Why this matters
The phone rings and it is your daughter, crying. There has been a crash, or an arrest, and she needs money this minute. The voice is hers, down to the catch in it. It is not her. It is a few seconds of her voice, copied from a video online and played back by a machine.
Cloning a voice no longer takes a studio. Starling Bank, which runs a public campaign on exactly this, says a usable clone can be built from as little as three seconds of audio, and that more than a quarter of UK adults had been targeted by a voice-cloning scam in a single year. The raw material is a birthday video, a voice note, a clip from a school play.
It works because it skips past thought. The scam is built to make you act before you check, using the one voice you would never question. By the time the doubt arrives, the money has gone by a route that does not come back.
The defence is not technical. You cannot tell a careful clone from the real voice by ear, and you do not have to. One word, agreed in advance and known only to your family, settles it in a second. The voice can be faked. The word cannot.
Agree a family code word now. On any urgent call for money or secrecy, ask for it. No word, no money.
How the scam works
The call follows a script. Knowing its shape is half the defence, because you start to recognise the move while it is happening.
It begins with a clip. A few seconds of the target’s voice from a social-media video, a podcast, or a voicemail greeting is enough to build the clone. The less you have posted, the harder this first step, which is why keeping your details thin helps here too.
Then comes the call, in the cloned voice, posing as the family member in crisis, or as an official around them: a lawyer, a police officer, a doctor at a hospital. And then the squeeze, which is the same every time. A disaster to frighten you, a plea to tell no one, and a demand to pay fast by a route that cannot be reversed, such as gift cards, a bank transfer or cryptocurrency.
In December 2024 the FBI warned that criminals use AI-generated audio to impersonate a relative in crisis and ask for money or a ransom, and told families to create a secret word or phrase to verify each other. The advice in this guide is theirs, put plainly.
The one defence
A code word is a short, private word or phrase that everyone in your family knows and no one else does. On any call that demands money or secrecy, you ask for it.
The real person knows it at once. A scammer, however perfect the voice, does not. That is the whole of it. You stop trying to judge whether the voice is genuine, which is a test you will lose against a good clone, and you ask instead for something the voice cannot produce.
Both the FBI and Starling Bank recommend this same step, because it sidesteps what the scam depends on. The attacker has spent their effort making the voice convincing. The word makes the voice beside the point.
Never send the word in a text, an email or a chat, and never say it on a call you did not place. It is spoken only when you ask for it, and it lives nowhere a thief could find it. The moment it is typed somewhere, it starts to leak.
Set one up tonight
This takes one conversation. The aim is a word everyone remembers and no one has written down.
Pick something odd and private
Choose a word or short phrase that is memorable and a little strange, and that you have never posted anywhere. Two unrelated words work well, such as a colour and an animal that have nothing to do with each other. Avoid anything a stranger could look up, such as one pet’s name, a street or a birthday. If you would rather have one suggested, the Code Word Generator makes memorable pairs in your browser, with nothing saved.
Share it with the people, not the devices
Decide who needs it: parents, children, grandparents, anyone who might take one of these calls. Tell them in person. Keep the circle to people you trust and small enough that everyone remembers who is in it.
Say it aloud, never type it
Agree the word out loud together. Do not put it in a family group chat, a shared note or an email. Its strength is that it has never been typed, so there is nothing for a breach or a snooping app to find.
Make clear when to use it
Make sure the youngest and the oldest both understand the trigger: any surprise call about money or trouble, ask for the word before doing anything else. Keep the instruction that simple, so it holds under stress.
Practise it once
Practise once. One person calls, the other asks for the word. It fixes the habit, and it shows everyone that asking is not rude or awkward. The first real time should not be the first time.
If a random phrase is hard to recall, build one from your own pets. Not a single name a stranger could find, but a string of them that only your family would put together: a childhood cat, the dog you have now, the goldfish that lasted a week. Something like “Biscuit Smudge Pickle” is easy to say back and hard for anyone else to guess, because the names can be familiar while the combination stays private. You can even fix the question, so that “pass phrase please” always means name the pets.
Doing it for a relative
This guide is partly for the person reading it on someone else’s behalf. Older relatives are among the most targeted and the least warned, and a few minutes of setup spares them the worst version of this.
Raise it without fear. Frame the word as something the whole family is adopting, not a lecture about anyone’s judgement. “We are all picking a family word” lands better than “you might get scammed”, and it gets everyone to take part rather than feel singled out.
Make the callback the easy option. Write the real phone numbers of close family on a card kept by their phone, so the answer to a frightening call is to hang up and dial a number they can see. Agree one rule alongside it, that no money decision is ever made on a surprise call. The bank, the police and a real grandchild will all wait for a callback.
If a caller insists you do not hang up, or that you tell no one, that alone is the scam. A real emergency survives a two-minute callback. Pressure to stay on the line exists only to stop you checking.
If a call comes
If a call like this reaches you, the steps are the same whether or not you have a word ready.
- Stop. Do not act on the voice. The panic is the weapon, so the first move is to slow down.
- Ask for the code word. If it cannot be given, end the call there.
- Hang up and call back. Use the number you already have for them, never a number the caller gives you.
- Check with someone else. Reach another family member to confirm where the person is.
- Refuse the fast payment. No gift cards, transfer or cryptocurrency on a surprise call, whatever the story.
- Report it. Tell your bank and your country’s fraud line, so the next person is warned and any payment can be chased.
Quick reference
| Situation | Do |
|---|---|
| Setting up | Agree one family code word, known to people, never typed. |
| Any urgent money call | Ask for the word before anything else. |
| No word given | Treat it as a scam and hang up. |
| To verify a story | Call back on the number you already have. |
| The pressure signs | Panic, secrecy, speed: any one means slow down. |
| Fast payment demanded | Gift card, transfer or crypto on a surprise call is a red flag. |
| For an older relative | Real numbers on a card by the phone, no decisions on a surprise call. |
Common questions
The questions families ask once they realise a familiar voice is no longer proof of anything.
How little audio does a scammer need?
Seconds. Starling Bank, which runs a public campaign on this, says a voice can be cloned from as little as three seconds of audio. That is the length of a clip from a birthday video, a voice note or a voicemail greeting, so the raw material is already out there for most of us.
What makes a good code word?
Something private and a little odd that you have never posted anywhere. Two unrelated words are easy to remember and hard to guess. Avoid anything a stranger could look up on its own, such as one pet's name, a street or a birthday.
Can we use our pets' names?
Yes, as a combination rather than a single name. One pet's name on its own may be online, but a string of them that only your family would put together is both easy to remember and hard to guess, such as a childhood cat, the dog you have now and the goldfish that lasted a week. Keep the particular combination to yourselves, and you have a phrase the youngest and the oldest can both recall under pressure.
Who should know it?
Everyone who might receive one of these calls: children, parents, grandparents. Keep it to people rather than devices, share it out loud in person, and never put it in a group chat or a notes app where it could leak.
What if I freeze and forget to ask for it?
Fall back on the simpler rule: hang up and call the person back on the number you already have for them. A real emergency survives a two-minute callback. The word and the callback both work, and you only need one of them to hold.
My relative is not technical. How do I explain it?
Frame it as something the whole family is doing together, not a warning aimed at them. Choose the word as a group, write the family's real phone numbers on a card by their phone, and agree the single rule that no money decision happens on a surprise call.
The caller said not to hang up or tell anyone. Is that normal?
No, and it is the clearest sign of a scam. Secrecy and staying on the line exist to stop you checking the story. A genuine emergency does not fall apart because you called someone back to confirm it.
My family's voices are already online. Is it too late?
No. You cannot pull every clip off the internet, and you do not need to. The code word works no matter how good the clone is, because it tests something the voice cannot supply. Posting less only makes you a smaller target.
What if I already paid?
Act quickly. Contact your bank to try to stop or reverse the transfer, change any shared passwords, and report it to the authorities, such as the FTC at ReportFraud.ftc.gov in the United States or Action Fraud in the United Kingdom. Gift-card and crypto payments are hard to recover, so speed matters most.