ApkiAwaz Try the demo

Research demo · Hindi phone banking

It sounded like the customer. It was a clone.

The clone passed two checks. The third caught it.

Try the demo See the results
Example call · Sahayak Bank (fictional) · G.711
Bank challenge 4 7 2 9 0 3 four seven two nine zero three
AI voice answers Repeats the digits in a generated voice
  1. DigitsMatched
  2. Voice matchPassed
  3. AI voiceCaught
DecisionVerify another way
Test illustration, not a real call. 30 speakers; simulated phone lines; thresholds set before testing.
1Finding

Random digits don't stop a clone.

A fresh digit challenge can stop old recordings. It didn’t stop this clone: it repeated the new digits and passed the voice match. The synthetic-speech check caught it.

Clones accepted by voice match alone
94.8%
903 of 953
Clones through all checks
0/953
95% upper bound 0.4%
A cloner the model never saw (XTTS)
1/953
held-out engine
Test conditions
Opened once, 4 Nov 2026
30 held-out speakers, public Hindi datasets
Simulated G.711 phone line
Thresholds frozen on separate data first
Our own verifier only, not Gnani Biometrics or any bank
2The checks

Three checks on the same phone audio.

Every check gets the same 8 kHz phone audio. We check the recording quality first; then all three checks must pass.

Fig. 2Caller's answerone recording, 8 kHz
  1. A

    Spoken digits

    Gnani Prisma

    Transcribes the answer and compares it with the fresh challenge.

    Stops
    Replaying an old recording.
    Misses
    A clone that says the new digits.
  2. B

    Voice match

    ECAPA speaker embedding

    Compares the voice with the customer's enrolled voiceprint.

    Stops
    A stranger.
    Misses
    A clone (903 of 953 passed), and about 1 in 5 same-gender impostors.
  3. C

    AI voice check

    Our model, trained on 8 kHz Hindi phone audio

    Looks for signs the voice was generated by software.

    Stops
    The clones we tested.
    Misses
    A real person. On unfamiliar lines it also flags genuine callers.
All pass: allow. Any fails: step up to another way to verify.

A failed call hears one neutral line. The caller is never told which check failed, so an attacker learns nothing to tune against. The three checks share one audio channel: they're layered evidence, not independent factors.

3Demo

Run a call yourself.

Pick a call to see what each check decided. Clone calls are labelled. These are replays; live microphone checks run only on this machine.

Sahayak Bank fictional bank
Bank asks for

Call check results

this call
  1. Spoken digits matchWaiting
  2. Voice matches customerWaiting
  3. Live human voiceWaiting
Waiting for a call 

        

      

    

  







  
4Results

  

    
How it did, including where it struggled.

    
We ran the final test once, on 4 Nov. We set the thresholds using separate data first. The test used 30 speakers kept out of training, new clone models and phone lines the model hadn’t seen.


    

      
Fig. 3 Catch and cost, by phone line

      
      
    
        
  • G.711 μ-law trained on37/803 · 4.6%0/953
    • 
        
  • AMR-NB 12.2k trained on74/803 · 9.2%0/953
    • 
        
  • G.711 A-law unseen37/803 · 4.6%1/953
    • 
        
  • GSM-FR unseen73/803 · 9.1%5/953
    • 
        
  • AMR-NB 4.75k unseen bitrate331/803 · 41.2%0/953
    • 
      

      
Bars span 0–50%. We used the same frozen thresholds for every line: 30 speakers, 803 real calls and 953 clone attempts per line. On the unfamiliar low-bitrate line, about 2 in 5 real callers had to verify another way.

    


    

      

        Table 1 Other attackers, G.711 phone line
        
GateAI clones let throughReal callers stepped up

        
          
Voice match only903/953 (94.8%)28/803 (3.5%)

          
All checks, Gnani clones0/953 (under 0.4%)37/803 (4.6%)

          
All checks, unseen cloner (XTTS)1/953 (0.1%)37/803 (4.6%)

          
All checks, unseen engine family (FreeVC)6/600 (1.0%)19/600 (3.2%)

        
      

    

    
"Under 0.4%" is the 95% upper bound for 0 of 953. The hardest attack: FreeVC through a GSM line, 18 of 600 (3%) got through. The full tables, with speaker-level bootstrap intervals and every codec, are in our results package.

  







  
5Limits

  

    
Where this test stops.

    

      

        
What we found

        
    
          
  • A new voice cloner could still get through.
    • 
          
  • About 1 in 5 same-gender impostors passed the voice match in our test.
    • 
          
  • We simulated the phone line; we didn’t call through a carrier.
    • 
          
  • We tested read Hindi speech from public datasets, not real bank calls.
    • 
          
  • We tested our own verifier, not Gnani Biometrics or any bank.
    • 
          
  • Banks should pair voice checks with another way to verify.
    • 
        

      

      

        
What an attacker could do

        

          
They have
The customer's ID, 5–30 seconds of clean speech, and a voice-cloning service.

          
They can
Hear the challenge, make a spoken answer, then send it into the phone line.

          
We assume
The customer's original enrollment and our server are secure.

          
We didn’t test
Human relays, skilled impersonation, edited fake audio, over-the-air replay, or every future voice cloner.

        

      

      

        
Voice data

        
    
          
  • Real speech came from AI4Bharat’s Kathbath and IndicVoices datasets (CC BY 4.0).
    • 
          
  • Clones of dataset speakers stay private and will be deleted on 15 Nov 2026.
    • 
          
  • The voices used for demo clones belong to the project team.
    • 
          
  • Every clip made by a cloner carries an "AI-generated" label.
    •