Voice Fraud Detection for Bank Call Centers: A Review Workflow for Cloned-Voice Callers

Why Do Financial Institutions Need Voice Deepfake Detection Now?

Three US agencies have now described cloned or synthetic voices being used against financial institutions and their staff, and the calls they describe are the ones contact centres handle every day. In public service announcement I-120324, published on 3 December 2024, the FBI's Internet Crime Complaint Center said criminals obtain access to bank accounts by using AI-generated audio clips of individuals and impersonating them. The same notice tells consumers to hang up and call the bank back on a number they look up themselves, which is the customer-side version of an established-number callback.

FinCEN's alert FIN-2024-Alert004, dated 13 November 2024, reported an increase in suspicious activity reports describing suspected deepfake media and named deepfake voices among the tools used in family emergency schemes and executive impersonation. Its red flags include a customer who declines multifactor authentication and a customer who tries to switch communication method during a live verification check, citing suspicious technical glitches. FinCEN asks institutions to put the key term FIN-2024-DEEPFAKEFRAUD in SAR field 2 and in the narrative when activity relates to the alert.

The CISA and FBI advisory on Scattered Spider (AA23-320A, first published 16 November 2023 and revised 29 July 2025) shows the same pattern from the employee side. The actors phoned IT help desks posing as employees and persuaded staff to reset passwords and move MFA to devices the actors controlled, after first learning what each help desk asks during a reset. A bank's customer line faces the same help desk impersonation, with a customer's name in place of an employee's.

How Does Voice Cloning Defeat Voice Biometrics and Knowledge Questions?

Both controls assume that the person on the line is the person the account belongs to. Voice biometric enrolment stores a model of how a customer sounds and scores each new call against it. A clone trained on the customer's own recordings aims to land close to that model, so a system that only measures similarity to the enrolled voice can accept it. Matching a speaker and detecting synthetic speech are separate problems, and a voiceprint engine needs a dedicated spoof check to tell a real caller from a good copy.

Knowledge-based questions fail for a different reason. Date of birth, postcode, recent transactions and security answers are often available from breaches, social media or an earlier phishing call, and the Scattered Spider advisory notes that the actors researched reset procedures before calling. With a convincing voice and accurate answers, an attacker passes most scripted checks. Caller ID adds little: numbers can be spoofed, and the same advisory documents SIM swaps that move a victim's number onto an attacker's card.

Real-time voice conversion makes the attack interactive. The attacker speaks and software converts the speech into the target's voice, so they can answer unexpected questions and react to the agent instead of playing pre-generated clips. The awkward pauses agents were once taught to listen for are no longer a dependable tell.

Which Contact Centre Requests Should Trigger Step-Up Review?

Classify the request before the agent discloses anything or starts authentication. FFIEC IT support guidance says authentication can vary with the contact method, the problem, the requested action and the data involved, and it points to layered controls such as MFA, pre-established secrets and callbacks to established numbers. A balance inquiry and a payee addition should never share a script.

Account takeover usually runs through a short chain: change the email or phone number, reset the password or MFA device, then add a payee or raise a transfer limit. Treat each link as high risk on its own, and treat two or more of them on one account within a short window as a pattern. Controls for the last step are covered on the new payee enrollment page; this workflow aims to break the chain earlier.

Step-by-Step Review Workflow for a Suspected Cloned-Voice Call

These steps assume the agent sees a risk panel with the request type, recent account events and any detection result. Each step leaves a record, so a supervisor or investigator can reconstruct the decision later.

Agents need written permission to stop a call. A rule that lets a polite, persistent caller talk past step-up because they sound distressed is the gap these attacks look for. Accessibility needs designed alternatives: customers who cannot use the app or a camera should have a pre-agreed route, such as a branch visit or a delayed callback, so agents never improvise a weaker check.

• Classify the request from the caller's first statement and fix the authentication path for that tier before any account details are read out.
• Check recent events on the account: contact-detail changes, password or MFA resets, new devices, failed logins and SIM-change signals from the carrier where available.
• Run standard authentication and watch the live voice screening result if NeuroCall (Beta) is deployed on the line.
• If the request is high risk or any signal conflicts, move confirmation out of the voice channel: in-app approval, a NeuroVerify selfie or video check, or a callback to the number held on file.
• If the caller refuses every alternative or pushes urgency, pause the request, explain how to complete it safely, and transfer to the fraud team with notes attached.
• Record the request, factors attempted, results, detection outputs, data disclosed and the decision, and keep the call recording under restricted access.
• Where review supports suspected deepfake activity, open a NeuroDetect case for the recording and reference FIN-2024-DEEPFAKEFRAUD in any SAR filed.

How Should Banks Run Outbound Callbacks When a Voice Is in Doubt?

A callback adds independence only when the bank chooses the number from its own records and the callback cannot approve more than the action under review. Dialling a number supplied during the suspicious call, or one changed on the account last week, reconnects the attacker.

Before dialling, check when the number on file last changed and whether the carrier reports a recent SIM swap. On the call, state the exact action awaiting confirmation, never ask for a one-time code or password, and listen for signs of coaching, because a customer who has been told by a fraudster to confirm a payment can sound entirely genuine. Pass the outcome to a separate release owner so the agent who placed the callback does not also release the payment.

Log the trigger, the source and version of the dialled number, the agent, the time, the details presented, the customer's response and any escalation. Those fields let an audit test whether recent contact changes are undermining the callback.

Where Voice Fraud Detection for Bank Call Centers Fits: NeuroCall, NeuroVerify and NeuroDetect

Neural Defend splits the job across three products so each step in the workflow gets the right kind of evidence. NeuroCall, currently in Beta, is the voice and call deepfake detection product: it looks for signs of synthetic or cloned speech in call audio so agents and fraud systems get a signal while the conversation is still running. Because it is in Beta, run a scoped pilot on your own call audio and telephony path before it drives production routing.

NeuroVerify handles re-verification once a call moves out of the voice channel. The bank sends the customer a link from its app or by SMS, the customer takes a selfie or short video, and one API request checks it with six signals: Visual Safety Screening, Live Presence Verification, Face Manipulation Detection, AI Generative Model Analysis, AI Pixel-Level Manipulation and AI Content Compliance. It returns one risk score with signal-level evidence in under 200 ms p95 on eligible image requests under defined test conditions, and your policy decides the outcome. NeuroVerify does not read ID documents, so compare the face with the onboarding record you already hold.

On the public VendorBench-100 benchmark for deepfake image detection (arXiv, v2 of 29 July 2026), Neural Defend ranked first of 36 systems with an MCC of 0.876, against 0.646 for the next-best vendor. The benchmark covers 100 still images, so it is evidence for the selfie and video-frame step and says nothing about call audio. One VendorBench author also co-authored the paper on ARCAS 1B, Neural Defend's own deepfake detection model, and the corpus and scores are public for anyone to rerun.

NeuroDetect is the investigation workspace. An analyst uploads the authorized call recording into a case, reviews results down to individual audio segments, reads an LLM-assisted summary linked to the evidence, and downloads a forensic report with observations, uncertainty, provenance, model context and analyst notes. The analyst makes the final call. The products can run as a managed cloud API, in a private cloud or VPC, as a secure container, on-premises or air-gapped, and Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications.

What Voice Deepfake Detection Cannot Do on a Bank Call

Detection estimates whether audio was synthesised or altered. It does not establish who is speaking, whether they are authorised, or whether a genuine customer is being coached by a fraudster in real time. A real customer reading out a payment instruction under a scammer's direction will pass any synthetic-speech check, which is why request controls and payment holds carry most of the weight.

Call audio is difficult material. Narrowband codecs, packet loss, background noise, speakerphones, accents, illness and assistive speech tools all change the signal and can push scores in either direction. Treat a high score as a reason to step up and a low score as the absence of one warning, not as proof of identity. A score alone should never deny service to a customer who can complete an alternative check.

Recording and analysing calls also brings notice, consent and retention duties that differ by jurisdiction. Agree them with legal and privacy teams before a pilot, and limit recording access to the people who review cases.