Ten seconds of audio is enough to clone you — treat voice as a dead credential, not a detection problem

Ten seconds. That is the sample ElevenLabs needs to replicate a person's voice, according to a report by El Destape citing WIRED. The system does not merely copy timbre from a short clip: it holds vocal identity stable across long passages and lets producers dial expressivity with tags ranging from calm to enthusiastic. Language coverage has gone from 70 to more than 90 — meaningful, because synthetic speech outside English used to sound obviously artificial.

The intended market is industrial and mostly benign: dubbing, accessibility, content production, audiobooks, corporate training and advertising. It has also become a core component of conversational agents and phone support centres, where low-latency synthetic speech can handle a call without the caller noticing. None of that is a scandal. Dubbing a documentary into 90 languages, or giving speech back to someone who has lost theirs, is the kind of quiet, unglamorous abundance we think this technology genuinely delivers.

The problem is that the capability does not come in two versions. Ten seconds is a forwarded WhatsApp voice note, a clip from a public video, a hold message, a conference Q&A. The report flags the obvious downstream uses — phone scams, identity impersonation, audio deepfakes increasingly hard to tell from a real recording — and puts its finger on the structural issue: the technology is moving faster than the consent and verification mechanisms that should accompany it. That gap, not the synthesis itself, is the story.

Our read, and it is a practical one: voice is now a deprecated credential. It should be treated the way security teams came to treat SMS one-time codes — a convenience, never a proof. The fix is procedural, not technical. Agree a code word with family. Hang up and call back on a number you already have. Confirm any money request through a second channel. Banks and companies that still use voice biometrics as an authentication factor should be retiring them, and the burden belongs on those institutions, not on a 78-year-old who answered the phone and heard a grandchild. Betting on detection is an arms race that the detectors lose by construction; betting on verification protocols is a fight you can actually win, because it does not depend on the audio being distinguishable.

This fits a pattern we keep returning to. The near-term AI risk that will hurt most people is not distant superintelligence — it is the industrialisation of ordinary fraud, where capabilities built for dubbing studios become a scam call centre's cost reduction. That is a transition cost, and transition costs land hardest on whoever has the least protection. It is also a solvable one: the countermeasures are social protocols, consent infrastructure and provenance standards, all of which can be built now. The same technology that makes a scam call convincing is the one that puts audiobooks, education and accessible interfaces into 90 languages. We should want the second thing badly enough to pay for the guardrails on the first.