The One Credential You Cannot Reset

By the time a scam phone call reaches you, the hard part is already done. Before the phone rings, a criminal has studied who you are and who you answer to, learned who signs off on payments and who is traveling this week, and pulled a few seconds of your voice from a webinar, a podcast, or a recorded meeting to build a copy of it. The call itself is quick. Building the fake that makes the call believable is the slow part, and until recently, that slow part is what gave the person being targeted a chance to catch it.

Recently, we have seen security vendors release free tools that erase that slow part. These tools work like this: you type in your name, record several seconds of audio, and it clones your voice, gathers public details about you (such as your current employer and role or relationships), and produces a personalized impersonation you can talk to live. A companion tool builds a fake video version of your face. What matters is not who makes these tools, but what the tools themselves can do: they hand anyone, for free and in minutes, the exact thing a criminal used to spend weeks building.

There Is a Responsible Way to Do This

Showing someone how easily they can be impersonated has real value, when it is done deliberately: with the person’s consent, for a clear purpose, with someone accountable for the result, and with rules for how the recording is stored and when it is destroyed. That is protection. It creates one controlled example, for one person, and then answers for it. This is not a new position for Doppel. We have made this case before: cloning a real person’s voice or likeness should not happen without that individual’s awareness of how the copy could be used or shared, and how it is secured against misuse.

Handing the same power to anyone, for free, is a different thing entirely. What separates the two is not whether a box was checked. It is what happens after the voice is cloned: whether there is a defined scope, someone accountable for the result, and any control over how the copy can be used and where it ends up. A deliberate demonstration has those controls, and shows one person their own risk. Scope, accountability, and control are the clear line between a safety tool and a liability.

What the Tool Actually Hands Over

A name and a short recording are exactly what a criminal needs to build a convincing fake of your voice. The tool does not make that easier to obtain. It simply gives it away. It also combines two things criminals normally have to gather separately, the public details of your life and a copy of your voice, bundled into one neat package. That is precisely how these scams are built, and here it arrives finished.

Even the intended version, cloning only yourself, means handing over a voice sample together with your job title, employer, and contact details. Tools like these typically keep that material for an unspecified time and pass it to outside AI services to do the actual work. You are not sampling a demo; you are depositing a copy of your voice and a profile of yourself into someone else’s system.

A copied voice does not stay in the exercise. Paired with a few facts about your job and the people around you, it can be reused to trick your company into wiring money, to pressure you or your family for payment, or to fool a partner or vendor into trusting a voice that is not really yours. One recording can reach everyone who trusts that voice.

Promoting all of this as a fun, free download also quietly teaches people that their voice and face are throwaway data. They are not. You can change a password after it leaks. You cannot change your voice.

The Safeguards That Disappear

When this power is freely available, the protections that normally surround it fall away:

• Companies tell regulators, insurers, and courts that fake executive voices are dangerous and tightly controlled. Handing employees a free way to make those same fakes contradicts the very position they are defending.
• The safeguards are self-attested paperwork, not enforced controls. A checkbox covers your own clone; a line in the terms asks you to promise you had permission for anyone else’s voice. Nothing verifies whose voice was actually recorded, and the promise does not prevent misuse. It only leaves whoever accepted the terms personally on the hook for it.
• Anyone with a grudge, an employee or a contractor, can build a fake of an executive and take it elsewhere, for an unauthorized test or for outright fraud, all under the cover of security awareness.
• Once convincing fake recordings of a named executive exist out in the world, proving “I never said that” becomes far harder in a dispute, an investigation, or a fraud case.
• Marketing this as exciting and free pushes people to adopt it before anyone has weighed the risk, reviewed the privacy impact, or given the person being copied any say.

We do not leave blank passports on the front desk with a sign that says help yourself. A voice, now that it can be copied easily, has become a form of identification too, and the same rule applies: the moment anyone can reproduce it for free, it stops protecting the person it is meant to identify.

Doppel spends its days on the other side of that scam call, protecting people and brands from impersonation and taking the fakes down. In a world facing a flood of deepfakes, impersonations, and synthetic content, our job is to protect what is real, not to add to what is fake.