Deepfake Detection for Voice Biometrics: Can Voice Cloning Beat Voice ID?

How deepfake detection and voice biometrics differ

Voice biometrics and deepfake detection answer different questions, and confusing them is how cloned voices get through. A voice biometric system asks whether this voice matches the voiceprint enrolled for the account. Deepfake detection asks whether this speech was produced by a human vocal tract or by a machine. A good clone is built to pass the first question, so only the second one catches it.

In anti-spoofing research the combination has a name: SASV, short for speaker verification that is resistant to spoofing. The ASVspoof 5 challenge, published in August 2024, evaluates both stand-alone spoof countermeasures and SASV systems that join speaker matching with spoof detection, because a matcher on its own is known to accept high-quality synthetic speech.

Can voice cloning bypass bank voice authentication?

Yes. The best-known public demonstration came on 23 February 2023, when Motherboard journalist Joseph Cox reported getting into his own Lloyds Bank account by phone with a clone made on a free online service from about five minutes of his recorded speech. The bank asked for his date of birth, then had him say the passphrase "my voice is my password". The first attempts failed; after adjusting the generated audio, the system accepted it and he heard his balance and recent transactions.

The weakness was structural. The voiceprint checked similarity, the date of birth was the only other factor, and dates of birth are easy to find in breached data. Voice cloning has improved since then: research systems such as Microsoft's VALL-E (January 2023) work from a 3-second recording, and Starling Bank warned UK customers in September 2024 that three seconds of online audio can be enough.

The FBI's December 2024 public service announcement lists cloned voices used to gain access to bank accounts among current criminal techniques, so this is no longer a theoretical risk.

Is voice biometrics still safe after AI voice cloning?

Voice biometrics is no longer safe as a stand-alone authenticator. NIST's SP 800-63B-4, finalised in July 2025, states that biometric comparison based on voice shall not be used in its digital identity authentication guidelines. The same document requires presentation attack detection for facial recognition and discusses injection attack detection, which shows where standards bodies now place the risk.

Voice matching can still be useful as a passive risk signal: a strong mismatch is a good reason to step up, and a match can reduce friction for low-risk requests such as checking a balance. What it should not do is approve a payment, a password reset or a change of contact details by itself.

For institutions with large enrolled voiceprint populations, the change does not have to be abrupt. Start by listing every action a voice match currently permits, then move the high-risk ones behind an app approval or callback. Tell customers why the extra step exists; many will already have read about voice cloning scams. Keep the voiceprint data under the same retention and consent rules as any other biometric, and plan for its eventual retirement if it no longer earns its place in the risk model.

How to combine deepfake detection with voice biometrics

Banks and contact centres that keep voice biometrics should add a synthetic-speech check and change what a pass allows. A practical design looks like this.

• Run deepfake detection on every call that reaches voice authentication, not only on calls that fail it, since a clone is most dangerous when it passes.
• Treat a voiceprint match plus a low synthetic-speech score as permission for low-risk servicing only.
• Require an out-of-band factor, such as an in-app push approval or a callback to the number on file, for payments, payee changes, password resets and contact detail updates.
• When the synthetic-speech score is high, end self-service, route to a trained agent and notify the customer on a separate channel.
• Log scores, model versions and decisions for each call so fraud teams can review incidents and tune thresholds.

Where voice deepfake detection falls short

Detection has its own weaknesses. Narrowband phone codecs remove some of the high-frequency evidence detectors use, short utterances such as a spoken passphrase give the model little to work with, and new generators can be missed until models are retrained. ASVspoof 5 added adversarial attacks for the first time precisely because attackers can tune audio to fool detectors.

That is why detection belongs alongside, not instead of, process controls. It narrows the set of calls that need expensive verification and catches clones that would otherwise pass a voiceprint, but the decision rule must still assume some clones will get through.

How Neural Defend adds deepfake detection to voice authentication

Neural Defend's NeuroCall, currently in Beta, analyses call audio for synthetic speech and returns a risk signal that sits next to your existing voice biometric result, so your policy can decide what a match is allowed to approve. For digital channels, NeuroVerify checks face images, video and audio in one API request with six signals and returns a unified risk score with signal-level evidence, and reports under 200 ms p95 on eligible image requests under defined test conditions.

Both can be deployed in a managed cloud, private cloud or VPC, on-premises or air-gapped, and Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certification, which matters when call recordings and biometric data are in scope.