Did you know that Voice Channel is becoming one of the softest targets in the enterprise market?
The FBI’s IC3 Internet Crime Complaint Center received 859,532 complaints and reported losses exceeding $16 billion in 2024.
A portion of those frauds operates through phone channels. When it does, callers typically encounter either an IVR (Interactive Voice Response) or an IVA (Intelligent Voice Assistant).
These two systems can be exploited for fraud in different ways, and understanding that difference is key to knowing which defenses will actually be effective.
We looked into publicly available incidents of voice fraud and CVE reports and found cases related to IVAs and IVRs. All cases we discuss are publicly available.
Key Takeaways
- The important difference between these two lies in their failure modes: IVA is vulnerable to prompt injection, whereas IVR is vulnerable to signal manipulation. One represents an AI challenge and the other a telephony issue, meaning that a solution for one doesn’t address the other.
- Caller ID spoofing is the only high-risk factor present in both systems.
- Voice biometrics alone can’t provide you sufficient protection. These voice IDs can be tricked by attackers using voice cloning.
- Three effective defenses are the voice synthesis detection, behavioral analysis for the IVA, and procedural manual review for high-value transactions.
What IVA and IVR Are (And Why Fraudsters Target Them)
IVR (Interactive Voice Response) is a system that guides callers through a set of menu options using key presses or basic voice commands.
On the other hand, an IVA (Intelligent Voice Assistant) uses AI to understand the language of the caller and grasp the intent. It may even use internal systems to execute a request.
Fraudsters target both types of systems for the same reason: they serve as the first authentication layer without human supervision, are available 24/7, and are primed to assist whoever calls.
Never Worry About AI Fraud Again. TruthScan Can Help You:
- Detect AI generated images, text, voice, and video.
- Avoid major AI driven fraud.
- Protect your most sensitive enterprise assets.
IVA Vulnerabilities: AI-Powered Systems, New Attack Surface
My primary concern with IVA systems is not rooted in complexity but in prompt injection, which OWASP ranks as LLM01: 2025 at the top of its LLM Top 10 list.
Voice cloning is another pressing concern, and there is enough evidence to support this. For example, a reporter from Vice managed to clone his own voice on ElevenLabs’ free tier, successfully navigating Lloyds Bank’s Voice ID to access account balances and transaction screens.
Similarly, a Guardian Australia journalist required about four minutes of audio and a customer reference number to access his Centrelink account.
The same tactics are employed in the enterprise wire transfer fraud, with even more financial risks described in our report on AI-related fraud in financial services, in which consumer account exploits are conducted for very low amounts of money.
Another common concern is model manipulation, which becomes significant as your IVA can process financial transactions.
IVR Vulnerabilities: Signal Exploitation and Social Engineering
Despite being an older technology, IVR isn’t inherently safe.
Criminal OTP bots like SMSRanger, Brainshot, OTP BOT, Apollo, and SMS Buster sabotage IVR systems by automating caller ID spoofing and simulating a trustworthy bank recording that asks victims to input their one-time passcodes.
Attackers often use keypress simulation and DTMF spoofing to learn how an IVR system works before attempting a more serious attack.
Another concern is the IVR platform itself, which attackers are targeting. A number of popular PBX and IVR systems, such as FreePBX had several serious weaknesses which were exploited in 2025. (CVE-2025-57819, CVE-2025-66039, CVE-2025-61675)
Once the phone system is compromised, the attacker can be able to listen in on calls, reroute calls, or be able to access sensitive information before any voice authentication has been carried out.
Fraud Attack Patterns: IVA vs IVR Comparison Matrix
The following matrix shows ten different attack patterns for both systems, as seen in reported attacks.
| Fraud type | IVA: risk and best detection | IVR: risk and best detection |
| Voice cloning | High. Voice synthesis detection + confidence scoring. Blind spot: compressed telephony audio hides the artifacts | Medium. The same detection applies, but most IVRs never enrol a voiceprint. Blind spot: No voice layer analysis, so the clone simply reaches an agent instead. |
| Prompt injection | High. Input and output filtering, instruction isolation, strict tool permissions. Blind spot: spoken injections are hard to log and review. | Not applicable. There is no language model to inject into. |
| Model poisoning | Medium. Training data origin + model integrity reviews. Blind spot: It may only surface after deployment. | Not applicable. No model, no training data, nothing to poison. |
| Signal manipulation | Low. An IVA rarely detects raw tones, so there is little signal surface to attack. | High. Signal integrity + audio quality monitoring at the telephony layer. Blind spot: needs carrier-level visibility |
| DTMF spoofing | Low. Not a meaningful path into a conversational system. | High. Key press timing analysis + rate limiting per caller ID. Blind spot: legitimate autodialers and accessibility tools |
| Key press simulation | Medium. Behavioral anomaly detection on navigation speed and intent patterns. | High. Cross-call behavioral analysisBlind spot: any single call looks harmless at first |
| Caller ID spoofing | High. Metadata + carrier-level origination checks Blind spot: caller ID can be forged | High. Identical exposure + OTP bots + automated caller ID spoofing at scale. Blind spot: the same forgery |
| Behavioral fraud | Medium. Intent + account-history anomaly detection. | High. Cross-call + account detection. Blind spot: most contact centers never link calls across days |
| Social engineering | Medium. Constrain what the IVA can do without a second factor. | High. Agent-side controls + step-up verification. Blind spot: the IVR validates the account before a human agent approves the change. |
| Platform exploitation (CVE) | Medium. Dependency + model supply chain monitoring. | High. Patch monitoring |
Two important observations arise.
Caller ID spoofing is the only high-risk factor present in both cases, and the systems should consider it a reliable credential.
That’s not all, the major vulnerability in IVA is the immediate threat of prompt injection, which is not the case in IVR. On the other hand, a major vulnerability in IVR is the threat of reconnaissance, which may manifest days after the initial engaging call.
Detection Strategies: How to Catch Voice Fraud in IVA and IVR Systems
For IVA: Voice Synthesis Detection + Behavioral Analysis
Voice Synthesis Detection identifies the artifacts that are generated by the AI models. In contrast, Behavioral Analysis identifies any abnormalities beyond audio, such as the caller being able to navigate too easily, impacting the account probes, or doing something that doesn’t match their account history.
The reason failed attempts at Lloyds and Centrelink were successful was that they used only a single biometric score. It must always be simple; the voiceprint can just start the discussion, but not to validate a transaction through the call alone.
To learn more about assessing deepfake technology on our deepfake detection software blog.
For IVR: Signal Integrity + Rate Limiting
Signal integrity monitoring assesses DTMF timing + audio characteristics by comparing them with what a human could generate. On the other hand, rate limiting on caller ID and account would prevent the attack cycle, as the attacker needs a sequence of low-cost calls to do that.
We know these aren’t foolproof when attackers can easily change spoofed numbers, but together, they make it more expensive logistically to map out IVR fraud.
For Both: Add Manual Review for High-Value Transactions
None of the detection systems is perfect on its own, and documented failures have occurred in both.
Therefore, you need manual reviews, such as callbacks to phone numbers on file, an additional approval process, and a clear statement that simply identifying a person’s voice will not be enough for authorization.
Arup lost HK$200 million (around US$25.6 million) across 15 transactions to five accounts. In comparison, a Hong Kong branch manager authorized $35 million after the scammers used AI-generated videos and voice clones of the CFO and other staff during a live call.
This same pattern emerged in AI-driven business email compromise, where familiarity becomes the basis for exploitation.
Best Practices: Voice Fraud Defense Roadmap
- Audit your IVA and IVR systems for vulnerabilities. CVE-2025-57819 alone was exploitable, so test your IVA with prompt injections, and evaluate your IVR for the information an unauthenticated caller can extract before verification
- Try implementing voice synthesis detection, especially if you use biometric methods, because voiceprint alone can’t be trusted.
- Work with behavioral anomaly detection (call patterns, route questions, call lengths, etc.), analyzing multiple calls per day rather than single calls.
- For sensitive transactions, use multi-factor verification so that caller ID is not used as a verification factor. The FCC has fined a voice service provider $1 million for failures related to voice robocalls that passed through its network with spoofed caller IDs.
- Record and follow up on all failed login attempts. These failures provide a reconnaissance map and give you the very first alerts on fraud attempts.
Frequently Asked Questions
What does IVA stand for, and how is it different from IVR?
IVR is an older menu-driven system with key inputs, and IVA is an AI system that can act on the caller’s intent. IVA is vulnerable to AI attacks such as prompt injection, while IVR is vulnerable to phishing attacks such as DTMF manipulation and caller ID spoofing.
Can voice cloning bypass IVA biometric systems?
Yes, and here are the examples. A reporter for Vice accessed Lloyds Bank Voice ID with a free ElevenLabs clone, and a Guardian journalist logged into Centrelink with some four minutes of audio and a customer reference number.
How do fraudsters exploit IVR systems?
They’d weaponize IVR by using OTP bots to spoof the caller ID and play a file that sounds like a bank to collect the OTP. They can also exploit IVR by making repeated automated calls to confirm users’ identities, leading to a full takeover.
What’s the best way to detect voice cloning in call centers?
The best advice is to use a multi-signal approach. Add voice synthesis detection for generation artifacts, behavioral analysis of the caller to understand how he/she performs, and metadata checks to confirm that the origination aligns with the story.
Should we replace IVR systems with IVA to reduce fraud?
This won’t solve the problem. It only shifts the telephone attack, as both are vulnerable to fraud.
The best approach would be to choose the system that best fits your business needs and integrate a security measure such as caller verification, a fraud detection tool, or continuous monitoring.
How do we test if our IVA/IVR is vulnerable to voice fraud?
You can start with an attack that you know would work.
Try to perform a prompt injection on the IVA, a voice clone on your own biometric enrolment, and conduct a reconnaissance test to see how much information an unauthenticated caller can get from the IVR. Then see if your logs captured what was happening.
Final Thoughts
IVA and IVR each have their own shortcomings, but the cases examined show that attackers have exploited vulnerabilities in both systems.
The common factor in each of these incidents is the same: a voiceprint, caller ID, or a familiar voice used as an overreliance on a verification mechanism.
That’s the core lesson for any enterprise call center security and fraud prevention roadmap. So build your defence around that knowledge and correlate it with what your call logs already know.
If you are thinking about ways to identify synthetic voices or deepfakes in your own channels, you can start by using the TruthScan’s deepfake detector.