A client in Vashi asked us this in September, after a supplier's accounts person received a call from "the owner" asking for an urgent transfer. The voice was right. The urgency was right. The owner was in a meeting and had made no such call. Nothing was lost, because the accounts person rang him back first, but the question that followed was reasonable: is there software that would have caught it?
Lacewing Technologies is an AI and software development company in Navi Mumbai. We build our own products alongside client work, and a good part of that client work is voice agents: software that answers and makes phone calls in English, Hindi and Marathi. So we sit on both sides of this question. We generate synthetic speech for a living, and we get asked how to detect it. This post is our honest answer as of November 2026.
How is a synthetic voice actually made?#
Two different things get called "AI voice", and they have different detection profiles.
Text-to-speech (TTS) turns written text into audio in a stock voice. Modern TTS is a neural model that predicts an acoustic representation from text and a second model (a vocoder) that turns that representation into a waveform. The voices are fluent and expressive, and they are not pretending to be anyone in particular. This is what a legitimate voice agent uses.
Voice cloning is TTS conditioned on a sample of a specific person. The model extracts a compact description of the speaker (timbre, pitch range, accent, habits of articulation) and renders new text in that voice. This is the part that worries people, because the sample requirement has collapsed. ElevenLabs' own documentation recommends 1 to 2 minutes of clean audio for an instant clone, sets a floor of 10 seconds in total, and notes that more than 2 or 3 minutes "will yield little improvement". Its professional clone, the higher-fidelity option, wants 30 to 180 minutes.
Ten seconds is a WhatsApp voice note. Two minutes is a wedding video, a podcast appearance, a product demo on LinkedIn, or a "wrong number" call in which a stranger keeps you talking. The Tamil Nadu Police advisory on voice-cloning scams describes exactly that last technique: a call disguised as a wrong number, used to collect a sample.
The reputable vendors have guardrails. ElevenLabs requires a verification step for professional clones and states that you cannot clone another person's voice even with their consent. Those controls are real and they do matter. They also only bind the vendors who apply them. Open-weights speech models run on a rented GPU with no verification at all, and that is the tooling a fraud operation uses.
Which detection methods exist, and what does each catch?#
Five families of method are in use. None is sufficient alone, and the table is the fastest way to see why.
| Method | What it looks at | What it catches well | Where it fails |
|---|---|---|---|
| Spectral and artefact analysis | Vocoder fingerprints, phase inconsistencies, unnatural high-frequency energy, over-smooth spectra | Output from models the classifier was trained on, in clean audio | New or unseen models; audio re-encoded through a phone codec; clips of a few seconds |
| Prosody and breathing cues | Pauses, breath placement, pitch drift, disfluencies, response latency | Older or cheaper TTS, scripted playback, agents with slow turn-taking | Current expressive models that synthesise breaths and hesitations; a human reading a script |
| Watermarking | A signal the generator embedded on purpose | Audio from the one vendor whose detector you are using | Every model that did not embed a mark; the absence of a mark means nothing |
| Provenance (C2PA) | A signed manifest of who made the file and how | Files that keep their manifest from creation to playback | Anything re-recorded, streamed through a call, or stripped of metadata |
| Liveness challenges | Whether the caller can do something unpredictable in real time | Pre-recorded clips and slow clone pipelines | Low-latency real-time clones driven by a live operator |
The rest of this post goes through each row, then the limits that cut across all of them.
What do spectral and artefact detectors look for?#
Every synthesis pipeline leaves traces. A vocoder reconstructs a waveform from a compressed representation, and the reconstruction is never perfect: phase relationships between harmonics come out slightly wrong, energy above a few kilohertz is either missing or too regular, and the spectrum is smoother than a real vocal tract and a real room would produce. Early detectors were hand-built around these cues. Current ones are neural classifiers trained on large sets of real and synthetic speech, which learn whatever separates the two in their training data.
That last clause is the whole limitation. A classifier learns the fingerprints of the generators it was shown. A generator released next quarter, with a different vocoder, has different fingerprints, and the classifier's confidence on it is meaningless in both directions. Text detectors have the same structural problem; audio has it worse, because vocoders change faster than written language does.
It is also why vendor-specific classifiers are more honest than general ones. ElevenLabs publishes a free AI Speech Classifier and is unusually plain about scope: it reports "the probability that it was generated with ElevenLabs AI voice technology", it "cannot detect audio from other providers", it analyses only the first minute of a sample, and it "does not reliably classify audio generated with the Eleven v3 model". A vendor telling you its own detector lags its own newest model is telling you something true about the field.
The US Federal Trade Commission's Voice Cloning Challenge, judged in 2024, is a useful snapshot. The FTC framed the harm as fraud against "families and small businesses", and the winning entries split across a detection app, a method that perturbs a person's published voice samples so they clone badly, and a scheme that authenticates human origin at the moment of recording. Note how little of that is "listen to the clip and decide".
Can prosody and breathing give a clone away?#
Often, with older systems. Humans breathe at phrase boundaries, run out of air on long sentences, speed up when they are confident and slow down when they are reading. Cheap TTS does none of this: pauses are uniform, every sentence lands at the same pitch, and there is no breath because nothing is breathing.
Two other cues matter in a live call rather than a recorded clip.
Response latency. A clone pipeline driven by a human operator has to hear you, decide what to say, type or speak it, synthesise, and play it back. Interrupt mid-sentence and ask something off-script, and the gap before the answer is often the tell. This is also the cue most likely to fade: real-time speech-to-speech models have brought turn-taking down to conversational speed, and we use that latency in the agents we build for legitimate purposes.
Disfluency. People say "umm", restart sentences, and trail off. Expressive models now synthesise all of that on request, so its presence proves nothing. Its total absence in an urgent caller is still worth noticing, because real panic is messy.
Treat prosody as a reason to be suspicious, never a reason to be reassured. A halting, breathless caller might be a scared relative or might be a model instructed to sound scared.
Do watermarks solve this?#
For the vendor that embeds them, partly. For everyone else, no.
A watermark is a signal the generator inserts on purpose so that its own detector can later find it. Google DeepMind's SynthID is the most prominent published example for audio. Google states that SynthID embeds a watermark in audio produced through its Lyria music model and in NotebookLM's podcast generation, that it is inaudible, and that it survives "common modifications like adding noise, MP3 compression, or changing the speed of the track". Those are Google's claims about Google's models, and they describe a real engineering achievement.
What a watermark cannot do is tell you anything about audio that was never watermarked. If a fraudster uses an open-weights model, there is no mark. If they use a vendor that does not watermark, there is no mark. If the mark exists but you are checking with the wrong vendor's detector, you see nothing. A watermark check that comes back clean is therefore not evidence of a human voice; it is evidence that this particular generator was not used. Anyone selling you "watermark detection" as a general defence has skipped that paragraph.
Watermarks do a narrower job well: letting a responsible vendor identify its own output when a clip is reported and trace it to an account. That is accountability, not detection.
Where does C2PA provenance fit?#
C2PA is an open standard, backed by a steering committee that includes Adobe, Google, Microsoft, OpenAI, Meta, the BBC and Sony, that attaches a signed record of origin to a media file. The C2PA FAQ describes Content Credentials as working "like a nutrition label for digital content", covering "an image, video, audio recording, or document". The technical specification bundles assertions about how the file was made into a claim, signs it, and binds the result into a manifest; its embeddable formats include the containers audio actually ships in, such as RIFF (WAV), BMFF (MP4 and M4A), ID3 (MP3) and AIFF. The specification also defines a digitalSourceType that can mark content as produced by a trained algorithm, which is the mechanism for a generator to say "this is synthetic" in a verifiable way.
The limit is structural and C2PA states it itself: any modification, "intentional or accidental", breaks the cryptographic linkage, and metadata "can be removed inadvertently or intentionally". That is the right design for a news photograph. For a phone call it is close to irrelevant, because a call is not a file. Audio leaves a generator, passes through a SIP gateway, is encoded by the telephone network, and arrives at your ear with no metadata at all. Provenance helps when you are judging a recording handed to you intact: a forwarded voice note, a clip in a news story, an audio exhibit. It cannot help during the call.
What does a liveness challenge do in a call flow?#
This is the method we actually recommend to clients, because it does not depend on winning an arms race with the generator.
A liveness challenge asks the caller to do something unpredictable in real time that a pre-recorded clip cannot do and a slow clone pipeline does badly. In practice:
Ask for something only the real person knows. Not a security question with an answer on social media. Something about the last conversation you had, the name of a colleague's dog, what they ate at lunch.
Ask them to say something specific. A phrase you choose, now. A recording cannot comply. A clone pipeline can, but with a delay and often with a flat delivery that does not match the panic of the rest of the call.
Switch channel. Hang up and call back on a number you already hold. Send a message on a channel the caller did not initiate. The Tamil Nadu Police advisory gives the same instruction: verify through a known, verified number and ask probing questions.
Introduce a procedural delay that the fraud cannot survive. Any payment above a threshold waits for a second approver, full stop. A genuine owner is mildly irritated for ten minutes. A fraud collapses.
Liveness is weakest against a live operator with a real-time clone and good preparation. It is still better than any acoustic method, because the acoustic methods fail silently and liveness fails loudly: either the caller passes the challenge or they do not.
Where do all of these methods break at once?#
Three conditions defeat most of the table simultaneously, and all three are normal in an Indian phone call.
Compression over the network. Mobile and VoIP codecs discard precisely the high-frequency detail and fine phase structure that artefact detectors rely on. By the time a voice reaches you through a 2G fallback in a Thane basement, the model's artefacts and the network's are indistinguishable. Whether watermarks designed to survive MP3 compression also survive a telephone codec is not something the vendors we checked publish, and we will not invent a claim.
Short clips. A fraud call needs perhaps fifteen seconds of speech: "Papa, I'm in trouble, send money to this number, I'll explain later." Classifiers trained on longer samples produce noise on that little audio. ElevenLabs' classifier uses up to a minute precisely because more audio is more signal.
New models. Every classifier is a snapshot of the generators that existed when it was trained. The gap between a new speech model's release and a detector that handles it is measured in months, and the people running frauds are not waiting.
A fourth condition is specific to India. The published detection research and the vendor classifiers are overwhelmingly trained on English. Performance on Hindi, Marathi, Tamil or Bengali speech, and on speech that switches between a regional language and English mid-sentence, is less characterised and should be assumed weaker. A clone of a Marathi-speaking parent has not been tested by most of the tools you can find online.
What should a business deploying voice agents do?#
This is where we have direct experience rather than reading.
Disclose that the caller is an AI, at the start. Every voice agent Lacewing Technologies builds opens by saying it is an automated assistant for the named business. We do this because callers deserve to know, and because the alternative, being discovered partway through, costs more trust than the disclosure ever does. In our deployments the disclosure has not measurably hurt call completion, though we have not run a controlled study and will not pretend otherwise.
Never use the agent's voice as a proof of identity. The agent speaks for the business. It should never ask a customer to confirm a payment, share an OTP or approve a change on the strength of the agent having "the company's voice". The whole point of this post is that voice is not proof.
Give the agent a verifiable callback. If the agent calls a customer, it should offer them the option to hang up and call the number on the company website. A legitimate agent loses nothing by this; a fraud impersonating your brand cannot offer it.
Write the internal rule before the external one. The owner-impersonation fraud our client nearly suffered is defeated by one line in the finance SOP: no transfer on a voice instruction alone, regardless of who appears to be calling. Put it in writing, tell the owner it applies to them, and test it once by having the owner actually ring and ask.
Protect your call recordings. Say in the disclosure that calls are recorded, restrict access, and delete on a schedule. A breached call archive is a voice-cloning dataset for your entire customer base.
How should an individual verify a call?#
The sequence we give our own staff and families, in order:
Notice the pattern, not the voice. Urgency, secrecy, a new payment destination, a reason you cannot call back. The Tamil Nadu Police description of these scams names "sobbing or pleading tones" and a push to UPI. The script is the tell; the voice is just the costume.
Hang up and call back. On the saved number, not the one that just called. If the relative is really in trouble, they will answer, or someone near them will.
Ask one question only they can answer. Something about your last shared meal, not their date of birth.
Do not pay under time pressure. Nothing legitimate requires UPI within five minutes.
Report it. The Tamil Nadu Police advisory, like other state police advisories, directs victims to the 1930 cyber helpline and the national portal at cybercrime.gov.in. Report even if no money was lost, because the pattern data is how police connect cases.
A note on institutional impersonation. In November 2024 the Reserve Bank of India cautioned the public about deepfake videos of its Governor giving investment advice, stating that "RBI does not give any such financial investment advice". That was video, not a call, but the lesson transfers: an official body that would never call you with a financial instruction has not started doing so because the voice sounds right.
The honest summary#
Can you detect an AI-generated voice? From the audio alone, sometimes: a clean recording, a known generator, a decent length, and a classifier trained on that generator will give a useful signal. Through a phone line, on a fifteen-second clip, in Marathi, from a model released last month, no tool we have found will tell you reliably, and any tool that claims to should publish the test that proves it.
So the practical answer in 2026 is to stop asking the audio and start asking the caller. Watermarks and provenance make responsible vendors accountable. Artefact and prosody analysis are worth running on recordings after the fact. But the defence that works during the call, against a model that does not exist yet, is a callback on a known number and a payment process that does not move on a voice. That is cheaper than any detector, and it is the one piece of advice here that will still be true next year.