Two ways to fake a voice
Voice spoofing — sometimes called a presentation attack — comes in two main forms. In a replay attack, the attacker plays a genuine recording of the target into the microphone or phone line. In a synthetic attack, the attacker generates new speech: text-to-speech in the target’s cloned voice, or voice conversion that reshapes the attacker’s own speech.
Both end with a voice that sounds like the right person. They differ in what the attacker can say and in the evidence they leave in the audio.
Replay attacks
A replay uses real audio, so the voiceprint genuinely matches. That makes replays dangerous for systems that rely on speaker verification alone. The limitation for the attacker is content: they can only play what the person actually said, which is why replay attacks favour short, predictable phrases — “yes”, a passphrase, a name.
Replays leave physical traces. The audio has passed through a loudspeaker and back into a microphone, adding channel and room characteristics that a live voice does not have. Detecting them is part of liveness detection.
Synthetic attacks
Synthetic speech can say anything, which makes it far more flexible for conversational attacks on AI voice agents. Quality improves with every new generation of voice models, so a detector trained once and left alone degrades quickly.
Generated audio carries different artefacts from its synthesis process. Detecting them reliably — including on engines the detector has never seen — requires continuous retraining against new open-source and commercial models.
Side by side
| Replay attack | Synthetic attack | |
|---|---|---|
| Source audio | Real recording of the target | Generated by TTS or voice conversion |
| Can say anything? | No — only what was recorded | Yes |
| Passes voiceprint match? | Often, because it is the real voice | Sometimes, depending on clone quality |
| Main traces | Loudspeaker, room and re-recording artefacts | Generation artefacts |
| Detector | Replay / liveness | Synthetic-speech detection |
Why you need both — and speaker verification
Each detector covers the other’s blind spot. A replay detector does not tell you whether speech is synthetic; a synthetic-speech detector may pass a clean recording of a real person. And neither tells you who is speaking. That is why Vosco returns synthetic, replay and speaker signals in the same call and combines them into a single trust score.
In our benchmarks, Vosco Precise reaches 3.1% synthesis error and 2.0% replay error with 99.3% speaker accuracy; the on-device Vosco Nano reaches 4.6% and 4.5% with 98.4% speaker accuracy at 7M parameters.
Frequently asked questions
What is a replay attack in voice security?
A replay attack plays a genuine recording of the target’s voice into a microphone or phone line to impersonate them. Because the voice is real, it can pass voiceprint matching unless replay detection is used.
Is a deepfake voice the same as a replay?
No. A deepfake or synthetic voice is newly generated speech, while a replay is a recording of something the person actually said. They leave different artefacts and need different detectors.
Does speaker verification stop replay attacks?
Not on its own. Speaker verification confirms whose voice it is; replay and liveness detection confirm the person is speaking live rather than through a recording.
Verify the voice before your AI acts.
Start on the Vosco API with 1,000 minutes free every month, or talk to us about on-device deployment.