AI vishing: persuasion, not voice-cloning realism, predicts who complies

What is this?

On July 15, 2026, researchers from Harvard Kennedy School, Harvard’s School of Engineering and Applied Sciences, and Meta Platforms published Evaluating AI Models’ Capability to Automate Voice Phishing Attacks (arXiv 2607.09970). The team — Fred Heiding, Claudio Mayrink Verdun, Simon Lermen, Andrew Kao, Vitor Albiero, Lauren Deason, Irina-Elena Veliche, and Christine Lehane — ran a survey experiment with 4,100 US adults plus a smaller set of qualitative interviews, measuring how people react to phone scams voiced by six commercial speech systems (Llama Full Duplex, Sesame, Gemini, OpenAI’s Advanced Voice, PlayAI, and ElevenLabs) against human callers as a control.

The headline finding is uncomfortable for the deepfake-detection market: whether a target complies with a scam has almost nothing to do with how convincingly human the voice sounds, and almost everything to do with how persuasive the script is. A caller can be correctly identified as synthetic and still walk away with a one-time passcode.

How it works

The study separated two things that the security conversation usually conflates: detection (can a listener tell the voice is synthetic?) and compliance (does the listener do what the caller asks?).

On detection, participants flagged synthetic voices as machines about 70% of the time — which sounds like a working defense until you look at the control group. The same participants also labelled real human callers as machines roughly two times out of three. In other words, there is no reliable “AI voice” detection skill on display here; there is a population that has become broadly suspicious of unfamiliar callers. Suspicion rose; accuracy did not. Prior exposure to AI tools or voice assistants made no measurable difference.

On compliance, the researchers scored each caller on sentiment, persuasiveness, trustworthiness, and human-likeness, then tested which of those predicted whether a person would go along with the request. Persuasiveness was the dominant factor: each step up the persuasiveness scale was associated with roughly a 2.58× increase in the odds of compliance. Once persuasiveness and the other factors were accounted for, human-likeness — the property every voice-cloning vendor sells and every detector tries to catch — added essentially no independent predictive power.

A compact way to read the result:

# What actually moves a vishing target

  Voice realism (human-likeness)
    Common assumption: "The better the clone, the more victims."
    → In the model, once other factors are controlled,
      realism does little independent work.

  Script persuasiveness
    Reality: each step up the persuasion scale
    → ~2.58x higher odds of compliance.
    A voice pegged as synthetic can still succeed.

Why it matters

The numbers need careful reading, and the paper is honest about this. Across the five scam scenarios, about 16.5% of participants said they would or might comply. The “relative in distress” scenario reached as high as 36.1% — but that figure lumps together firm “yes” answers with “maybe” answers. In the voice-clone variant, only about 6.5% gave a hard “yes.” Hesitation is not the same as handing over a credit-card code, and briefings that treat a third of the population as ready to pay are misreading what was measured. That said, hesitation still helps an attacker: a caller who keeps you on the line gets a second attempt.

Two structural consequences follow. First, the industry reflex — buy synthetic-voice detection, train staff to “listen for the robot” — targets the wrong variable. Detection is already near-random for humans, and detecting the machine does not stop the persuasion. Second, the practical shift AI brings is not better fakery but scale: it removes language, staffing, and geography as constraints on running persuasive scripts at volume. Voice fraud was economical for organised operations long before voice cloning; the paper’s cost model (built on a US wage assumption) is best read for direction, not decimal places.

The finding sits in the same lineage as text-based social-engineering research: the model is a force multiplier for a human weakness, not a novel exploit. It maps to the social-engineering and identity-threat sections of most 2026 threat reports rather than to any single product vulnerability.

Defenses

Because compliance rides on persuasion rather than audio fidelity, controls that depend on a human hearing the difference will fail. The durable mitigations are procedural and out-of-band.

1. Out-of-band verification for any sensitive action. A password reset, wire transfer, credential change, or MFA reset should never be triggerable by an inbound caller alone. Require a callback to a number the organisation already holds, or a second channel the caller does not control.
2. Voice is not an authentication factor. Retire voice-recognition-based identity proofing at help desks and call centres. Treat any voice — human or synthetic — as unauthenticated until proven otherwise through data the caller cannot socially engineer.
3. Family and executive code words. For “relative in distress” and CEO-fraud patterns, a pre-agreed passphrase defeats a cloned voice regardless of quality. Distribute these the same way you would a recovery code.
4. Rewrite the runbook, not the training. Awareness programmes that teach staff to spot robotic artefacts train a skill people demonstrably lack. Replace “detect the fake” guidance with hard procedural gates and scripts for pausing high-pressure requests.
5. Expect more false positives on legitimate calls. As the public grows suspicious of all unfamiliar callers, genuine outbound calls from banks and IT desks get flagged as fake. Build verification paths that work in both directions so legitimate callbacks are easy to confirm.

Status

Item	Reference	Date	Notes
Voice-phishing study	arXiv 2607.09970	2026-07-15	N=4,100 survey + interviews; six voice systems + human control
Detection vs. compliance	same	2026	~70% synthetic detection, but humans mislabelled as machines ~2/3 of the time
Key predictor	same	2026	persuasiveness ≈ 2.58× odds of compliance; human-likeness not independently predictive
Compliance range	same	2026	~16.5% overall (yes/maybe); up to 36.1% relative-in-distress; ~6.5% hard “yes” in clone scenario

The paper is a research result, not a disclosed exploit against a named product. Its operational message is stable across stacks: if your anti-vishing posture depends on someone noticing the voice is synthetic, it is defending the wrong variable. Move the control to out-of-band verification and procedure.