How a Voice-Cloning Gang Turned the Trust Check Into the Attack

Greek police say a telephone fraud ring took more than a million euros by cloning the voices of its victims' own relatives, and the detail worth pausing on is where the recording came from. The gang did not scrape social media or lift audio from a podcast. When a target hesitated and said they wanted to check with a family member, the caller asked for that person's number, phoned them under a separate pretext, kept them talking, and recorded them. The clone was played back to the original target as confirmation.

Two men aged 23 and 25 were arrested in Nea Ionia, Attica, Hellenic Police announced on 18 September 2026, on charges of criminal organisation, fraud and aggravated theft. What the case shows is not that voice cloning got better. It is that the safety step people are told to take was converted into the attacker's supply chain, and that the telephone channel it all runs on quietly favours the attack over any detector pointed at it.

Hellenic Police announced on 18 September 2026 that two men had been arrested in Nea Ionia, in the Athens suburbs, just after about 30,000 euros in valuables were taken from a house. The Hellenic Police say they were the collectors for a criminal organisation whose telephone fraud has taken more than a million euros since early July. The charges are criminal organisation, fraud, and aggravated theft both completed and attempted. Four more people sit in the case file and three of them have been identified.

None of that is unusual. Telephone fraud rings of this shape are arrested across Europe most months. The detail that makes this case worth reading closely is where the gang got its audio.

They did not scrape it from social media. They did not lift it from a podcast, a company webinar or a voicemail greeting. They asked the victim for it, and the victim handed it over as an act of caution.

‍

What the Greek police found

The organisation ran a three-role structure of organisers, callers and collectors, and made contact by impersonating staff of HEDNO, the Hellenic Electricity Distribution Network Operator, along with mobile operators and fibre-optic providers. Investigators have confirmed the same method in at least five further cases beyond the one interrupted at the arrest.

Two euro figures circulate in the coverage and they are not the same figure. The announcement puts the illegal benefit attached to the charged counts above 120,000 euros. The estimate of what the organisation earned in total exceeds one million. A charge sheet describes what prosecutors believe they can prove on specific counts; an investigative estimate describes what the unit thinks the group actually took. Reporting that quotes only the million tends to obscure that distinction, and it matters if you are trying to read how solid the case is.

The announcement credits two units. The Directorate for Combating Organised Crime dismantled the organisation, and officers of the Sub-Directorate for the Prosecution of Economic Crimes carried out the operation in Nea Ionia.

‍

The call that harvested the voice

The sequence runs in four moves, and the third one is the interesting one.

A caller phones the target with a technical pretext, most often that fibre-optic work at the address requires them to do something now. If the target accepts it, a collector is sent and valuables are taken. That version of the fraud involves no artificial intelligence at all.

If the target hesitates, the caller does not push. They encourage the check. They suggest the target speak to a relative or another trusted person to confirm, and they ask for that person's number so the confirmation can be arranged. The gang then phones the relative, presenting as an employee of a mobile operator, and records a sample of their voice during what police describe as a brief conversation. An AI tool clones it. The original target is called back and hears, in a voice they have known for years, that the story is true.

Read as a whole, the clone is not a way around the victim's suspicion. It is manufactured out of it. A victim who complies immediately is never worth the extra two calls, so the cloning capability exists only for the people who did the thing everyone is told to do.

‍

This is a different failure from the one in the Bacolod payment fraud, where a public figure's voice was available to anyone because he is a public figure, and different again from the Taipei conversion ring, where the cloned voices belonged to the operation's own staff. Here the voice was chosen by the victim and collected to order.

‍

What a voice clone actually needs

Voice cloning, in the sense used in these cases, is the synthesis of new speech in a target speaker's voice from a short recording of that speaker. It is distinct from voice conversion, which transforms a live speaker's utterance into another person's timbre in near real time, and distinct again from a replayed recording, which carries only the words that were actually said. The wider family of synthetic media these sit in is set out in what is a deepfake. The Greek method as described fits cloning: a sample was captured, a model was built from it, and new sentences were spoken that the relative never uttered.

The resource question is how much of the target's speech the attacker has to obtain. Published zero-shot systems answer it in seconds rather than minutes. The paper introducing VALL-E states that it synthesises personalised speech from a three-second enrolled recording of a speaker the model has never encountered. Other zero-shot systems quote figures in the same range.

Three seconds is roughly one sentence. That explains why a brief call was enough: a short service call can capture a sentence or two of the relative speaking without them noticing anything unusual.

Europol's 2025 Internet Organised Crime Threat Assessment describes the same capability from the enforcement side, noting that criminals can use voice deepfakes to increase the credibility of spear-phishing campaigns used for business email compromise and CEO fraud, and separately that vishing is enabled by the prevalence of spoofing services which let criminals impersonate local and reputable entities. The Greek case is both of those observations arriving in the same operation, aimed at households rather than finance departments.

‍

The band both sides have to use

A telephone call is not a recording. It is a heavily constrained transmission, and the constraint is old and specific. ITU-T Recommendation G.711, Pulse code modulation of voice frequencies, remains in force and defines the narrowband channel most voice calls still traverse: audio passed in the 300 to 3,400 Hz band and sampled at 8,000 Hz, companded to eight bits per sample at 64 kbit/s.

That band was not chosen to preserve a voice. It was chosen, decades before anyone considered synthesising one, as the minimum that carries intelligible and recognisable speech at acceptable cost. Everything above about 4 kHz cannot be represented at all at an 8 kHz sampling rate, and everything above 3,400 Hz is filtered before it gets that far.

For the attacker this is not a constraint. Intelligible, recognisable speech is precisely the input a cloning system asks for, and the channel is engineered to deliver exactly that and nothing more. The gang did not need a studio capture. It needed a phone call, which is what it had.

‍

What detectors lose on that wire

The same channel treats the defence differently, and this is measurable rather than rhetorical.

Published anti-spoofing countermeasures are trained and benchmarked on clean, wide-band material. Wang, Wang, Nishizaki and Li report baselines of 1.76% equal error rate for a ResNet18 system and 2.36% for an LCNN system on the ASVspoof2019 logical-access set. Evaluated against the ASVspoof2021 logical-access set, which carries material transmitted over real telephone systems including VoIP and the public switched telephone network, the same architectures score 3.23% and 3.95%. The error rate roughly doubles.

That comparison is tighter than it first looks. The ASVspoof 2021 evaluation plan states that the logical-access attacks are the same as those used in 2019 and that countermeasures should be trained on the 2019 training and development data, so the variable the 2021 set adds is transmission rather than a new set of attacks. Its trials are carried across a public switched telephone network or a VoIP network, using codecs including a-law and G.722, and the plan notes the resulting data may differ in bandwidth and sampling frequency. The residual caveat is that these remain two evaluation sets rather than one set scored twice. Zhang, Zhu, Jiang and Duan reach the same conclusion from a different angle, observing significant degradation when countermeasure systems are evaluated across datasets, hypothesising channel mismatch as an important reason, and confirming it by degrading systems on deliberately channel-shifted data. Delgado and colleagues at EURECOM found the same with narrowband and coded speech: detection degraded significantly, though optimising the features recovered much of the loss. The remedies proposed in this literature are telling in themselves: Wang and colleagues recover part of the loss by low-pass filtering the input and then rebuilding the missing band, which is an admission that the high frequencies a countermeasure would like to use are not reliably there. The general limits of this class of control are covered in how anti-spoofing works and where it stops working.

‍

‍

The asymmetry nobody prices in

Put the two requirements on the same axis and the shape of the problem changes.

‍

The attacker's entire input requirement sits inside the band the channel preserves. The detector's does not. Roughly 3.1 kHz of bandwidth is sufficient for one side of this fight and a measurable handicap for the other, and that asymmetry is a property of the wire rather than of any vendor's model. A better detector can recover much of that loss, as the filtering research shows, but it cannot put back a band that was filtered out before the file existed.

This is the same structural point made in liveness detection versus deepfake detection and in presentation attacks versus injection attacks, arriving through a different door. In both of those, a control fails not because it is weak but because the signal it interrogates never reaches it. A phone call does that to audio forensics by design.

It also explains a pattern across the incident library. In the PSNI investment ad case the synthetic artefact survived, sitting on a platform where it could in principle be examined. Here there is no artefact at all. The cloned audio existed for the duration of one call to one household and was never recorded by anyone with an interest in keeping it. Any detection-led response has to reckon with the fact that the evidence is gone before anybody knows a crime occurred.

‍

Where the relative check broke

Consumer advice across Europe converges on one instruction: if a call makes you uneasy, stop and confirm through someone you trust. That instruction is sound, and it is worth being precise about what the Greek gang actually defeated, because the careless version of this argument concludes that checking with a relative no longer works, which is both wrong and harmful.

The victim did not call the relative. The victim gave the relative's number to the stranger on the phone, and the stranger placed the call. The verification the victim believed they had arranged never happened. What happened was that the attacker acquired a new target, contacted them, and recorded them.

The failing step is therefore narrow and nameable. It is not the callback. It is the disclosure of a third party's contact details to an unverified caller, and the surrender of call initiation to that caller. A victim who had ended the call, found their daughter's number in their own phone, and dialled it themselves would have reached their daughter. The gang's method requires the intermediate step, and it requires it because a clone of a voice is only useful if the attacker controls when and to whom that voice speaks.

That is a more useful finding than saying voices can no longer be trusted. It identifies a specific behaviour to change, which is that a caller who offers to arrange your verification for you has told you what they are.

‍

What the FBI already recommends

The clearest public guidance on this attack class predates the Greek case by more than a year. The FBI's Internet Crime Complaint Center issued public service announcement I-051525-PSA on 15 May 2025, on senior US officials being impersonated in a malicious messaging campaign. It records that actors are more frequently exploiting AI-generated audio to impersonate well-known public figures or personal relations, and it lists four defensive steps.

A year and a half earlier, in alert I-120324-PSA of 3 December 2024, the same office had already described the family-emergency version of this fraud, recording that criminals generate short audio clips containing a loved one's voice to impersonate a close relative in a crisis situation, asking for immediate financial assistance or demanding a ransom. What the Greek case adds to that description is the acquisition step. The FBI's account begins with an attacker who already has the loved one's voice. This organisation did not have it, and solved that by getting the victim to nominate whose voice to take.

Grading the four recommendations against the mechanism Greek police describe is unflattering for three of them.

‍

The recommendation that survives is the one people treat as the quaint option. A secret word agreed within a family is established before any attacker is in the loop, is not present in any recording of anyone's voice, and cannot be reconstructed from a three-second sample however good the model is. It is out-of-band with respect to the channel under attack, which is the only property that matters here.

The Hellenic Police drew the same lesson in the announcement itself. It advises people to hang up and call the relative themselves on a number they already know, and to use a pre-agreed safety word or phrase.

The first recommendation, verify the identity of the person calling you, is not wrong in principle. It failed in this case because the verification was routed through the attacker. Stated more carefully, it should read: verify through a channel the caller had no part in choosing.

‍

Call direction beats voice analysis

What generalises from this case is a control that does not depend on anyone, human or machine, telling a real voice from a synthesised one.

Every step of the Greek method requires inbound calls the attacker placed. The pretext call is inbound. The harvesting call to the relative is inbound. The confirmation call carrying the clone is inbound. At no point does the operation survive a victim who hangs up and dials out to a number they already held. The defence is not acoustic. It is directional.

For an organisation, the same rule has a familiar shape. Any instruction arriving by voice that moves money, changes payment details or releases goods should be confirmed on a channel and an endpoint held before the request arrived. Not a number supplied in the call. Not a number in the email that prompted it. The reason this works is not that the callback is harder to fake. It is that the attacker has to be waiting at an address they could not choose.

Audio analysis still has a job, and it is a different job from the one people imagine. It belongs where recordings exist and persist: contact-centre archives, recorded onboarding calls, submitted voice evidence, enrolment audio in a verification flow. Those are places where the sample can be captured at better than telephone quality, retained, and examined at leisure. Deployed there, the same techniques that struggle on a live narrowband call are working with the material they were built for. The cases in how deepfakes bypass KYC and how deepfakes bypass liveness checks sit in that category; a cold call to a pensioner in Attica does not.

‍

What operators and banks can change

Two layers can act here without needing to classify any audio.

Telecoms operators sit on the enabling condition. Europol's assessment names spoofing services as what makes vishing effective, letting criminals present as local and reputable entities. A call that claims to come from an electricity distributor or a fibre provider is far more persuasive when the number on the handset agrees. Caller-line-identity authentication addresses the pretext rather than the clone, which is useful precisely because it fires at step one, before any voice has been recorded.

Banks and payment providers sit on the outcome, though in this case only partially. The Greek fraud terminated in physical collection of jewellery and cash by a person who came to the door, so payment controls had no sight of it. That distinguishes it from the investment-scam pattern and from the Ghana endorsement case, where the money left through a regulated channel that could in principle have questioned it. Where voice-initiated fraud does terminate in a transfer, the useful trigger is behavioural rather than acoustic: a first-time payee, an unusual amount, and a customer who is on a call while making the payment.

The wider identity-assurance argument in the Pinellas synthetic identity case applies in miniature. A signal is only worth what the process that produced it is worth. A voice on a phone certifies that someone can produce audio in that timbre. Before cloning was cheap, that was close enough to identity to rely on. It is not any more, and the substitutes are the ones that bind to something the attacker cannot manufacture from a recording.

‍

What this case does not tell us

Several things a reader might want are not in the public record, and it is better to say so than to fill them in.

No source consulted names the AI tool the gang used, or states how long the recorded samples were beyond describing the harvesting call as brief. The three-second figure in this article comes from published research on what such systems require, not from the Greek investigation, and it should be read as an upper bound on how much audio the attackers needed rather than a description of what they took.

‍

The announcement does not say how the gang identified targets, whether the households were chosen from a list, or how the relative's identity was selected when a victim named more than one person. The number of victims is given as at least five confirmed cases beyond the interrupted one, which is a floor rather than a total. The proceedings are at arrest and charge, so nothing here is a finding of a court and the people arrested are accused rather than convicted.

The interpretation that the trust check functions as the harvesting step is DDG's reading of the published sequence. Police describe the steps; they do not characterise the structure that way.

‍

Frequently asked questions

How much of someone's voice does an attacker need to clone it?
Published zero-shot systems specify seconds rather than minutes. The VALL-E paper describes synthesising personalised speech from a three-second enrolled recording of a previously unseen speaker. Police describe the call the gang used to capture the sample as brief.

Can a person hear the difference on a phone call?
Reliably, no, and the channel is part of why. Narrowband telephony discards everything above about 3.4 kHz, so the cues a careful listener might use are degraded for the listener in the same way they are degraded for a detector.

Does calling a relative back still protect you?
Yes, if you place the call yourself to a number you already have. The Greek victims did not do that. They gave the relative's number to the caller, who made the call instead, which is the step that produced the clone.

Why do voice detectors perform worse on telephone audio?
They are trained on wide-band material and then asked to score material that has been band-limited and companded. Published baselines of 1.76% and 2.36% equal error rate on studio-condition data rise to 3.23% and 3.95% on telephone-transmitted evaluation material.

What actually works against this attack?
A phrase agreed with family in advance, and a rule that you originate the verifying call to a number you already hold. Both are out-of-band with respect to the voice channel, which is why neither can be defeated by a better clone.

‍

Methodology and sources

Facts about the Greek case are drawn from four accounts read directly: Euronews, Greek City Times, Protothema and a Greek trade reproduction of the Hellenic Police announcement of 18 September 2026, supplemented by Business Daily. The Hellenic Police website returned HTTP 403 to every automated request made during this work, so the announcement is cited at one remove through outlets reproducing it. Two independent reproductions, ICTPlus and Protothema, carry identical text. GreekReporter, which also covered the case, returned HTTP 403 and none of its detail is used.

Technical figures come from primary documents rather than commentary. The band and sampling rate are those of ITU-T Recommendation G.711, listed as in force; the recommendation text itself sits behind the ITU's publication system, so the parameters are taken from the standard's widely reproduced specification rather than from the document. Enrolment duration is from the VALL-E paper's own abstract. Equal error rates are from the abstract and results of the low-pass filtering paper, with its two evaluation sets named rather than collapsed, and the design relationship between those sets taken from the ASVspoof 2021 evaluation plan published by the challenge consortium. The Europol material is from the IOCTA 2025 report PDF, and the FBI guidance from public service announcement I-051525-PSA.

Coverage appeared to disagree on the arresting unit and the arrest date. The announcement resolves both: it names both units, and it is dated 18 September without stating when the arrests took place. No figure, name or date appears here that was not read in one of the listed sources. DuckDuckGoose has not analysed any audio connected to this case and makes no claim about the material involved.

Last update: Q3 2026.