Fake Voices For Sale: How Dark Web Scammers Turn AI Into Cheap Phone Traps
Commercial listings for AI voice-cloning tools on dark web forums and Telegram channels jumped 7.4 times between the first seven months of 2024 and the same period in 2026, according to new research published Thursday by NordVPN.
The findings, gathered through the company’s NordLayer Intelligence threat exposure platform, show advertisements for voice-cloning software, services, and pricing rose 82 percent in 2025 before climbing another 75 percent during the first seven months of 2026. Forum discussions mentioning voice cloning in early 2026 have already surpassed the total recorded for all of 2025. Scams detailing specific schemes—such as executive wire fraud, voice phishing, family emergencies, and bank security bypasses—are on track to triple this year.
“Voice used to be the thing that proved you were talking to a real person. That is over, and most people have not adjusted yet,” said Adrianus Warmenhoven, a cybersecurity advisor at NordVPN. “The phone is still where the bank calls, where family calls, where anything urgent comes through. That trust is now something criminals can buy their way into cheaply.”
Researchers pointed out that the shift is less about audio quality and more about how easily cloned audio fits into ready-to-use fraud kits. Sellers bundle cloned audio into automated phone systems, spoofed dialers, and tools built to steal one-time passcodes.
Artificial Intelligence
Advertised products include the DOOM AI Call Center, which pitches real-time conversational agents, and DeepBot C2, an automated tool offering cloned voices and stolen credentials to create a digital twin of a target. Another program, the IVR Voice Clone System, mimics automated bank menus to trick callers into entering card numbers, PINs, and Social Security numbers.
Bank fraud and automated bank-menu impersonation represent the most common topics of discussion on these forums in 2026, followed by celebrity and cryptocurrency scams. Business wire fraud, bank biometric attacks, and fake family-emergency calls are discussed far less often.
Entry costs remain low. A Telegram bot named Saint OTP Bot, which calls targets to intercept banking and crypto security codes, sells for about $30 a week. The developer claims the bot abuses legitimate tools from ElevenLabs and Twilio without those companies’ knowledge. Another tool, Gorilla’s Call Bot, charges $200 to blast out 1,000 automated interactive phone calls, while a standalone program called Berry AI Voice Clone sells outright for $400 to $500.
Much of the black market relies on stolen access to legitimate commercial platforms. Hacked ElevenLabs and HeyGen accounts routinely sell for $10 to $150. Stolen ElevenLabs API keys go for as little as $8, while an ElevenLabs Scale tier account offering unlimited voice cloning sells for $150.
To guard against phone scams, NordVPN recommends setting up an agreed-upon family safe word for urgent money requests, hanging up to dial the caller back directly using a known number, and watching for false urgency or demands for secrecy rather than trying to spot flaws in the caller’s voice.