Voice Fraud is Moving from Spoofed Numbers Toward Synthetic Identities

Caller-ID spoofing can make a call appear familiar, while a synthetic voice can make the conversation itself more convincing. An attacker can combine these techniques with social engineering to create a compound attack that is harder to assess through conventional caller cues.

INTERPOL’s 2026 Global Financial Fraud Threat Assessment reports that convincing voice clones can be created from as little as 10 seconds of audio in some circumstances. The report also identifies AI-enabled fraud services offering synthetic identity capabilities.

The security challenge is therefore moving beyond whether a number appears trustworthy. synthetic voice telecom fraud can exploit the gap between verified caller information and the apparent authenticity of the speaker.

Caller Authentication Does Not Establish Voice Authenticity

Caller authentication and voice authenticity answer different security questions. Network controls can help establish whether a calling number has been legitimately presented, while voice analysis can assess whether audio has characteristics associated with synthetic generation or manipulation.

A legitimate number can therefore still be used with a convincing cloned voice to persuade a recipient to disclose information or authorise an action. As telecom security expands across network infrastructure and identity controls, caller identity controls, voice security is becoming another layer in the wider security lifecycle.

synthetic voice telecom fraud consequently creates a need for multiple independent signals rather than relying on a telephone number or voice impression alone.

Key Takeaway: Synthetic voice is making impersonation more convincing, increasing the need for layered caller authentication and network-level voice security.

Voice Security is Moving Toward Layered AI and Caller Verification

The emergence of synthetic audio is pushing telecom security beyond traditional caller screening. A network can establish information about a calling number, but that does not necessarily establish whether the voice itself is authentic. This is making synthetic voice telecom fraud increasingly dependent on multiple security signals, including caller identity, signalling information, call behaviour and AI-based audio analysis.

AI Detection is Moving into the Voice Network

Traditional approaches to unwanted calls have relied on reputation databases, known-number lists and traffic patterns. Synthetic voice creates a more adaptive threat because the audio can be generated or modified for each interaction. Detection systems therefore need to identify suspicious combinations of network and behavioural signals rather than relying on a single indicator.

GSMA’s 2026 case study on network-level voice protection describes AI-based systems analysing billions of call events and adapting to changing scam patterns. Hiya’s current voice-security network analyses approximately 28 billion calls per month across more than 40 countries, illustrating the scale at which automated call-risk analysis is increasingly being performed.

For synthetic voice telecom fraud, this creates a shift from static blocking toward continuous analysis. A suspicious call can potentially be assessed using the calling number, network characteristics, calling behaviour and other available signals before the recipient decides whether to trust the interaction.

Caller Verification is Adding Another Security Layer

AI-based audio detection is not the only response. Telecom and industry initiatives are also working on stronger ways to establish who is authorised to make a call.

Open Verifiable Calling, for example, is designed around cryptographically verifiable caller identity, allowing organisations to demonstrate that a number is associated with an authorised entity before the call reaches the recipient. This approach addresses a different part of the problem from synthetic-voice detection: rather than asking only whether the audio sounds genuine, it establishes whether the caller has a verifiable identity.

These approaches can therefore complement each other, Caller Verification, Who is making the call?, Voice Analysis, Does the audio show signs of manipulation and Network Intelligence, What additional context surrounds the call?

Together, these layers can provide more information for security decisions than any single control.

Synthetic Voice is Increasing Pressure on Detection Systems

Voice-security models also face a moving target. New synthesis techniques can produce different acoustic characteristics, while compression, background noise and network conditions can alter genuine and synthetic audio. Recent research on voice-authentication threats notes that anti-spoofing systems can struggle with previously unseen attack techniques, reinforcing the need for continuous evaluation and adaptation.

This makes synthetic voice telecom fraud a wider network-security problem rather than a problem that can be solved only through an audio classifier. Detection, caller verification and network-level intelligence increasingly need to operate together.

Voice Security is Becoming a Network Responsibility

Telecom voice security is increasingly moving beyond caller-ID protection toward a layered model that combines identity verification, signalling intelligence and analysis of the voice itself. Synthetic voice telecom fraud highlights the limits of relying on any single indicator, particularly when attackers can combine legitimate-looking numbers with AI-generated speech and social engineering.

Protecting voice services therefore requires cooperation between network operators, technology providers and the organisations receiving calls. Cryptographically verifiable caller identity, network-level monitoring and adaptive detection can provide complementary signals while maintaining appropriate controls over sensitive communications data.

Tele Info Today notes that the broader challenge is restoring trust in voice communications as synthetic audio becomes more accessible. As telecom networks strengthen caller verification and real-time detection, voice security is becoming an increasingly integrated part of the wider cybersecurity architecture supporting digital communications.

Telecom Networks are Becoming Sources of Fraud Signals

A financial institution can identify an unusual login or transaction, but it may not independently know whether a customer’s SIM was recently replaced or whether the mobile number is still associated with the device being used. Telecom operators can provide those signals because the network has direct visibility into subscriber and device relationships.

This creates an additional layer of risk intelligence. Number Verification can help confirm whether the mobile number being used by an application matches the number associated with the mobile connection. SIM Swap can indicate whether a recent SIM change has occurred, while Device Swap can identify a change in the relationship between a mobile number and physical device.

These capabilities do not determine that fraud has occurred. Instead, they give an external service another security signal that can be combined with transaction behaviour, account history and authentication data. Network API fraud prevention therefore works as part of a broader risk-assessment process rather than as an isolated fraud-detection tool.

Network APIs are Making Security Signals Accessible

The development is being supported by the GSMA Open Gateway and CAMARA ecosystems, which are creating standardised interfaces for exposing selected mobile-network capabilities to authorised applications. In March 2026, GSMA reported that its Open Gateway framework covered 86 operator groups and more than 300 networks, representing 80% of global mobile connections.

The scale of the ecosystem matters because fraud-prevention applications become more practical when they can access consistent network capabilities across multiple operators and markets. Standardised APIs can reduce the need for separate integrations while allowing operators to retain control over how network information is exposed.

For network API fraud prevention, this creates a new relationship between telecom cybersecurity and external digital services. Network security signals can move through controlled interfaces into fraud-management systems, where they can help determine whether an interaction requires additional verification or intervention.

Key Takeaway: The expanding global network-API ecosystem is creating a wider infrastructure through which trusted telecom security signals can support fraud prevention beyond the operator’s own network.

The upgraded cloud native 5G core is designed to deliver a planned capacity of 9 terabits per second, positioning it among Europe’s largest mobile packet cores. That level of throughput is critical for meeting the growing data demands driven by streaming, gaming, Fixed Wireless Access home broadband and other bandwidth-intensive services across VodafoneThree’s base of 28.6 million customers.

Deployed on Ericsson’s Cloud Native Infrastructure Solution, the new core provides a simplified, more resilient and automated network environment. By unifying 4G and 5G core functions on a single platform, the architecture reduces complexity while laying the groundwork for 5G Standalone capabilities and advanced services such as network slicing.

Differentiated Connectivity Through Network Slicing

The cloud native 5G core underpins VodafoneThree’s introduction of differentiated connectivity services, including the recently launched Vodafone SuperMobile. The service delivers up to four times faster speeds and a minimum download speed guarantee of 15 Mbps when customers are within 5G Standalone coverage.

Two dedicated network slices support these capabilities. The 5G+ FastTrack slice gives consumers access to a dedicated portion of the network, helping data move faster and more reliably during periods of high demand. The National Business Slice separates business traffic from consumer demand, enabling up to four times faster speeds and committed performance targets so that employees, applications and critical workflows remain connected and productive.

VodafoneThree’s network slicing strategy builds on the 5G+ Local Slicing service launched by Vodafone Business earlier in 2026. That offering delivers contracted performance at specific high-density sites such as entertainment venues, travel hubs and logistics facilities. Looking ahead, VodafoneThree plans to launch a National Critical Slice in 2027, designed to give blue-light organisations and critical public services priority connectivity and assured performance for mission-critical operations.

From Shared Infrastructure to a Dedicated Core

The upgraded cloud native 5G core represents the second major phase of VodafoneThree’s ambitious network transformation. Earlier in 2026, VodafoneThree completed a world-first network upgrade that unified core-level sharing through Multi-Operator Core Network technology with its existing Multi-Operator Radio Access Network across a multi-vendor 4G and 5G network. That step enabled Vodafone and Three customers to automatically connect to the best available coverage from either network at no extra cost. The current deployment advances that work from shared infrastructure to a single, dedicated and highly advanced Ericsson 5G Core.

The core network project was originally contracted by Three UK in January 2025 to support increasing data demand. It has since been seamlessly integrated into the wider VodafoneThree network strategy. Ericsson serves as VodafoneThree’s sole vendor for the nationwide core network and provides the significant majority of its radio access network, as part of the eight-year partnership announced in September 2025. The ongoing modernisation also includes deployment of Ericsson’s latest energy-efficient radio hardware and smart multi-band antennas across major population centres.

Hrvoje Jerkovic, Network Engineering Director at VodafoneThree, said: “The activation of our new cloud-native 5G core network is a major milestone in our journey to build the UK’s best network. Following the successful integration of our radio networks earlier this year, we are now taking the next step by creating a single, highly advanced core network that will underpin the future of connectivity for consumers and businesses across the UK. Together with Ericsson, we are building a network designed for the demands of tomorrow, delivering greater capacity, resilience and performance, while creating the foundation for innovations such as network slicing and new AI-powered services.”

The companies conducted the demonstration from September 16 to 18 in Helsinki, including a live trial at Vuosaari Harbor. The test used Integrated Sensing and Communication, or 5G ISAC, to monitor drone activity and build a broader view of the surrounding area through multiple network points.

The technology is being explored as a way to extend situational awareness in environments where small, low-altitude drones can be difficult to detect, particularly when they are not connected to a network or transmitting wireless signals.

5G Network Infrastructure Gains a Sensing Role

5G ISAC combines communications and sensing by using radio-signal reflections and cooperating mobile network base stations to identify, locate and track moving objects. During the Finnish demonstration, several network points gathered sensing information simultaneously, allowing the system to create a more complete picture of activity across the test area.

For authorities, the approach could provide earlier awareness of potential risks and support decisions on when and where to respond. Ericsson and Erillisverkot said the capability could be used around ports, airports, borders, critical infrastructure and major public events, while also complementing established sensing and counter-drone technologies.

The demonstration also highlights a broader change in the role of mobile infrastructure. Instead of being used only to provide connectivity, 5G network sites can potentially support distributed sensing functions that use existing communications infrastructure and telecommunications systems.

Ericsson said its 5G ISAC development combines its Massive MIMO 5G radio platform and beam steering with specialised edge computing, signal processing and sensing software. Artificial intelligence and machine learning can also be applied to enhance target detection and classification.

Finnish Authorities Explore Public Safety Applications

For Erillisverkot, the demonstration is focused on how mission-critical communications infrastructure can support wider security and preparedness requirements. The company works with Ericsson on Finland’s next-generation public safety network, Virve 2.0, providing an established foundation for their work together on secure and resilient communications.

The latest 5G ISAC test points toward potential applications in low-altitude airspace, where authorities increasingly require continuous awareness around sensitive locations. At Vuosaari Harbor, the companies were able to examine how network-based sensing could operate in a complex environment with multiple potential sources of activity.

The technology is still emerging. Ericsson positions 5G ISAC as part of the evolution toward 5G Advanced and future 6G networks, with early applications expected to focus on defence and public safety before wider commercial adoption develops alongside standards and the broader ecosystem.

The demonstration therefore represents a practical step in evaluating how existing mobile network infrastructure can support sensing alongside communications. Further development will determine how the technology can be integrated with existing sensors, command and control systems and operational requirements.

The solution is intended to give operators faster access to trusted and unified data, reducing the time required to prepare information for operational use. Nokia said the integrated approach can make high-quality data available in minutes rather than weeks, addressing a key challenge for telecom providers seeking to scale telecom network automation across their network operations.

Unified Data Infrastructure Supports Network Automation

Nokia Data Suite provides prebuilt and reusable telco data products with data quality controls and telecom-specific semantic modelling. Microsoft Fabric contributes a unified data platform with OneLake storage, analytics tools and AI-enabled applications.

By combining the two platforms, telecom operators can connect network data with enterprise, IT and third-party information in a broader environment. The architecture is designed for multi-vendor and cross-domain networks and can support hybrid, cloud and on-premises infrastructure.

The companies said the approach can support use cases such as automated root-cause analysis and closed-loop operations. It also aims to reduce the data integration work traditionally required before AI applications can be introduced into network environments, supporting broader telecom network automation strategies.

The flexibility of the platform is intended to support operators that need to maintain regulatory requirements while expanding their use of AI and automation. Nokia and Microsoft are positioning the unified data foundation as an infrastructure layer for building agent-based solutions across different parts of the telecom network.

AI Use Cases Extend Across Telecom Network Operations

Initial use cases include autonomous Voice over New Radio, or VoNR, assurance, geo-experience and predictive maintenance and fault management. The VoNR capability is designed to identify service anomalies, conduct root-cause analysis and recommend actions using network, service and subscriber visibility.

The geo-experience capability combines subscriber, network and radio frequency data to map sessions to precise locations, identify degraded radio performance and locate coverage or capacity hotspots. AI agents can then analyse potential causes of radio access network issues and provide recommendations for corrective action across standard and network-sliced 4G and 5G services.

Predictive maintenance and fault management use historical and real-time data to identify potential network issues before they affect customers. These capabilities can contribute to telecom network automation by helping operational systems analyse conditions and support workflows with less manual intervention.

The collaboration also includes AI-driven operational assistants that provide network engineers with contextual insights, recommended actions and automated workflow execution. This approach is intended to support higher levels of telecom network automation while retaining human oversight within defined governance boundaries.

The solution is available now, with Nokia and Microsoft continuing to expand autonomous network use cases and customer deployments. The companies said the operating model is designed to allow AI systems to take on increasingly complex network responsibilities while maintaining human oversight.

The South Korean operator proposed “AI Agent Approval over RCS” as a formal standards agenda item within the GSMA RCS group, the consultative body where global carriers, device makers, platform companies and business messaging operators collaborate on technical specifications for Rich Communication Services. The proposal was tabled during a face-to-face standards meeting hosted by SK Telecom at its Seoul headquarters from September 15 to 18, 2026. Representatives from 16 companies attended, including AT&T, T-Mobile, Vodafone, Orange, Apple, Google, Samsung Electronics and officials from the GSMA Secretariat, with 33 working-level participants in total.

A Verified Approval Channel Built on the RCS Standard

At the heart of SK Telecom’s proposal is the idea that RCS messaging can serve as a dedicated approval channel whenever an AI agent needs a user’s consent before completing a transaction. Today, if the verification step happens entirely inside an AI service, it can be vulnerable to malfunctions or external manipulation. There is also the practical problem that approval methods differ from one AI agent to another, making it difficult for users to judge whether a given request is legitimate.

Under the proposed RCS standard framework, only pre-registered and verified corporations would be able to display their name and logo within the approval message. This means a user would see clear, authenticated branding before deciding whether to proceed. The message itself could include a product image alongside an approval control, allowing the user to review order details and the payment amount and then authorize execution without leaving the default messaging application. Because the approval request and the user’s response remain stored in the smartphone’s conversation list, there is a built-in record that can be reviewed at any time.

Consider a practical scenario: an AI agent arranges a product purchase on a user’s behalf. Before the payment is finalized, the user receives an RCS message showing the item, the price and the name of the verified seller. The user taps to approve, and the AI agent completes the transaction. Convenience is preserved, yet the user retains direct judgment at the decisive moment.

The significance of establishing a shared RCS standard for AI agent approvals extends well beyond a single operator. As AI agents begin performing more actions across different platforms, carriers and geographies, inconsistent verification methods could erode user trust and fragment the experience. A common RCS standard would offer interoperability, ensuring that the same approval mechanism works regardless of the carrier, device or AI service involved.

Yoo Kyung-sang, head of SKT AI CIC, said, “The more AI can do on behalf of users, the more important the touchpoint becomes where users directly check critical information and make the final decision.” He added that SK Telecom will work with global partners to make standards discussions more concrete so messaging can evolve into a trust-based channel connecting AI agents and users.

It is important to note that the proposal is currently under discussion as an agenda item within the GSMA RCS group. It has not been adopted as a finalized global standard, and broader deployment of AI agent transaction verification over RCS remains a future prospect rather than present reality.

The forum was originally established to build an open and resilient 6G ecosystem focused on developing foundational technologies, trialing emerging use cases, exploring new spectrum bands and ensuring alignment with global standards bodies such as 3GPP. With the addition of these nine organizations, the group gains deeper multi-disciplinary expertise that is expected to strengthen work across AI integration, cloud services, network security and independent test emulation, all of which are critical to shaping an AI-native network architecture from the ground up.

Yago Tenorio, Chief Technology Officer and Senior Vice President of Technology Development at Verizon, said, “By expanding our Innovation Forum and refining live edge-AI trials today, we are ensuring the AI-native 6G network is built from day one to scale 5G Advanced capabilities and translate these next-generation technologies into meaningful, real-world experiences for our customers.”

Successful ISAC Trials Demonstrate Practical 6G Capabilities

To move beyond theoretical research, Verizon highlighted recent field trials with founding members Samsung and Qualcomm centered on Integrated Sensing and Communication, commonly known as ISAC. This technology enables cellular networks to function as distributed, radar-like sensors without requiring physical cameras, integrating communication and sensing within the same infrastructure.

In a trial conducted with Samsung during a major international soccer celebration in Dallas, Texas, the companies demonstrated AI-powered crowd-density detection using a virtualized Radio Access Network, a single 5G base station and CBRS spectrum. Samsung’s AI RAN and edge AI platform analyzed ambient wireless signal variations from smartphones to produce real-time crowd-density heatmaps, showcasing how network-native sensing could support large-scale event management. This marked the first such ISAC trials demonstration on a virtualized RAN for crowd detection.

A separate trial with Qualcomm at its San Diego campus focused on drone and vehicle tracking. Using millimeter-wave spectrum and four synchronized transmission and reception points, the system mapped the position and velocity of an airborne target and ground vehicles while simultaneously maintaining high-speed 5G Standalone communications with a phone user on the ground. The results underscored how next-generation wireless networks could provide foundational tracking infrastructure for autonomous drone safety and similar applications. These ISAC trials represent tangible progress toward capabilities that are expected to mature further with 6G.

Expanded 6G Ecosystem Sets the Stage for Future Deployment

Looking ahead, the members of the 6G Innovation Forum plan to continue sharing findings from demonstrations inx`volving digital twins, robotics, AI and advanced wearables. Verizon has identified the 2028 Summer Olympics in Los Angeles as an interim proving ground on the path toward commercial 6G deployment, with a dedicated 6G Lab already established in the host city to stress-test capacity demands and early use cases of the AI-native network era. The expanded 6G ecosystem positions the broader industry to collaboratively address the technical and operational challenges that lie ahead.

This is creating a broader role for AI voice agents in telecom customer service. Instead of simply identifying an intent and directing the caller toward another process, an agent can potentially understand the request, retrieve relevant information, use connected tools and continue through an authorised workflow. The important change is therefore not only more natural speech, but the ability to connect spoken interaction with service execution.

From Scripted IVR to Conversational Voice Support

Traditional IVR remains useful for predictable requests at scale, but its menu-based structure can create friction when a customer’s issue does not fit neatly into predefined options. Natural-language voice systems offer a different interaction model by allowing customers to describe a problem in their own words.

This is where AI voice agents can provide a more capable interface. A customer could explain that a recent bill appears higher than expected, report a connectivity problem or ask about an existing order without navigating through several layers of options. The system can interpret the request and determine which information, tools or workflows are relevant.

The development is also moving beyond speech recognition itself. A capable voice agent needs to combine voice interaction with access to business systems, defined procedures and operational tools. TM Forum’s 2026 Contact Center Voice Agent Implementation Guide identifies four capability areas: voice interaction, task completion, tool-calling and SOP compliance.

Voice Agents are Moving Toward Task Completion

The distinction between a voice bot and an agent becomes clearer when the system is expected to complete work rather than simply provide an answer. A billing interaction, for example, could involve checking the customer’s account, reviewing the relevant charge, explaining the result and initiating an approved follow-up action.

The same principle can apply to technical support. A caller reporting a connectivity problem may require checks against service status, account information and previous troubleshooting steps before the issue can be resolved. A connected voice agent can potentially coordinate those checks within the same conversation rather than transferring the customer between separate processes.

AI voice agents therefore represent an evolution in how telecom operators can use voice as a customer-service interface. The objective is not simply to make automated calls sound more natural. It is to connect spoken interaction with the data, tools and workflows required to deliver a useful outcome.

Key Takeaway: Telecom voice agents are being defined around more than conversational speech, with task completion, tool access and procedure compliance becoming core capabilities.