By: Scott Harris
When Artificial Intelligence Can Pretend to Be You
Not long ago, a friend of our family got a call from his wife. At least, that’s who it sounded like. Whether it was a clever AI bot or a person using an AI-assisted voice changer, we’ll never know. She said her flight had made an emergency landing, that the crew wouldn’t let her take her purse off the plane, and that she needed him to read her his credit card number so she could rent a car before they were all gone. It was urgent, it was her voice, and it made just enough sense in the moment.
He read the number. Hours later, still worried that his wife wasn’t picking up, he finally reached her when her flight landed, right on schedule, with no emergency at all. By then a car had been rented on his card, and the last I heard, it was believed to have been driven into Mexico. In the end they didn’t have to pay, but only after a trip to that airport to prove it hadn’t been them. His wife will never post about getting on a plane again.
That’s AI impersonation fraud, and it’s the subject of this post.
What’s changed
Throughout this series I’ve written about deepfakes, AI training data, children’s digital identities, and what happens to our identity after death. They all point to one larger concern: what happens when AI can convincingly pretend to be you?
Criminals have always used impersonation. What AI changes is the speed, the realism, and the scale. A classic scam might be an email pretending to come from your boss, a fake social media account with someone’s photo, or a call claiming to be a relative. Those depend on deception, and they have limits. The scammer doesn’t know how the real person sounds or writes, so the messages have mistakes, the voice is wrong, and the story falls apart under a few questions.
AI shrinks those weaknesses. By analyzing what’s publicly available, it can help a scammer imitate someone’s voice, writing style, face, vocabulary, tone, professional relationships, and personal details. It doesn’t just let someone pretend to be you. It helps them sound, look, and communicate like you.
Your voice is already out there
Voice cloning shows the problem most clearly. Modern AI can produce speech that closely matches a real person’s voice, sometimes from a fairly short recording, and most of us have put our voices online already: podcasts, interviews, livestreams, YouTube videos, social posts, and work presentations. You may never have given an AI company permission to copy your voice and still have hours of it publicly available.
So, does publishing your voice online mean you’ve given others permission to recreate it? I don’t think most people would say yes. Sharing a video or doing a podcast means letting people hear you. It doesn’t mean letting AI build a synthetic version of you that can say things you never said. That distinction is at the heart of the Digital Persona Rights debate.
Recognition is the weak spot
My friend’s story is a version of the family emergency scam, and it works because of something we all rely on without thinking: recognition. When you hear the voice of someone you love asking for help, you don’t stop to wonder whether that voice was generated by a machine. You just help.
Businesses face the same thing. Picture an employee getting a call from someone who sounds exactly like the CEO, knows their name, understands the business, and needs an urgent wire transfer, a few gift cards, sensitive information, or account access. Companies have spent years training people to spot suspicious emails. A request in a voice that sounds completely authentic is a much harder problem.
Deepfake video adds another layer. A criminal could combine a cloned voice, a realistic video call, and a fake social profile full of convincing photos and posts. Each piece might pass on its own. Together, they can make an entirely artificial version of a real person. At that point, this isn’t really identity theft anymore. The attacker isn’t stealing your name or password. They’re building a synthetic you.
The raw material is what we post
AI impersonation feeds on the information we leave online. Social profiles can reveal names and relationships, workplaces, family members, locations, hobbies, travel plans, photos, voice recordings, how we communicate, and who we know professionally. My friend’s wife had posted that she was getting on a plane. That one detail was all the scammer needed to make the story believable.
Each detail seems harmless. Together they make a remarkably complete profile, and AI makes that profile easier to organize and use. The real question isn’t whether someone can steal your identity. It’s whether someone can use everything you’ve left online to reconstruct it.
AI also changes the economics. A traditional scam takes time: researching a target, writing messages, building fake profiles, making calls. AI can automate most of that, so one attacker could run personalized impersonation attempts against hundreds or thousands of people at once.
Identity as a security credential
For decades, security has focused on protecting passwords, financial information, and account credentials. AI impersonation means identity itself has to become part of security. Your voice can be an authentication signal, your face an ID method, your writing style a recognizable pattern, and your relationships part of your profile. As AI gets better at reproducing each of those, each one becomes something an attacker can target. Identity no longer just needs protecting from misuse. It may need protecting like a password.
From identity theft to identity replication
Existing laws already cover fraud, identity theft, harassment, and misuse of personal information, but AI raises questions they don’t fully answer:
- Is creating an AI copy of someone’s voice unlawful in itself?
- Should consent be required before someone’s likeness can be used in synthetic media?
- Who’s responsible when an AI impersonation causes financial harm?
- Should victims have a legal right to remove unauthorized AI replicas?
- Should companies have to detect and prevent identity-based AI fraud?
- How should the law tell legitimate parody from malicious impersonation?
Current law mostly focuses on the harm after an impersonation. Digital Persona Rights would go further, recognizing that copying someone’s identity without permission can be a violation in itself, before anyone loses money.
Traditional identity theft means getting information that lets you act as someone else. AI lets someone replicate parts of who you are, and that’s a different kind of damage. A stolen credit card can be canceled and a password can be changed. Your face, voice, and mannerisms can’t be replaced. A convincing digital version of you could damage your reputation, your work relationships, and your family’s trust, and attach your face to things you never said or did. In the worst cases, it could keep circulating long after the original fraud is taken down.
We need better ways to verify each other
As impersonation gets more convincing, we’ll all need to rethink how we confirm who we’re talking to. A familiar voice may not be proof. A face on a video call may not guarantee there’s a real person behind it. An email from a familiar address may not be enough either. Organizations will lean more on multi-step verification, confirmation procedures, digital signatures, and agreed-upon protocols.
At home, simple safeguards help. A family code word for urgent money requests would have saved my friend a lot of grief. Businesses can require independent confirmation before unusual transactions. And all of us can think twice before posting detailed plans, like the fact that we’re about to board a flight. The lesson is simple: as AI gets better at imitating people, we need better ways to verify them.
What protecting identity should mean
Digital Persona Rights recognize that identity is more than a name, a photo, or an ID number. It’s everything that makes you recognizable: your face, your voice, your mannerisms, how you talk, how you behave, your reputation, and your digital presence. As AI learns to reproduce those things, the law needs to recognize that copying them without permission can do real harm even when no traditional identity theft is involved. The goal isn’t to stop digital creativity or expression. It’s to set clear boundaries around when and how a person can be artificially recreated.
The technology isn’t evil on its own. It has real value in entertainment, accessibility, education, and communication. But today’s voice clones and deepfakes will look primitive compared with what’s coming: AI that can hold long conversations in your voice, generate real-time video, adapt to how you communicate, and answer questions using everything you’ve ever posted. At that point, telling the real person from the imitation may be close to impossible.
That leaves a basic question: if technology can convincingly become someone else, shouldn’t each of us have a legal right to control how our identity is copied? Identity theft used to mean stealing someone’s information. The next generation of identity crime may mean creating a version of someone that never existed, but looks, sounds, and acts enough like them to fool the people who love them most. My friend found that out the hard way. Protecting identity can’t just mean protecting information anymore. It has to mean protecting the person behind it.
Join the conversation