Researchers Fred Heiding, Claudio Mayrink Verdun, Simon Lermen, Andrew Kao, Vitor Albiero, Lauren Deason, Irina-Elena Veliche, and Christine Lehane (affiliations: Harvard Kennedy School, Harvard School of Engineering and Applied Sciences, Meta Platforms Inc., and independent researchers) published 'Evaluating AI Models' Capability to Automate Voice Phishing Attacks' (arXiv:2607.09970), accepted for publication in Expert Systems with Applications and covered by Help Net Security on 2026-07-17.

The study combined a large-scale survey experiment (N=4,100 US adults) with qualitative interviews (N=12). Participants were exposed to audio recordings or transcripts of five vishing scenarios generated by six leading voice-AI systems — Llama Full-Duplex (Meta, experimental mode, April 2025), OpenAI Advanced Voice Mode ('Sol' voice, GPT-4o), Google Gemini ('Ursa' voice, mobile app), Sesame ('Maya' voice, open-source conversational model), Play.AI ('Celeste' voice), and ElevenLabs (voice cloning) — alongside human-caller control recordings, with model refusals, disclaimers, and generation beeps edited out to simulate a competent attacker.

The five scam scenarios were: (1) MasterCard credential phishing impersonating card support (~7-15% compliance), (2) Gmail credential phishing impersonating Google support (~6-13% compliance), (3) a charitable Donation solicitation from an unknown caller (20-32% compliance), (4) a 'Police-Grandma' bail/relative-in-trouble scenario from an unknown caller (24-25% compliance), and (5) a 'Sister-in-Distress' scenario using an ElevenLabs-cloned voice claiming a family emergency requiring immediate funds, which produced the highest compliance at 36.1% (combined 'yes'/'maybe' responses; 6.5% hard 'yes'). Overall compliance across all five scenarios and both AI and human callers averaged 16.5%.

Detection performance varied sharply by model: participants correctly flagged OpenAI AVM as synthetic 93.7% of the time, Llama FD 88.6%, Gemini 88.4%, Play.AI 85.6%, ElevenLabs clones 75.8%, but Sesame only 66.3% — the hardest system to distinguish from a human. Overall voice-AI detection accuracy across all six systems was 70.3%, while real human callers were incorrectly flagged as synthetic between 54.2% and 67.4% of the time, indicating participants applied a strong 'guess AI' bias rather than genuine discrimination ability. Neither self-reported AI familiarity nor voice-assistant usage improved detection (51.2% for frequent AI users vs. 54.4% for non-users, not statistically significant).

Regression analysis identified message persuasiveness as the dominant predictor of victim compliance (odds ratio 2.58, p<.001), followed by caller sentiment (OR=1.64) and a 9-item trustworthiness scale covering expertise, credibility, empathy, urgency, and confidence (OR=1.48, Cronbach's alpha=.927). A separate 6-item Partner Modelling Questionnaire human-likeness scale (alpha=.93) did not independently predict compliance once persuasiveness and trustworthiness were controlled for — meaning voice realism itself was not the primary driver of victim harm; script quality and emotional manipulation were. Participants who cited 'repetitive responses' (OR=1.38, p=.048), 'long-winded responses' (OR=3.80, p<.001), or 'unnatural phrasing' in text transcripts (OR=3.39, p<.001) were more likely to correctly detect AI, but these cues went unnoticed by the majority of participants despite being present in the recordings.

The paper's economic model computed expected hourly attacker profit per voice system using a revenue formula r_j(t,X_i) = m(X_i) x p_j(t,X_i) x q, where m(X_i) is average extractable value per victim (~$450), p_j is per-call success probability, and q is a 0.6% call-to-contact conversion rate calibrated from marketing-industry data. Human operators paid US minimum-adjacent wages ($34.55/hr) were unprofitable at -$27.10/hr expected profit despite a 23% success rate, because human labor cost dominates. Among AI systems, Gemini (12% success rate, $0.13/hr compute cost) yielded +$2.38/hr expected profit, Sesame (15.2% success, $0.33/hr cost) yielded +$1.03/hr, and ElevenLabs (36.9% success rate — driven by the cloned-voice sister scenario — $0.75/hr cost) yielded the highest expected profit at +$2.97/hr; Llama FD, OpenAI AVM, and Play.AI remained unprofitable at current success/cost ratios. The authors estimate a one-time attacker development cost of $16,120 (260 engineering hours at $62/hr), with break-even periods of continuous operation ranging from 226 days (ElevenLabs) to 655 days (Sesame) to recoup that investment — figures the authors expect to shrink further as model costs decline and success rates improve.

The authors conclude that 'the primary risk of present-day AI-enabled vishing thus lies in the economics of automation rather than novel or superhuman persuasive techniques,' and that 'even a 5% success rate across millions of automated calls represents a transformative shift in the economics of fraud.' They recommend consumer education pivot from 'detect the synthetic voice' toward recognizing manipulative conversational strategies and resisting urgency/emotional-pressure tactics, plus out-of-band verification through independently-established channels, developer-side abuse-prevention and provenance tracking for voice-AI platforms, risk-based Know-Your-Customer controls for AI voice service signup, and regulatory frameworks that account for the 'automation dividend' of near-zero marginal-cost attacks.

This finding sits within a broader 2025-2026 vishing/imposter-scam surge documented by federal agencies: the FBI has issued repeated advisories on AI voice-cloning attacks impersonating senior US officials and family members in distress, and the FTC's June 2026 fraud report found Americans reported $3.5 billion in imposter-scam losses in 2025 (up roughly threefold since 2020), with imposter scams the top-reported fraud category for a fifth consecutive year and social media the fastest-growing initial contact vector ($2.1B in 2025 losses, an eightfold increase since 2020). A separate, since-withdrawn arXiv preprint (2602.20061, submitted Feb 2026, withdrawn Mar 2026 pending revision) reported even lower human discrimination ability (37.5% accuracy, below chance) on a smaller 22-participant, 16-clip sample, consistent directionally with the Harvard/Meta findings though not independently verified due to withdrawal.