Telephone scams often attempt to defraud or steal the identity of individuals by eliciting a response to a pressing request for payments or submission of information such as social security numbers. These calls usually come from numbers that individuals have not encountered before, and the request is passed through as a pre-recorded message with a generic voice. But AI-enabled voice cloning and the ability to spoof Caller IDs have given scammers the opportunity to run schemes targeted individuals with a cloned familiar voice coming from trusted numbers. This paper reports the findings from an empirical study that replicates this scenario with 14 participants (7 pairs of family relatives of friends) to capture the experiences of receiving such a scam call and responses to it. The results of our thematic analysis show that the familiar voice, coming from a trusted number of a family relative or a friend, is highly persuasive towards deceiving the call receiver (i.e., callee) to indeed follow through with the scammer’s request. The callee, together with the caller or the participants who volunteered their voices for cloning, saw this scam working particularly in the context of family emergencies, as real-world reports have surfaced about children held for ransom, grandchildren under arrest, or relatives in car accidents. The callers and callees saw no immediate way to fend off these “family emergency scams” than for families and friends to work on “family/friend codewords” that are hard to be inferred by the scammers (and thus cloned). We discuss our findings towards the development of user-centered interventions that would facilitate the detection of a wide range of AI-enabled voice cloning scams, in addition to the suggested personal ways of scam detection.

This paper reports on a study exploring how two groups of individuals, legally blind$(n=36)$and sighted ones$(n=36)$, react to aural telephone scam warnings in naturalistic settings. As spoofing a CallerID is trivial, communicating the context of an incoming call instead offers a better possibility to warn a receiver about a potential scam. Usually, such warnings are visual in nature and fail to cater to users with visual disabilities. To address this exclusion, we developed an aural variant of telephone scam warnings and tested them in three conditions: baseline (no warning), short warning, and contextual warning that preceded the scam's content. We tested the two most common scam scenarios: fraud (interest rate reduction) and identity theft (social security number) by coldcalling participants and recording their actions, and debriefing and obtaining consent afterward. Only two participants “pressed one” as the scam demanded, both from the legally blind group that heard the contextual warning for the social security scenario. Upon close inspection, we learned that one of them did so because of accessibility issues with their screen reader and the other did so intentionally because the warning convinced them to waste the scammer's time, so they don't scam vulnerable people. Both the legally blind and sighted participants found the contextual warnings as powerful usable security cues that, together with STIR/SHAKEN indicators like Scam Likely, would provide robust protection against any type of scam. We also discussed the potential privacy implications of the contextual warnings and collected recommendations for usably accessible implementation.