How Do You Stop Fake Leads Reaching Your CRM From a Voice Agent?

A voice agent that works too well at capturing leads has a problem that nobody mentions in the demo. It captures everything. The genuine enquiry from a homeowner with a leaking roof. The spam caller who wanted to sell you an extended warranty. The teenager who found your number and had a go. The colleague testing it at ten at night. The robot from another company that rang to see if a robot answers. And the genuine customer whose name it heard wrong.

Each of those becomes a record. Each record triggers whatever you set up for a new lead: a text message, an email, a task for your team, a callback booking. The cost is not the junk itself. It is the work and the messages that junk causes, and the damage to your trust in your own numbers.

This is a different kind of abuse from the cost attacks I describe in our guide to securing an AI voice agent. Nobody is attacking you. Your system is simply too willing to believe what it is told. Here is where the junk comes from, and the design I would recommend to keep it out of the system that your team trusts.

Here's what matters most:

• Junk comes from eight places: spam and robocalls, bots, test calls, duplicates, wrong or misheard details, other machines, pranksters and competitors. Only some are malicious.
• Automated traffic is already more than half of what hits the open web. Imperva's 2025 report put it at 51 percent of web traffic in 2024, with 37 percent classed as bad bots.
• The fix is not smarter detection first. It is where the data lands: a holding area, with promotion into the real CRM only after a few checks.
• The agent should be able to create records in the holding area and nothing else. It should never edit or delete existing contacts.
• Every call needs one unique reference, so that a retry, a dropped line or a repeat caller cannot create a second record.

Where fake leads come from

I like to start with an honest list, because it changes the defence. Most owners picture one villain, a spammer. In practice, there are eight sources, and most of them are not malicious.

1. Spam and robocalls. Unwanted automated calls that reach the number, and now reach your agent. Some owners of AI answering services report that spam calls use up their monthly allowance, and one reviewer on the review site Trustpilot said their provider stopped filtering robotic calls so they were "wasting quota unnecessarily". Each one is a call your agent answers, bills and records.

2. Bots and scripts. If your agent has a web button or a form, scripts will find it. The Imperva 2025 Bad Bot Report, from the security company, put automated traffic at 51 percent of all web traffic in 2024 and bad bots at 37 percent. That is a vendor report and I treat the exact number loosely, but the direction matters: a form or web call that is open to the public will be used by machines.

3. Test calls. Your staff, your developer and your vendor. If nobody tags them, they become leads, and early on they can be a large share of all calls.

4. Duplicates. One person calling back three times creates three records. A dropped line and a redial create two. A retry after a temporary fault creates two. These are the most common junk records, and nobody means them.

5. Wrong or misheard details. A customer who is real but whose name, email or number was transcribed wrongly. This is not a spam problem. It is a data quality problem that looks like one. Sierra's τ-Voice research found that voice agents' transcription failures clustered on names and emails, even when callers spelled them out. A lead with a wrong email is a lead you cannot reach.

6. Other machines. Automated systems that call your number, including voicemail systems, other AI agents and auto-dialers. Two machines can talk to each other for minutes and produce a transcript that looks like a conversation.

7. Pranksters. Taco Bell scaled back its voice AI at drive-throughs after viral incidents, including a reported order for 18,000 cups of water. It reported the system worked for millions of other orders, and the details of the prank differ between outlets, but it shows what happens when a voice system accepts odd input. A prankster wastes a call and leaves a record behind.

8. Competitors and the curious. A competitor ringing to see how your agent responds, a journalist, a student. Not harmful, but not leads either.

If you count them up, the malicious ones, such as bots, are a minority of the list. That is good news, because most of the cure is ordinary data hygiene.

What junk actually costs you

I want to be careful here. The figures that circulate online for what bad data costs a company mostly come from vendors with something to sell, and I have not found an independent number I would put my name to. So I will describe the cost in terms you can measure in your own business.

Follow-up cost. Every lead may trigger a text, an email or an AI callback. Those cost money per message and per minute, and a callback to a spammer is a call you pay for twice.

Team time. Someone opens the lead, reads the transcript, tries to call back, finds a dead number and closes it. Multiply by the junk rate.

Distorted numbers. If a third of your leads are junk, your conversion rate looks terrible, your cost per lead looks fine, and every decision you make from the numbers is wrong.

Trust. When people learn the CRM is full of nonsense, they stop trusting the leads that are real. A good lead sits for two days because "it's probably another test".

Damage downstream. Systems connected to the CRM act on bad data. A speed-to-lead automation that texts every new contact within a minute will text every fake number you give it.

To see what your junk rate is, take the last fifty leads your voice agent created and sort them by hand into real, duplicate, test, spam and unclear. That takes half an hour and will teach you more than any tool.

The holding-area design

The design I would recommend is simple, and it is the core of this article. Call it a holding area. A voice agent never writes into the live CRM directly.

Instead, every call produces a call record, a plain log of what happened: time, number, length, a transcript, a short summary, and what the agent thinks the caller wanted. That goes in a separate place that nobody treats as customers. Only after a record passes a few checks does it get promoted into the CRM as a contact.

The checks are deliberately boring.

Is it a real, reachable person? Confirm the callback number by sending a text message with a short code or a link, and promote only if the person responds. For the web, a verified email works the same way. Phone and email verification add friction, and sources on form spam note this, so use them where the lead is worth it.

Did a real conversation happen? Set a minimum: a call of at least a certain length with at least a few turns from the caller. A two-second hang-up and a ten-minute silence are not leads.

Did the agent understand what they wanted? If the agent's own confidence about the request is low, send it to a person to review instead of promoting it.

Is it a duplicate? Compare the normalised phone number, with country code and formatting stripped, against existing contacts and recent call records. If it matches, attach the new call to the existing contact and do not create a new one.

Is it on a blocklist, or from a known test source? Your staff's numbers, your developer's numbers, known spam numbers. Skip them.

Is it something other than a person? Call length, no speech or looping speech, and an answering machine greeting can be detected, and those calls tagged as machine or voicemail.

A call that fails a check is not deleted. It stays in the holding area with a reason attached, so you can see what you are rejecting and change the rules if a check is too strict. A weekly five-minute skim of the rejected pile is how you find the genuine customer your rules wrongly turned away.

Rules for what the agent can write

The second half of the design is about permissions, and it matters even more for voice than for forms, because the agent speaks to the person while it writes.

Create only. Give the agent permission to add records in the holding area and nothing else. It should not edit, merge or delete existing contacts. If a caller says "I'm Priya, please change my number", the agent logs a request. A person, or a rule that checks identity, makes the change. OWASP, the group behind the standard list of AI application risks, calls this limiting excessive agency: minimise the tools an agent can use and limit what each one can do.

One reference per call, used as a unique key. Every call has a unique ID. Use it so that the same call cannot create two records, even if the connection retries. Voice agent guides recommend not retrying writes such as bookings inline, because a retry on a call that actually succeeded can double-book, according to Speechify's guide on voice agent tool calls. A unique key makes a repeat harmless.

Claims must match records. If the agent tells a caller "I've added you to our callback list", the callback list entry must exist in the log. Sierra's τ-Voice research found an agent that told a caller it had updated their shipping address without making the change. The reverse, a record created that the caller was never told about, is as bad. Reconcile the two.

Read only what it needs. An agent that can read the whole CRM can be talked into reading it out. Limit what it can see to what the call needs: the caller's own record, and nothing else.

A worked example, with illustrative numbers

This example is illustrative, not a real client. Dana runs a three-person roofing company. A voice agent answers her phone after hours and creates a lead for every call.

In a typical week, suppose it answers 40 calls. When Dana sorts them by hand, she finds 16 genuine enquiries, 8 repeat calls from the same people, 6 spam or robocalls, 4 tests by her own team, 3 wrong numbers and 3 where the agent misheard the email. Her CRM shows 40 new leads. The real number of new customers waiting is 16, and 3 of those cannot be reached because of a misheard email.

With a holding area, the same 40 calls produce 40 call records and 16 contacts. The 8 repeats attach to existing contacts. The 6 spam calls are tagged as spam by a short-call rule and a blocklist. The 4 tests are on an internal list. The 3 wrong numbers fail the text confirmation. The 3 misheard emails are flagged for a person to fix, with the audio attached.

Dana's team sees 16 leads, and 3 of them come with a note: "Confirm email". Nothing was deleted. Everything is traceable. Those numbers are made up to show the mechanism, and your own sort of fifty real calls will give you your own.

When the junk comes from the web button

If your voice agent has a "talk to us" button on your website, the same junk can arrive through that route, and it arrives with the added problem that it starts a metered call. For anything public, put limits at the front door: the request that starts the call should come from your own site, be limited per visitor and across all visitors, and cap the length of the call. Sources on form spam describe a layered setup of a hidden field that bots fill, a timing check, a challenge such as Turnstile or reCAPTCHA, and verification on valuable forms. They also warn that advanced bots increasingly bypass invisible challenges, and that most percentages quoted come from vendors, so treat the layers as a cost-raising measure, not a wall.

You can try an agent below, and then do what I suggest: call it three times with different details and see what it would have written.

If you want the agent to put every call into a holding area and promote only verified leads into your CRM, that is how we design the connection when we build AI voice agents. For why the quality of what the agent writes is a reliability problem, read why AI agents work in demos and fail in production.

FAQ

How do I stop fake leads from my AI voice agent?

Do not let the agent write directly into your CRM. Have it write call records to a holding area, then promote a record to a contact only after checks: a confirmed callback number, a real conversation of minimum length, a low-confidence flag for review, a duplicate check and a blocklist for test and spam numbers. Keep rejected records with reasons so you can adjust the rules.

Why does my AI receptionist create duplicate contacts?

Because each call or retry creates a record unless something prevents it. Repeat callers, dropped lines and retries after faults all produce duplicates. Use the call's unique ID as a key, and match new calls against existing contacts by normalised phone number so a repeat call attaches to the existing record.

How do I filter spam calls out of my AI answering service?

Block known spam numbers, tag very short calls and calls with no real speech, detect answering machines, and exclude internal numbers. Ask your provider what share of calls it filters and whether spam calls count against your minutes, because some owners report that unfiltered spam uses up their monthly allowance.

Can an AI voice agent verify that a lead is real?

It can help. It can ask for a callback number and trigger a text confirmation, repeat back names and emails for the caller to confirm, and flag low-confidence transcriptions for review. Verification adds friction, so use stronger checks where a lead is worth more.

What should I do with leads the agent misheard?

Treat them as quality problems, not junk. Keep the audio and transcript, flag the record for a person to correct, and use a different channel, such as a text with a link, to confirm the details. Research on voice agents shows names and emails are among the details they most often transcribe wrongly.

How can I measure how much junk my voice agent creates?

Take the last fifty records, sort them by hand into real, duplicate, test, spam and unclear, and count. Repeat monthly. The proportions tell you which check to build first.