bharatiya Nyaya Sanhita, 2023 | Section 111 | Organised crime, which can include deepfake content |
Source: MeitY statement, PIB, 6 August 2026.
The same statement notes that the IT Rules, 2021 were amended on 10 February 2026 to deal with synthetically generated information, including labelling and faster takedown timelines for platforms. Those platform duties are explained in our guide to deepfake labelling under the IT Rules. They help when a cloned voice or video is posted online; they do little for a private phone call, where your own checks are the main defence.
Where to report
If money has left your account, speed matters more than anything else:
- Call 1930 or file a complaint on the National Cyber Crime Reporting Portal. Our guide to the 1930 cyber fraud helpline walks through what to have ready.
- Tell your bank at once. How quickly you report an unauthorised transaction affects how much of the loss you bear, as our explainer on unauthorised electronic banking transaction liability sets out. Those rules are written for unauthorised transactions, so ask your bank how it will treat a payment you approved yourself after being deceived.
- Report the call even if you lost nothing. The Department of Telecommunications’ Chakshu facility on Sanchar Saathi takes reports of suspected fraud calls and messages, covered in our guide to Chakshu and Sanchar Saathi.
Calls in which fake police or investigators keep a victim on video for hours are a related pattern, explained in our guide to the digital arrest scam.
At work
The 2024 advisory gives organisations a longer list: verification protocols with multi-factor authentication and callbacks for sensitive transactions, detection tools, staff training and a crisis plan for deepfake incidents. For finance teams the practical rule is that no payment instruction is approved on the strength of a voice or video call alone, however senior the caller sounds. Employers using AI tools themselves have separate duties, covered in our guide to the DPDP Act and AI at work.
Sources
CERT-In Advisory CIAD-2024-0060, Deepfakes: Threats and Countermeasures, 27 November 2024. CERT-In Advisory CIAD-2026-0020, Defending Against Frontier AI Driven Cyber Risks, 26 April 2026. Ministry of Electronics and Information Technology, Government Strengthens Regulatory Framework to Address AI-Generated Deepfakes, PIB, 6 August 2026. Documents consulted on 19 October 2026.
