AI-powered phone scam tools sold cheaply on dark web, researchers warn

Cheap, off-the-shelf AI tools used for phone scams are being sold openly on the dark web, new cybersecurity research warns.

For as little as US$30 (about C$42) per week, scammers can rent a robotic phone scammer designed to steal one-time passcodes used to protect bank accounts, according to data from NordVPN.

The tools are advertised for various frauds, including voice phishing, bank impersonation, CEO wire fraud and grandparent emergency scams.

READ MORE: Snack names with 'oh' sounds perceived as more filling than those with 'ee' sounds, study finds

READ MORE: Canadian MPs divided over AI use in House of Commons as study reveals widespread adoption

"Posts advertising voice-cloning services, tools, and pricing rose 82% in 2025, then a further 75% in the first seven months of 2026 alone," the company said.

Adrianus Warmenhoven, a cybersecurity advisor at NordVPN, said one tool being sold is an IVR Voice Clone System, which clones the automated menu customers hear when they call their bank.

Scammers use it to call customers and trick them into sharing card numbers, PINs and CVV codes.

Another tool, called Gorilla Call Bot, costs $200 per 1,000 calls and comes with a customizable script, Warmenhoven said.

"They pair with spoofing dialers, which control what shows up on your screen. (It is used to show) your bank’s real number, or a local Ontario area code so it does not look foreign," he said.

Bots designed to steal one-time passcodes are also advertised.

These bots call customers while a criminal is already logging into their account, Warmenhoven explained.

Scammers who have already obtained a target's login credentials use the bot to steal verification codes by pretending to be a fraud team.

NordVPN's data shows scammers can use such bots for about $30 per week.

Warmenhoven also described a product called DOOM AI Call Center, sold as voice agents with humanlike speech and custom voice clones that can hold a conversation.

There is even an all-in-one phishing panel that bundles fake login pages, an auto-dialer and an AI call assistant.

"A complete starter kit for someone with no skills at all," he added.

Some tools, like the Berry AI Voice Clone, are sold as standalone software for $400 to $500.

"It does one thing, produces a cloned voice, and the buyer decides what to do with it," Warmenhoven said.

However, he added that most voice cloning tools advertised on the dark web are not criminal software but stolen access to ordinary commercial products, resold cheaper.

AI and cybersecurity expert Abbas Yazdinejad, an assistant professor at the University of Regina, said preventing voice cloning is very difficult.

"One of the biggest challenges with AI voice cloning is that even a relatively short, clear recording of someone’s voice can potentially be used to create convincing synthetic speech," he said.

Preventing cloning is particularly hard for people whose voices are publicly available online.

Yazdinejad said a convincing voice should no longer be treated as proof of identity.

"The important change in the AI era is that we can no longer assume, ‘I recognize the voice, therefore I know who is speaking,’" he said.