In late July, a Forbes Business Council piece by Sebastian Dobrincu made the rounds under a provocative claim: voice authentication is fundamentally broken, and most companies haven’t noticed. The author, who co-founded a voice AI company himself, calls it the “voiceprint fallacy”: the idea that your voice is a unique, unforgeable credential, when in reality it’s the one piece of your identity you broadcast constantly, on podcasts, earnings calls, and voicemail greetings. In his words, “A fingerprint at least stays on your hand. A voice is a credential you publish.”

It’s a sharp piece, and parts of it are simply correct. We think the conclusion is wrong, and one of his own examples proves it.

Where He’s Right

The bank failures he cites happened, and they were embarrassing. In 2023, a journalist cloned his own voice and broke into his own Lloyds account using the bank’s voice login. In 2024, a BBC reporter did the same to Santander and Halifax. When confronted, each bank gave a version of the same answer: voice ID is only one layer. He’s right that this concedes the point. A single, static voice check, used as the only gate, was never a strong credential. That’s not a controversial claim. It’s the argument we’ve been making ourselves: a check performed once, at a predictable moment, is a narrow target that a well-resourced attacker can plan around.

He’s also right that human judgment isn’t a reliable defense. He cites a University College London study finding that people, even after training, correctly identify synthetic voice only about 73% of the time. Your ear is not evidence. That’s a fair, well-supported claim, and it matters more every quarter as generative voice models improve.

Where the Argument Breaks

His central piece of supporting evidence is the Arup case: the roughly $25 million fraud where an employee in Hong Kong joined a video call in which every other participant was a synthetic deepfake of a real executive. It’s a genuinely alarming case, and he’s right to take it seriously. But look at what the public accounts of that case describe. The employee was fooled by people who “sounded right.” Nothing in those accounts suggests any deepfake detection was running on that call. The fraud succeeded without the technology he’s arguing is “the wrong fix” ever being in the room.

That’s not a case study in detection failing. It’s a case study in what happens without it. Citing Arup as evidence against deepfake detection is a little like citing a house fire as evidence against smoke detectors, when nothing suggests the house had one installed.

The same misstep runs through his “arms race” argument. He calls detection a losing proposition because every improvement in catching synthetic audio trains the next generation of synthetic audio to evade it. That’s true, and it’s true of literally every security control that has ever existed. Passwords, EMV chips, multi-factor authentication, fraud-scoring models: all of them are arms races. None of that is an argument for abandoning the layer. It’s an argument for continuous investment in it, which is a very different conclusion.

And the market is behaving accordingly. Industry projections reported by Biometric Update put combined face and voice deepfake-detection revenue at roughly $3 billion this year, doubling to about $6 billion by 2028, with voice-deepfake checks alone nearly doubling over the same stretch. A survey by Pindrop, itself a voice-security vendor, found that 74% of the 250 U.S. security leaders it polled had encountered or suspected a deepfake attack, while only 10% had purpose-built defenses in place. Vendor surveys deserve some skepticism, but the direction is hard to read as an industry quietly giving up on an unwinnable fight. It looks like one mobilizing capital because the fight is worth having.

His Fixes Aren’t Competing With Detection. They’re the Same Idea.

Here’s what’s strange about the piece: his prescribed solution (callbacks to a number already on file, a shared verification phrase agreed offline, a second approver on large transfers) isn’t actually opposed to voice authentication and deepfake detection. It’s the same underlying philosophy, applied to a different set of channels. He’s arguing, correctly, that no single check should be trusted on its own. We agree completely. We just don’t think the conclusion is “therefore stop using voice.” We think it’s “therefore stop using any one thing alone”: voice included, but also callbacks, also shared secrets, also a second signature, none of which are immune to social engineering either. A callback number can be changed by a convincing enough phone call. A shared verification word can be phished the same way a password can. Every control on his list degrades under enough pressure from a motivated attacker. That’s not a reason to discard any of them. It’s a reason to combine them.

This is exactly why we’ve moved away from treating voice authentication as a single event. A voiceprint match tells you the pattern is consistent with the person on file. Continuous, real-time deepfake detection tells you, separately, that the audio producing that match is actually human, not a synthetic clone maintaining the pattern well enough to pass. Layer in a callback to a known number, a second approver above a certain dollar threshold, and a few additional signals like audio quality anomalies or unusual acoustic characteristics, and you have something meaningfully harder to defeat than any single layer, voice or otherwise. (We go deeper on how this works in practice in our piece on continuous authentication and deepfake detection.)

The Platforms Are Adding Voice, Not Dropping It

Since the piece ran, one of the largest platforms in the world has made a move that cuts against its premise. At Made on YouTube on September 23, YouTube said that, as part of its likeness-protection tools for creators, it will “start integrating speaking voice detection with facial detection to improve overall match accuracy and help better safeguard your likeness.” The capability is described as coming later this year, and today the tool matches faces only. But the direction is the point. YouTube has no stake in defending voice authentication as a product category, and it isn’t treating voice as a liability to be designed around. It is adding voice as one more signal, alongside facial matching, to make its overall detection harder to fool. That is the same conclusion this piece has been arguing for: not voice instead of other signals, and not other signals instead of voice. Both, together.

The Real Fallacy

The “voiceprint fallacy,” as described, is really a special case of a much older and more general mistake: trusting any single factor because it feels definitive. Voice felt definitive because it’s personal and hard to fake with older technology. It no longer is. But the fix isn’t to find a new single factor that feels definitive today and repeat the mistake in five years, once cloning callback numbers or synthesizing a “trusted” second approver’s video call becomes the next commodity attack. The fix is to stop looking for a single factor at all (voice, callback, shared secret, or otherwise) and build systems that verify continuously, across multiple independent signals, for the full duration of anything that matters.

Arup didn’t prove voice authentication is broken. It proved that trusting any one credential, checked once, in a channel with no real-time verification running underneath it, is broken, which is precisely the argument for building continuous, detection-backed authentication into every high-stakes interaction, voice included.