A printable one-page guide against voice cloning and deepfake fraud: replace "does it sound like them?" with rules the whole household follows.
- A familiar voice is no longer proof. Voices can be copied from a short recording, so "it sounded just like her" has stopped working as a test.
- Agree a family code word. Pick something never posted online, and share it with the people most likely to get the call.
- Hang up and call back. Send no money and give no details on an incoming call; ring the number already saved in the phone.
- Urgency plus secrecy is the alarm. A real emergency survives a short callback; a scam does not.
- If it has already happened, act fast. Call the bank, report it, and tell the family.
A stranger can now copy a voice from about three seconds of recorded audio — a voicemail greeting, a video, a call someone answered. So the old test, "it sounded just like her", stopped working. Everything below replaces that test with something that still works: a rule you follow, instead of a judgement you make.Microsoft Research, VALL-E, January 2023, read at source 10 Sep 2026: high-quality personalised speech from "only a 3-second enrolled recording of an unseen speaker", preserving the speaker's emotion and acoustic environment.
Four steps
Agree a code word
Pick one word or short phrase the whole family knows. Not a pet's name, not a birthday, not anything posted online. Anyone who calls claiming to be family in trouble must be able to say it.
Tell the people who need it most — grandparents, parents, anyone who might get the call — and do not write it in a message that could be read on a stolen phone.
Adopt the callback rule
Nobody sends money or gives out details on an incoming call. Hang up. Call back on the number already saved in the phone — never a number the caller gives you, and never by pressing redial.
This single rule defeats almost every version of this scam, because the caller cannot control the number you dial.
Memorise three sentences
The scam works by rushing you. Having the words ready means you do not have to think of them while frightened.
"I'm going to hang up and call you back." "I don't send money on a phone call." "I need to speak to someone else in the family first."Say them out loud once at the kitchen table. It feels silly and it is the part that works.
Decide who verifies
Name one person everyone can ring to check a suspicious call — and make sure everyone knows who that is before anything happens. Scammers rely on isolation and secrecy. A second person breaks it.
If that person is you, say so plainly: "Ring me first, any hour, and I will never be annoyed about it."
Set this up before anyone needs it: a code word, the callback rule, three sentences said out loud once, and one person everyone rings to check.
What these calls sound like
Two things are always present, whatever the story: urgency and secrecy. An accident, an arrest, a hospital, a legal problem — and a reason not to tell anyone else yet.
Take that pair as the alarm. Not the voice, not the accent, not the emotion — those are now cheap to fake. Urgency plus secrecy is the tell. A real emergency survives a five-minute callback; a scam does not.
Nobody should be embarrassed. These calls fool careful people — a finance professional at a major engineering firm authorised fifteen transfers totalling about US$25.6 million after a video call with what appeared to be his own colleagues. Act quickly: call the bank immediately and ask about recall or reversal, then report it — in the US at reportfraud.ftc.gov and the FBI's IC3, elsewhere through your national fraud line. Then tell the family, because silence is what lets the same call work twice.Case detail: CNN Business, 16 May 2024, reporting what Hong Kong police said in February 2024 and what the firm, Arup, confirmed in May; read at source 17 Sep 2026: “He subsequently agreed to send a total of 200 million Hong Kong dollars — about $25.6 million.” and “The amount was sent across 15 transactions, Hong Kong public broadcaster RTHK reported, citing police.” Arup told CNN it could “confirm that fake voices and images were used”.
Judge the call by what it asks for, not by how it sounds. If money has already gone, call the bank straight away, report it, and tell the family.
Why this page exists
In the FBI's 2025 Internet Crime Report, Americans aged 60 and over reported roughly $7.7 billion in losses — the most of any age group. The same report gives artificial intelligence a section of its own, which the 2024 report did not have: 22,364 complaints and $893,346,472 in losses where the complaint mentioned AI. The bureau suggests the real share is larger, because many victims do not realise AI was involved.Source: FBI Internet Crime Complaint Center, 2025 IC3 Annual Report, read at source 17 Sep 2026: “60+: 201,266 complaints, $7.7 billion in losses.” · “In 2025, IC3 received more than 22,000 complaints reporting AI-related information. Adjusted losses of these complaints exceed $893 million.” (the AI section’s own count: 22,364 complaints, $893,346,472) · “However, overall losses to Investment scams exceeded $8 billion, demonstrating that many victims do not realize the extent AI may be involved in scams.”
Those are the people this page is for. Not because they are careless — because they are called more, and because the defences that protect them are social rather than technical.
Do not teach your family to be afraid of technology. Teach them one rule: verify by calling back. Fear makes people easier to manipulate, and it costs them the good uses of the same tools. A household that hangs up and rings back is protected, whether or not anyone in it can tell a real voice from a copied one.