How to Detect AI-Generated Voice and Deepfake Audio in 2026

In January 2024, a finance worker in Hong Kong wired $25 million after a video call with what he believed was his company's CFO. Every person on that call was a deepfake — face and voice. The attackers used commercially available voice cloning to replicate the CFO's speech patterns from earnings call recordings freely available on YouTube.

That was 2024. The tools have got cheaper, faster and more convincing since.

The deepfake audio problem

Voice cloning has moved from academic research to consumer product in under three years. The barrier to entry is now effectively zero for anyone willing to spend a few dollars and upload a voice sample.

How voice cloning works in 2026

Modern voice synthesis uses neural codec models — architectures that decompose speech into discrete tokens capturing timbre, pitch, rhythm and phonetics, then reconstruct audio from those tokens against new text. The practical consequence is that voice identity and spoken content have been fully separated: once a model has your timbre, it can say anything in it.

Where voice deepfakes are already causing harm

Scam calls. The FBI reported a 300% increase in AI-assisted voice fraud between 2024 and 2025. The most common pattern: clone a family member's voice from social media, then call with an "emergency" demanding money. Victims consistently report that the voice sounded exactly right — tone, cadence, even verbal tics.

Political disinformation. In the 2024 New Hampshire primary, AI-generated robocalls impersonated President Biden telling voters to skip the election. The audio was convincing enough to prompt an FCC ruling making AI-generated voice calls illegal without consent. But regulation does not stop bad actors; it only makes the consequences clearer after the damage is done.

Fake podcasts and audio content. Entire podcast episodes have been generated using cloned host voices, published to platforms, and indexed by search engines before anyone flagged them. The economic incentive is ad revenue; the reputational damage falls on the real host. One podcaster discovered 14 episodes under her name that she had never recorded, each accumulating downloads for weeks before takedown.

Corporate fraud. Beyond the Hong Kong case, multiple companies have reported voice-phishing attacks where attackers cloned executive voices from public conference calls, investor presentations or media interviews. The target is always the same: wire transfers, credential sharing, or access to sensitive data authorised by a "trusted" voice.

The voice was my mother's. Same accent, same rhythm, same way she says my name. I almost sent $3,000 before my actual mother called me back. — Victim testimony, FTC report, 2025

Technical tells: what AI voice gets wrong

However convincing deepfake audio sounds to the human ear, synthetic speech has measurable differences from real human voice. The difficulty is that most of those differences sit below the threshold of conscious perception. They exist in the signal, not in what you "hear".

Spectral artefacts

Real human speech produces a complex frequency spectrum shaped by the physical resonance of the vocal tract — throat, mouth, nasal cavities. Every person's spectrum is unique and consistent across utterances. AI-generated voice approximates that spectrum but often shows unnaturally smooth formant transitions: the frequencies shift too evenly between vowel sounds, lacking the micro-variations caused by physical articulation. Spectrogram analysis can reveal these patterns, though reading them takes either training or an automated classifier.

Breathing patterns and micro-pauses

Humans breathe. That sounds obvious, but it is a critical detection signal. Real speech contains involuntary breath sounds — inhalation before long phrases, slight catches between clauses, audible exhalation during laughter or emphasis. Most voice cloning systems generate speech continuously without realistic breathing. Some newer systems have added synthetic breath sounds, but these tend to be too regular, spaced at consistent intervals rather than varying with emotional state and sentence structure. The absence of breathing, or breathing that follows a mechanical pattern, is one of the strongest perceptual cues that something is off.

Emotional flatness and prosody gaps

Human emotion modulates speech in subtle, context-dependent ways. Genuine surprise involves a pitch spike followed by a specific decay pattern. Real anger compresses vowel duration. Authentic laughter has a chaotic spectral signature that is extremely difficult to synthesise convincingly. Current voice cloning captures a speaker's average prosody but struggles with emotional transitions — the shift from calm to excited, from explaining to joking. The voice sounds like the person, but not like the person feeling something.

Pronunciation consistency

Real speakers have pronunciation habits that are deeply consistent but context-dependent. You might drop the "g" in "running" casually and pronounce it fully in a formal sentence. You might say "gonna" to friends and "going to" in a presentation. Voice clones trained on limited samples either normalise these variations — always formal or always casual — or reproduce them inconsistently, using casual pronunciation in formal contexts and vice versa. This is often the first thing close associates notice: it sounds like them, but not how they would say it in that situation.

Room acoustics and environmental cues

Every real recording carries environmental information: room reverb, a background noise floor, microphone characteristics. AI-generated voice tends to exist in a conspicuously clean acoustic environment, or to have reverb applied as a uniform post-processing effect rather than the complex, frequency-dependent reverb of a real room. When a supposed phone call has studio-quality clarity with no line noise, no compression artefacts and no environmental sound at all, that mismatch is worth investigating on its own.

Detection methods that exist today

Voice deepfake detection is less mature than text or image detection, but the field is advancing quickly. There are three main approaches in use.

Spectral and signal analysis

Classical audio forensics analyses frequency-domain properties: spectral envelope, formant trajectories, harmonic structure, noise floor characteristics. These methods do not need to know which generator produced the audio — they look for statistical anomalies in the signal itself. Strengths: generator-agnostic and explainable. Weakness: high false positive rates on heavily compressed or low-quality audio such as phone calls and voice messages, which is exactly where deepfakes are most commonly deployed.

Neural network classifiers

Deep learning models trained on large datasets of real and synthetic speech. The current state of the art trains on both raw waveforms and spectrogram features, and includes models like the one behind Resemble AI's detection API, trained specifically to identify artefacts from common cloning systems. Like all trained classifiers, they are strongest on generators represented in their training data and weakest on whatever shipped last month.

The figures below are drawn from published evaluations of the named tools rather than vendor marketing.

Watermarking and provenance

Some voice generation platforms now embed inaudible watermarks in their output — imperceptible to the ear but detectable by verification tools. ElevenLabs embeds provenance markers in all generated audio. The limitation mirrors image watermarking exactly: adversarial actors can strip, alter or re-encode audio to remove a watermark, and open-source generators typically never add one. A watermark is a strong trust signal when present, and says nothing whatsoever when absent.

Why single-tool detection fails for voice

If you have read our work on text detection accuracy and image detection, the pattern will be familiar: no single tool reliably covers every generator, every content condition and every delivery channel. For voice it is worse than for either of the others.

Generator diversity

A detector trained mostly on ElevenLabs output may not recognise audio from XTTS or PlayHT. Each generator leaves a different statistical fingerprint, and the open-source ecosystem moves fast enough that a detector trained on last quarter's models may miss this quarter's output entirely. The training-data problem compounds: new generators appear faster than detection models can be retrained.

Channel degradation

Voice deepfakes delivered over phone lines lose the very artefacts that make detection possible. When audio is re-encoded through GSM, VoLTE or WhatsApp's Opus codec, the spectral anomalies that flag synthetic speech get smoothed away alongside genuine compression noise. A detector looking at that audio faces a signal-to-noise problem in which the signal has been partially destroyed by the channel itself.

Multimodal attacks

The most sophisticated deepfakes combine voice with video — lip-synced fake video calls — or with contextual information: the caller knows details about your company, references real meetings, uses internal jargon. Analysing the audio in isolation, however accurately, misses the broader attack surface. The Hong Kong case succeeded not because the voice was perfect but because it was convincing enough in combination with the video, the meeting context and the social engineering around it.

Voice detection in isolation solves the wrong problem. The threat is multimodal — voice, video and context combined.

How our speech check works

Our speech check analyses uploaded audio for synthetic-speech signals and returns a per-detector breakdown, including a voice-specific probability that the recording was machine-generated. Podcast episodes, recorded meetings, voice notes, video narration and forwarded audio messages are all in scope. It works on files you give it, after the fact.

Two things it deliberately does not do. It does not intercept or monitor live phone calls — there is no real-time call analysis here, and any product promising to sit on your telephone line and flag a caller mid-sentence is describing a much harder problem than the one detection tools have solved. And it does not identify who is speaking. Recognising that a recording carries synthetic-speech artefacts is a different task from matching a voice to a named person, and we do not do the second one.

Multiple signals, not one verdict

When you submit audio you do not get a bare "real or fake". You get individual scores from each detector we run, the voice-specific synthetic-speech probability, and any provenance or watermark result where one exists. If one detector flags a clip at 91% while another returns 34%, you see both numbers. That disagreement is itself informative — it often means compression artefacts are confusing one detector and not the other.

How the scores are combined

Showing every score is only half the job; a combined verdict still has to come out somewhere. Plain averaging is the obvious approach and a poor one, because it dilutes the signal from whichever detector actually found something: averaging a 91% and a 34% produces 62.5%, a figure that represents neither finding.

The tempting alternative is a maximum rule — flag the audio if any detector crosses the threshold. We do not do that either. Given how prone spectral analysis is to false positives on compressed audio, a maximum rule on voice would flag a large share of ordinary voice notes. It trades one failure mode for a worse one. What we use instead is a reliability- and decisiveness-weighted consensus, built on four rules.

Detectors near 50 are treated as abstaining. Any score within ±8 points of 50 is excluded from the calculation entirely. A detector returning 47% on a compressed voice note is not casting a vote; it is reporting that the channel has stripped out whatever it needed. That score is still shown to you — it just cannot pull a confident result toward the middle.

Remaining votes are weighted by decisiveness times reliability. Among detectors that committed, each vote counts in proportion to how far it sits from 50, multiplied by a reliability factor for that specific detector.

The reliability weights are deliberate. A declared content-provenance credential outweighs any statistical guess, because a signed declaration that audio was machine-generated is closer to ground truth than an inference from a spectrogram. Conversely, detectors known to be false-positive prone — which, on compressed audio, means most purely spectral methods — are weighted so that they cannot single-handedly override a confident ensemble.

Genuine disagreement is surfaced rather than smoothed. When confident detectors point in genuinely opposite directions, we report the split instead of quietly emitting a midpoint. On voice this happens often enough to matter, and knowing that the tools disagreed is more useful than a tidy number that hides it.

What we are honest about

Voice detection on compressed phone audio is unreliable — for us and for everyone else. We do not claim to have solved a problem that is not solved. Our speech check performs best on clean, high-quality audio: podcasts, recorded meetings, video narration. On audio that has been through a phone codec, treat any result as a weak indicator rather than a finding, and weigh it against everything else you know about the recording.

We also do not publish a headline accuracy figure or false positive rate for our own speech detection. We have not run the kind of controlled, independently reproducible evaluation that would justify putting a number on this page, and a made-up number would be worse than none. What we will state is what the system does, which you can check on any scan: every detector's raw score is shown, abstentions are excluded rather than averaged in, and disagreement is reported.