The Family Safe Word: How to Beat AI Voice-Cloning Scams

The call comes at the worst possible moment, which is the point. A voice that sounds exactly like your daughter, your son, your dad, cracking with fear. There's been an accident. A DUI. A kidnapping. They're crying, or someone next to them is doing the talking, and the one thing everyone agrees on is that you need to send money in the next few minutes or something terrible happens.

For years the shaky part of that scam was the voice. A stranger could not really sound like your kid, so the script leaned on bad phone connections and hysterics to paper over the gap. That crutch is gone. With a clip pulled from a voicemail greeting, a TikTok, or a birthday video, cheap software can now reproduce a familiar voice closely enough to fool the person who raised it.

So the old advice — "listen carefully, you'll be able to tell" — no longer holds. What does hold is a verification step that doesn't depend on your ears at all. That's the safe word.

Set up a family safe word in five steps

You can do this today, in one conversation, for free. The whole thing takes about ten minutes.

1. Pick a word or short phrase that means nothing. Two unrelated words work best — "copper lantern," "velvet tractor." Random beats meaningful, because meaningful is guessable.
2. Make sure it isn't anywhere online. Skip pet names, kids' schools, street names, birthdays, sports teams, and anything a scammer could scrape from your profiles or a data broker.
3. Share it out loud, in person or on a call you placed. Never text it, email it, or say it on a line that might be recorded. Everyone gets the same word.
4. Pair it with one rule. If anyone calls claiming to be family in an emergency and asks for money, you ask for the word first — and if you don't get it, you hang up and call them back yourself.
5. Say it once so it feels normal. A single dry run turns an awkward idea into a reflex people will actually use under stress.

That's the entire system. The rest of this guide is about making each step hold up when a real call lands and your heart is pounding.

What is a family safe word?

Think of it as a password for people instead of accounts. Banks and websites make you prove identity with something only you should know. A safe word does the same job for a phone call, where caller ID can be spoofed and the voice itself can be faked. It is deliberately low-tech. There is no app to install, no subscription, nothing to update. Its strength comes entirely from being a secret that lives only in your family's heads.

The scam it defends against goes by a few names — the grandparent scam, the family-emergency scam, virtual kidnapping — but the engine is always the same: manufacture panic, demand speed, and cut off the moment you'd normally use to check. The FBI describes the grandparent version as a confidence scam where criminals pose as a relative in immediate financial need, and notes that the scammers have grown more sophisticated over the years (FBI, "The Grandparent Scam"). AI voice cloning is the latest upgrade to a very old con.

Why a safe word works when your ears don't

Here is the mechanism, plainly. Voice-cloning software learns what a person sounds like. It does not learn what that person knows. Feed it a clip and it can reproduce the timbre, the accent, the little verbal habits. It cannot reproduce a word you agreed on at the kitchen table and never wrote down. Ask for that word and the clone has nothing to say.

The FTC has been blunt about how little audio the trick now needs. In its guidance on AI-enhanced family-emergency scams, the agency notes that with a short clip — maybe from something posted online — a scammer using a voice-cloning program "could call you and sound just like your family member" (FTC Consumer Alert, March 2023). Its remedy is a verification step that side-steps the voice entirely: hang up, call the person on a number you know is theirs, and try asking a question only the real person could answer (FTC, "Fighting back against harmful voice cloning," April 2024). A prearranged safe word is the cleanest version of that question, because you never have to improvise it in the moment.

The FBI lands in the same place from the other direction, recommending that families set up a shared verbal password or phrase that only they know, so a caller who can't produce it outs themselves as a fake. When the country's two biggest consumer-fraud authorities independently arrive at "agree on a secret word," it's worth ten minutes of your evening.

Why this matters: the losses behind the advice are not small, and they are climbing. The FTC reported that people lost $3.5 billion to imposter scams in 2025, the most-reported fraud category of the year, with reported losses up nearly threefold since 2020 (FTC, June 2026). Older adults carry an outsized share: the FBI's Internet Crime Complaint Center logged $4.885 billion in losses from people aged 60 and up in 2024 across 147,127 complaints, a 43% jump in losses over the prior year (IC3 2024 Elder Fraud Report). The family-emergency call sits squarely inside that impersonation category, and the voice is now good enough to close the sale.

Figure 01 · The 10-second safe-word check ScamDrill

Source: ScamDrill guidance, drawing on FBI and FTC advice for family-emergency and voice-cloning scams, 2023–2026.

What makes a word hold, or fold

Not every secret is a good secret. The safe word only works if a scammer can't guess it, can't find it, and can't trick it out of you. Most failures trace back to picking something convenient over something private.

The worst choices are the ones sitting in plain sight. A child's first name, the dog, the town you grew up in, a favorite team, an anniversary — these feel personal, but they are exactly the details that get harvested from social media and sold by data brokers. If a stranger could learn it by scrolling your profiles for five minutes, it is not a secret. The strongest words are arbitrary: two things that have no business being next to each other, easy for your family to remember precisely because they're absurd.

Where the word lives matters as much as the word itself. The moment you text it, email it, or type it into a group chat, you've created a copy that can be stolen in a breach or read off an unlocked phone. Say it out loud, in person if you can. And resist the urge to be clever with hints; a safe word written on a sticky note by the landline defeats the purpose.

Figure 02 · A safe word that holds vs. one that folds ScamDrill

Source: ScamDrill guidance on choosing and storing a household verification phrase, 2026.

How to test it without scaring anyone

A safe word you set and forget is a safe word you'll fumble when it counts. The fix is a light rehearsal, not a fire drill. Over dinner, ask each person, "What's our word?" and let them answer. That's it. You're checking two things: that everyone remembers it, and that saying it out loud feels ordinary rather than dramatic.

Older relatives deserve extra care here, because they're the ones the grandparent scam targets and because a clumsy "test" can feel like a loyalty exam. Frame it as protecting the whole family, not vetting them. Something like: "I set one up for me too — if you ever get a weird call that sounds like me asking for money, make me say it." That puts you both on the same side of the problem. The playbook for protecting elderly parents from scams goes deeper on having these conversations without stepping on anyone's independence.

Kids and teens can hold a safe word too, and they should. The same cloning trick powers "I lost my phone, text this new number" messages and, further along, the sextortion and blackmail scripts aimed at younger people. Building the habit early makes it stick.

Where safe words break, and the backstops

The word is a strong first filter, not a force field. It fails in a few predictable ways, and each has a backstop.

Someone panics and forgets to ask. That's the most common failure, and it's why the second half of the rule matters as much as the word: any request to move money right now, by wire, gift card, or crypto, triggers a call back on a number you already have. Even if the word never comes up, the call-back catches the scam. The FTC's core instruction is exactly this — don't trust the incoming number, reach the person through contact details you already trust.

The scammer talks past it. Real cons don't fold politely. Expect "there's no time for that," or anger, or a claim that they're too hurt to remember. Those reactions are the tell. A genuine relative, once they understand you're scared for them, will happily say the word. Pressure to skip verification is itself the red flag.

The word leaked. Maybe it got texted once, or said on a smart speaker, or a phone got stolen. If you suspect it's out, pick a new one and share it in person. Treat it like any password: rotate it if it's exposed.

What makes all of this work under pressure is that the scam runs on urgency and borrowed authority — the same levers behind nearly every con, which we break down in the psychology of how scammers persuade you and trace step by step in the anatomy of a modern scam. The safe word is powerful precisely because it interrupts the urgency with a slow, boring question the con can't answer.

The same trick hits workplaces

This isn't only a kitchen-table problem. The identical move — a cloned voice plus manufactured urgency — now shows up at work, where the "relative in trouble" becomes "the CEO who needs a wire sent before the deal closes." Finance and payroll staff are the targets, and the ask is a payment change or an urgent transfer that skips the usual checks.

The organizational version of a safe word is a verification phrase plus a hard call-back rule: any change to payment details or any out-of-pattern transfer gets confirmed through a known internal channel before anyone acts, no matter who seems to be asking. It's the same logic that stops vendor-invoice fraud, which we cover in the vendor email compromise playbook. If you run a team, a five-minute call-back policy is one of the cheapest fraud controls you can put in place — and you can pressure-test it the same way you'd test a phishing email, which is what ScamDrill for organizations is built to do.

If you already sent money

First, set down any thought that this was careless. These scripts are engineered to hit when you're frightened and to make hesitation feel like risking your child's safety. Being fooled by that is not a character flaw; it's the design working as intended.

Then move quickly. Contact your bank or the payment provider right away and ask them to stop, reverse, or recall the transfer — speed helps, though recovery is never guaranteed. Gather everything: the number that called, the time, what was said, any payment confirmations. Report it to the FBI's Internet Crime Complaint Center at ic3.gov and to the FTC at reportfraud.ftc.gov. If you're not sure what to do first, our first 60 minutes after a scam walkthrough lays out the order of operations, and the I've been scammed decision tool builds a tailored plan.

One more warning, because it's cruel and common: after a loss, a second wave often arrives — a "recovery" service promising to claw the money back for a fee. It's the same con aimed at the same wound, and no legitimate agency charges you to recover funds. We unpack it in the second scam.

Make it a drill, not a memo

Reading this helps. It does not make anyone immune, because the emergency call is built to erase what you read in a calm hour. Knowledge fades under adrenaline; trained reflexes don't. The point of a safe word isn't the word — it's the pause it forces, practiced enough times that it fires on its own before your fear can override it.

So pick the word tonight. Say it out loud once. Then, every so often, run it: a cloned-voice "emergency" text to a family member who has to ask you for the word before they react. That's the difference between a plan you wrote down and a habit that holds when a voice you love is on the line, asking you to hurry.