The scam call sounds real now. Verify, don't trust the voice.
Criminals are renting AI voice agents to impersonate support teams. Clear verification rules protect your staff, and clear messaging protects your customers.
By the Xuru Technologies team · 5 September 2026
Key takeaways
- A phishing platform reportedly uses AI voice agents posing as Apple Support to steal passcodes and two-factor codes.
- Another campaign abuses Microsoft 365 login flows to bypass two-factor authentication at thousands of organisations.
- Verification habits and phishing-resistant logins are the best defence.
Voice used to be a reliable sign of a real person. AI has changed that, and attackers are using it at scale.
What happened
DMARC Report's round-up described both campaigns, along with ransomware operators using AI coding tools in attacks.
What it means for businesses
- Staff are targets. Fake "IT support" calls ask for codes.
- Customers are targets. Scammers may impersonate your business.
- Codes can be stolen. SMS and app codes are weaker than passkeys.
Defences that work
| Defence | How |
|---|---|
| Never share codes rule | No real support team asks for them. |
| Call-back verification | Hang up and call a known number. |
| Passkeys and security keys | Can't be read out over the phone. |
| Customer warning on your site | "We will never ask for your password." |
Frequently asked questions
What is AI voice phishing?Scam calls using AI-generated voices that sound like real support staff or colleagues, to trick people into sharing codes or passwords.
Scam calls using AI-generated voices that sound like real support staff or colleagues, to trick people into sharing codes or passwords.
Can two-factor authentication be bypassed?Some phishing kits can capture codes in real time. Phishing-resistant options like passkeys are much stronger.
Some phishing kits can capture codes in real time. Phishing-resistant options like passkeys are much stronger.
How do I protect my customers?Tell them clearly how you will and won't contact them, and publish an official contact page to verify against.
Tell them clearly how you will and won't contact them, and publish an official contact page to verify against.
Stop scams before they start.
Passkeys, MFA, login protection and clear customer security messaging.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed
Leave a Reply