INTRODUCTION
Imagine two business owners that buy and sell from each other regularly. Given their many years of business relationship, they often finalize minor changes to their orders over phone calls and voice notes. One day, the buyer receives a voice note sounding exactly like the seller asking for an immediate price increase for the next delivery due to a stock shortage. He recognizes the seller’s voice and responds with a confirmation text. Later on, the two business owners meet and discover the seller never sent the voice note. A scammer had copied a short audio clip from the seller’s video and used an easy AI to create a fake audio message and sent it to the buyer.
This is what one would call “Phantom Consensus”. At first glance, it looks like a deal was made as voiced offer and text acceptance was made; but will this be binding given that the seller’s mind and intention were never actually present? Can such a fraudulent use of one’s voice lead to a legally binding contract, and who bears the liability for the losses caused?
THE LEGAL FRAMEWORK
For this to be so, one must look at the basics of contract law. The Indian Contract Act of 1872 establishes consent as the most fundamental requirement of contractual formation. Section 10 requires free consent of the parties in order for a contract to be legally valid, while Section 13 stresses upon consensus ad idem i.e. meeting of mind as an essential requirement of a valid contract.[1] In Tarsem Singh v. Sukhminder Singh, the Supreme Court recognised the importance of consensus ad idem as an essential feature of a contract.[2]
THE ANALOGY OF FORGERY
An AI-generated voice communication, however, raises a more fundamental question: whether a communication that was never made or authorised by the purported speaker can be attributed to that person as an expression of consent.
This is where the laws related to forgery come into the picture. In Bihta Cooperative Development Cane Marketing Union Ltd. v. Bank of Bihar, the Supreme Court recognised that a forged signature cannot constitute a mandate attributable to the purported signatory.[3] The importance of this principle lies not only in the falsity of the signature, but also in the absence of genuine authorisation underlying the apparent act of consent. In a similar manner, an AI-generated voice may imitate the distinctive characteristics of an individual’s voice while remaining completely unauthorised by that individual. The analogy, however, is not undisputed. A voice, unlike a signature, is not a legally prescribed instrument of authentication, and merely a means of communication. And thus, the contractual attribution may depend upon the surrounding circumstances and established methods of verification.
The analogy with forgery is therefore relevant in highlighting a common problem i.e. the distinction between the appearance of identity and actual authorisation. When a third party creates and misuses a communication using another person’s voice, the main question is whether such apparent assent can be legally attributed to the purported speaker.
ABSENCE OF CONSENT AND VITIATION OF AGREEMENT
In the case of an AI-generated voice communication, the most complicated question that arises is that the recipient may reasonably believe that the voice belongs to the other party involved in the contract, while the purported speaker neither made nor authorised the communication. The reproduced voice does not, by itself, establish that the purported speaker manifested consent.
The differentiation between the appearance of assent and actual authorisation therefore becomes imperative. If the communication originates completely from a third-party impersonator, it is arguable that no consent from the purported speaker existed at the stage of contract formation.
The scenario must also be differentiated from an ordinary matter of fraud or misrepresentation between the contracting parties. Sections 17 and 18 recognise fraud and misrepresentation affecting consent, while Section 19 talks about the voidability of contract where consent was obtained by fraud or misrepresentation.[4]
In a deepfake transaction, however, the primary issue may precede vitiation of consent. Thus, the legal consequences in such cases may depend upon whether the court treats the communication as an unauthorised act which is incapable of creating contractual obligations, or as a transaction in which the apparent consent was procured through third-party fraud.
THE ALLOCATION OF RISK
The absence of consent does not automatically resolve the question of who should bear the consequences of an AI-enabled impersonation. The RBI’s guidelines on ‘Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transaction’ can prove to be a useful model for risk allocation in such cases. Where an unauthorised transaction results from a third-party breach and neither the bank nor the customer is at fault, the RBI provides for zero customer liability, subject to timely reporting. Conversely, where the loss results from customer negligence, like sharing payment credentials, the customer bears the loss until the transaction is reported.[5]
By analogy, the risk should be allocated according to the parties’ respective conduct. The impersonator, as the party intentionally creating the deception, should bear the primary responsibility. However, where a person knowingly or recklessly exposes biometric material or fails to take reasonable precautions that could have prevented the fraud, such conduct may be relevant to determining contributory negligence.
This approach finds support in the principle of contributory negligence. In Municipal Corporation of Greater Bombay v Laxman Iyer, the Supreme Court recognised the relevance of a party’s own conduct where it contributes to the resulting harm.[6] Mere public availability of a person’s voice should not, however, amount to negligence by itself. The circumstances, foreseeability of misuse and precautions reasonably available to each party should determine the extent to which liability may be apportioned.
CONCLUSION
AI voice cloning has transformed identity fraud from a problem of forged documents into one of forged human expression. While existing contract law continues to require genuine consent, it lacks in confronting situations where the appearance of consent can be manufactured without the speaker’s participation. “Phantom Consensus” exposes a crucial gap between sounding like consent and actually giving consent. As voice becomes increasingly replicable, contractual obligations and certainty must depend not only on recognising a voice, but also on verifying the person and intention behind it.
Author(s) Name: Janhavi Mishra (Government Law College, Mumbai)
References:
[1] The Indian Contract Act 1872, ss 10,13
[2] Tarsem Singh v Sukhminder Singh (1998) 3 SCC 471
[3] Bihta Cooperative Development Cane Marketing Union Ltd v Bank of Bihar (1967) 1 SCR 848
[4] The Indian Contract Act 1872, ss 17-19
[5] Reserve Bank of India, ‘Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions’ RBI/2017-18/15,DBR.No.Leg.BC.78/09.07.005/2017-18 (6 July, 2017) paras 6-7
[6] Municipal Corporation of Greater Bombay v Laxman Iyer (2003) 8 SCC 731