AI can now clone a family member’s voice — and use it to drain your bank account. What you should know

The Office of the Superintendent of Financial Institutions (OSFI) (1) is the federal agency that regulates and supervises Canada's banks, insurers, and pension plans. In its Annual Risk Outlook 2024–25 (2), it said it is monitoring threats to institutions' integrity and security. It noted that due to advances in technology, financial institutions are "facing more sophisticated and frequent threats to their security and operational resilience." It's a warning that should concern every Canadian who holds a bank or investment account.

What OSFI is telling banks to fix right now

OSFI's analysis identified technology and operational risk as one of the most pressing systemic threats facing Canada's financial system. These risks include AI-enabled fraud, such as voice cloning, that can be used against bank employees and their customers.

The problem is that much of the banking system's phone-based security was built around the assumption that only you sound like you. But AI voice cloning changes that completely.

Today, realistic voice-cloning tools are widely available online for less than $5 per month. Many only require about 30 seconds of audio to create a convincing imitation. That audio can easily come from social media videos, voicemail greetings, podcasts, or video calls.

How AI voice cloning makes fraud calls sound exactly like your family

The mechanics behind the scam are surprisingly simple. All a scammer must do is collect a short voice sample of a target's family member, often from social media, and feed it into a cloning tool. Within minutes, they can generate audio that mimics tone, cadence and speech patterns. In many cases, the results are convincing enough to fool both humans and some automated verification systems.

According to a recent Angus Reid report (3), more than 80% of Canadians say they've been targeted by digital or phone scammers since 2024, while nearly 30% report having money or personal information stolen. In response to the growing threat of phone fraud, the Ontario Securities Commission (OSC) has issued video guidance on how to avoid AI-voice scams (4).

The emotional pressure of a distressed voice, especially one that sounds like a child or partner in crisis, can override the hesitation that might otherwise stop someone from sending money.

Stop wondering where your money went. Compare Canada’s top-rated budgeting apps and find the perfect tool to help you save more this month.

The authentication questions your bank asks are no longer enough

When dealing with banks or other financial institutions by telephone, one of the primary security measures has been verbal security questions like "What's your mother's maiden name?” or “Where was the last place you spent money on your account?"

However, these measures were designed to stop traditional identity theft, not AI-generated impersonation. There are two separate vulnerabilities here.

First, a fraudster impersonating you may already have access to your security answers through past data breaches or social engineering scams.

Second, and arguably more concerning, a fraudster pretending to be a family member doesn't necessarily need to fool your bank. They only need to fool you into authorizing the transfer yourself.

That second scenario is especially difficult for banks to detect because the transaction technically comes from a legitimate account holder acting under pressure or deception.

How to set up a verbal safe word with family members

One of the simplest protections you can put in place is also one of the most effective: creating a verbal safe word with your family.

If someone calls claiming to be a loved one in distress and asks for money, they must provide the agreed-upon safe word before you take any financial action.

Make sure that it is: