An SMS that seems to be sent by the bank. An immediate call with the voice of a family member, a boss or a supposed employee of the entity. An urgent request to confirm keys, validate a code or authorize a transfer.
The fraud only lasts a few minutes but it can be enough to leave your account shaking. “When the amount defrauded exceeds 50,000 euros, the penalty can reach six years in prison,” explains Juan Antonio Signes García, partner at Sanahuja Abogados Penalistas and member of the European Criminal Bar Association (ECBA).
This is how the scam that mixes fake SMS and cloned voices works
The sequence usually starts with a case of smishing. INCIBE defines this technique as sending messages that impersonate a legitimate entity to push the victim to click on a link, deliver data or act under pressure. The message speaks of an urgency and prepares the ground for the next step, the call.
Then comes the telephone contact. That’s where voice cloning with artificial intelligence comes into play. INCIBE has explained that these tools can generate a very convincing imitation based on a few seconds of previous audio, so that the victim believes they are listening to someone they trust. That detail is what turns a conventional scam into a much more persuasive maneuver.
Why this fraud is more credible than others
The strength of deception is not only in technology, but in the sum of elements. The SMS provides context, the call confirms the false alert and the cloned voice eliminates one of the most common psychological barriers, distrust of an unknown interlocutor. When the conversation includes specific references and a tone of urgency, the victim may act before checking whether they are really speaking to their bank, a co-worker, or a family member.
That is the most delicate point. For years, the voice functioned as an almost spontaneous signal of authenticity. The expansion of generative AI has eroded that security and greatly reduced the cost of spoofing.
The CNMC will block SMS with false aliases, but does not stop calls with synthetic voice
In March, the National Markets and Competition Commission approved the circular that regulates the Alias Registry for SMS, MMS and RCS. Starting June 7, 2026, operators must block messages sent with unregistered aliases or sent by unauthorized providers. The measure seeks to make it difficult for criminals to impersonate the commercial name of banks, companies or administrations in mobile messaging.
However, this protection has clear limits. The new registration acts on the messaging channel and not on the phone call with a cloned voice, which is precisely the decisive part of this hybrid scam. In other words, blocking fake SMS may close part of the way, but it doesn’t by itself neutralize fraud when social engineering continues over the phone.
What to do if you receive a suspicious SMS and call
The first rule is to do nothing under pressure. If the message asks to act immediately and you then receive a call confirming the content of the SMS, it is prudent to cut off communication and contact the entity or person supposedly involved yourself through their usual number.
INCIBE also recommends not providing passwords, verification codes or bank details over the phone, even if the voice is completely familiar. It also advises preserving all possible evidence and reporting the incident as soon as possible through 017, its free and confidential cybersecurity help line.
The claim to the bank can be key if the charge has already occurred
The payment services regulations establish that the entity must return unauthorized operations unless it proves fraud or serious negligence on the part of the client. In April 2025, the Supreme Court confirmed this criterion in a ruling against Ibercaja for a case of SIM swapping and stressed that the simple technical record of an operation is not enough to demonstrate that it was really authorized by the user.
This reasoning may also be decisive in new frauds involving cloned voices. If the client denies having validly authorized the transaction and there are indications of sophisticated deception, the discussion is not limited to the criminal sphere. You can also open a complaint with the bank about the authenticity of the order and the effectiveness of its security controls.