Voice clones and the family code word: a practical guide

The phone rings. It is your daughter, or it sounds exactly like her. She is upset. She has been in an accident, or arrested, or her bag has been stolen abroad. She needs money now, and please don’t tell anyone.

Scams like this are not new. What has changed is the voice. With a short recording of someone speaking, which is easy to find in social media videos, voicemail greetings or a clip from a school play, software can now produce a convincing copy of that voice saying anything. It doesn’t need to be perfect. It needs to be good enough for a frightened person on a bad line.

The best defence is surprisingly low-tech: a word your family agrees on, that a stranger can’t know.

How the call usually goes

The details change. The shape rarely does.

• Someone you love is in trouble. An accident, an arrest, a lost phone, a hospital.
• It is urgent. There is no time to think or check.
• It is secret. Don’t tell Mum. Don’t call anyone. I’m embarrassed.
• The payment is unusual. A bank transfer to a new account, gift cards, cryptocurrency, or cash collected by a “courier”.
• Someone else takes over. Often a “police officer”, “lawyer” or “doctor” comes on the line to explain what needs to happen.

Urgency and secrecy do the real work. They are there to stop you doing the one thing that would expose the scam, which is checking.

Why “I’d know their voice” isn’t enough

Most of us trust our ears. That trust used to be reasonable. It isn’t any more, and a frightened brain is even less reliable than a calm one.

The number on the screen can’t settle it either. Caller ID can be faked, so a call can appear to come from your son’s mobile, your bank or the police when it doesn’t. A familiar name on the screen tells you nothing on its own.

Personal questions are weaker than they look, too. “What was the dog called?” feels safe, but the answer might be on a social media post from years ago. You need something that has never been written down online.

Set up a code word

This takes five minutes. Do it in person or on a call you started yourself.

1. Choose a word or short phrase. Make it odd enough that nobody would guess it, and easy enough that nobody will forget it. Something like “blue teapot” works, though not that one, now it’s on the internet. Your street name, a pet’s name or a birthday won’t work either.
2. Never write it anywhere online. Not in a group chat, not in an email, not in a notes app that syncs to the cloud. If someone needs a reminder, tell them in person.
3. Agree the rule. Any call, voice note or video asking for money or anything urgent gets the question: “What’s our word?” No word, no action. It doesn’t matter who it sounds like.
4. Include the people most likely to be targeted. Grandparents, teenagers, and anyone who lives alone. Explain why, calmly. This is a seatbelt, not a sign that you expect a crash.
5. Agree that checking is never rude. If Dad asks for the word and you are genuinely in trouble, you give it and move on. No one gets offended.

If a call ever feels wrong

You don’t need to prove it’s a scam. You only need to pause.

1. Ask for the word. If they can’t give it, or start explaining why they can’t, treat the call as a scam.
2. Hang up. Even if it feels cruel. A real family member will understand. A scammer needs you to stay on the line.
3. Call back on a number you already have. Use the one saved in your phone, not one the caller gives you. If you can’t reach them, call someone who would know where they are.
4. Don’t send anything in the meantime. Not money, not bank details, not the codes your bank sends by text.

If there is any chance someone is in real danger, call 999. The police will never ask you to move money to keep it safe, and neither will your bank.

If you’ve already paid

Act quickly and don’t be ashamed. These scams are designed by professionals to catch careful people.

• Call your bank straight away. Use the number on the back of your card. In the UK you can also call 159, which connects you to the fraud team at most major banks. The sooner they know, the better the chance of stopping the payment.
• Report it to the police. Your bank can tell you how, and reporting helps protect the next person.
• Change the code word. If there is any chance it was overheard or shared, pick a new one.

At work, the same rule applies

The family version of this scam has a business twin. A call or video message from the “chief executive” asks for an urgent transfer. A “supplier” rings to confirm new bank details. The voice and face can both be faked now.

The defence is the same. Money never moves because of a call alone. Changes to bank details are confirmed by calling back on a number you already hold, never one in the message. And everyone, including the most junior person in accounts, has permission to say, “I’ll call you back.”

Do it tonight

Pick a word. Tell the people who matter, in person. Agree that nobody moves money for an urgent call without it.

It is one of the few protections against AI fraud that costs nothing and works whether the fake is good or bad.

We are also building Codeword, a free Android app that makes the check one tap: when an unknown number calls, the person being called can ask the real family member, “Is it you?”, while the call is still going.