The Family Safe Word: How to Beat AI Voice-Cloning Scams

The call comes at the worst possible moment, which is the point. A voice that sounds exactly like your daughter, your son, your dad, cracking with fear. There's been an accident. A DUI. A kidnapping. They're crying, or someone next to them is doing the talking, and the one thing everyone agrees on is that you need to send money in the next few minutes or something terrible happens.

For years the shaky part of that scam was the voice. A stranger could not really sound like your kid, so the script leaned on bad phone connections and hysterics to paper over the gap. That crutch is gone. With a clip pulled from a voicemail greeting, a TikTok, or a birthday video, cheap software can now reproduce a familiar voice closely enough to fool the person who raised it.

So the old advice — "listen carefully, you'll be able to tell" — no longer holds. What does hold is a verification step that doesn't depend on your ears at all. That's the safe word.

Set up a family safe word in five steps

You can do this today, in one conversation, for free. The whole thing takes about ten minutes.

1. Pick a word or short phrase that means nothing to anyone outside the family. Two unrelated words work best. Random beats meaningful, because meaningful is guessable. (We won’t print examples to copy; the ideas section below explains why, and how to build your own.)
2. Make sure it isn't anywhere online. Skip pet names, kids' schools, street names, birthdays, sports teams, and anything a scammer could scrape from your profiles or a data broker.
3. Share it out loud, in person or on a call you placed. Never text it, email it, or say it on a line that might be recorded. Everyone gets the same word.
4. Pair it with one rule. If anyone calls claiming to be family in an emergency and asks for money, you ask for the word first — and if you don't get it, you hang up and call them back yourself.
5. Say it once so it feels normal. A single dry run turns an awkward idea into a reflex people will actually use under stress.

That's the entire system. The rest of this guide is about making each step hold up when a real call lands and your heart is pounding.

What is a family safe word?

Think of it as a password for people instead of accounts. Banks and websites make you prove identity with something only you should know. A safe word does the same job for a phone call, where caller ID can be spoofed and the voice itself can be faked. It is deliberately low-tech. There is no app to install, no subscription, nothing to update. Its strength comes entirely from being a secret that lives only in your family's heads.

The scam it defends against goes by a few names — the grandparent scam, the family-emergency scam, virtual kidnapping — but the engine is always the same: manufacture panic, demand speed, and cut off the moment you'd normally use to check. The FBI describes the grandparent version as a confidence scam where criminals pose as a relative in immediate financial need, and notes that the scammers have grown more sophisticated over the years (FBI, "The Grandparent Scam"). AI voice cloning is the latest upgrade to a very old con.

Why a safe word works against AI voice clones

Here is the mechanism, plainly. Voice-cloning software learns what a person sounds like. It does not learn what that person knows. Feed it a clip and it can reproduce the timbre, the accent, the little verbal habits. It cannot reproduce a word you agreed on at the kitchen table and never wrote down. Ask for that word and the clone has nothing to say.

The FTC has been blunt about how little audio the trick now needs. In its guidance on AI-enhanced family-emergency scams, the agency notes that with a short clip — maybe from something posted online — a scammer using a voice-cloning program "could call you and sound just like your family member" (FTC Consumer Alert, March 2023). Its remedy is a verification step that side-steps the voice entirely: hang up, call the person on a number you know is theirs, and try asking a question only the real person could answer (FTC, "Fighting back against harmful voice cloning," April 2024). A prearranged safe word is the cleanest version of that question, because you never have to improvise it in the moment.

The FBI lands in the same place from the other direction. Its December 2024 warning on criminals using generative AI tells people to “create a secret word or phrase with your family to verify their identity”, so a caller who can't produce it outs themselves as a fake. When the country's two biggest consumer-fraud authorities independently arrive at "agree on a secret word," it's worth ten minutes of your evening. For how the cloned-voice emergency call actually works, and how to shrink the amount of your family’s voice that’s online, see our guide to AI voice cloning scams.

Why this matters: the losses behind the advice are not small, and they are climbing. The FTC reported that people lost $3.5 billion to imposter scams in 2025, the most-reported fraud category of the year, with reported losses up nearly threefold since 2020 (FTC, June 2026). Older adults carry an outsized share: the FBI's Internet Crime Complaint Center logged $4.885 billion in losses from people aged 60 and up in 2024 across 147,127 complaints, a 43% jump in losses over the prior year (IC3 2024 Elder Fraud Report). The family-emergency call sits squarely inside that impersonation category, and the voice is now good enough to close the sale.

Figure 01 · The 10-second safe-word check ScamDrill

Source: ScamDrill guidance, drawing on FBI and FTC advice for family-emergency and voice-cloning scams, 2023–2026.

Family safe word ideas: what makes a good one

Not every secret is a good secret. The safe word only works if a scammer can't guess it, can't find it, and can't trick it out of you. Most failures trace back to picking something convenient over something private.

Bad ideas, because they’re already public or guessable:

• Pet names, kids’ names and nicknames, or a grandparent’s name.
• The street you grew up on, your hometown, a school, or its mascot.
• A favorite team, band, or show, and any birthday, anniversary, or year.
• Anything that has ever appeared in a post, a caption, a bio, or a group chat.
• Words a frightened person might say anyway, like “help” or “emergency.”

These feel personal, but they are exactly the details that get harvested from social media and sold by data brokers. If a stranger could learn it by scrolling your profiles for five minutes, it is not a secret.

Good patterns, because nobody outside the room can reconstruct them:

• An odd two-word pairing with no story behind it. Two things that have no business being next to each other, picked on the spot at the kitchen table. Absurd is good: it’s memorable to you precisely because it makes no sense to anyone else.
• A shared memory with a nonsense twist. Start from a moment only your household was there for, then change one detail into something that never happened. Someone who saw every photo from that trip still couldn’t guess the twist.
• A phrase you would never say by accident. If it could come up in a normal conversation, it can be guessed, overheard, or said by mistake.

Run any candidate through three questions. Could a stranger find it in five minutes of scrolling? Would anyone in the family say it by accident? Can the youngest and the oldest person in the family still say it exactly a week from now? You want no, no, and yes.

Where the word lives matters as much as the word itself. The moment you text it, email it, or type it into a group chat, you've created a copy that can be stolen in a breach or read off an unlocked phone. Say it out loud, in person if you can. And resist the urge to be clever with hints; a safe word written on a sticky note by the landline defeats the purpose.

Figure 02 · A safe word that holds vs. one that folds ScamDrill

Source: ScamDrill guidance on choosing and storing a household verification phrase, 2026.

What if the caller doesn’t know it (or says they forgot)?

Treat “I forgot” exactly like a wrong answer. It is the most natural-sounding dodge a scammer has, and it often comes with a reason attached: they’re hurt, they’re panicking, someone is standing over them, there’s no time. None of that changes what you do next.

1. Don’t give hints, and don’t offer choices. “Is it the one about the beach?” hands a guesser half the answer. If you want to probe, ask about something that doesn’t exist, a trip you never took or a relative you don’t have. A real family member will be confused. A scammer will play along.
2. Say the line, then hang up. “I love you, I’m calling you right back.” Then call the person on the number already saved in your phone, not the one that called you, and not a “new number” the caller gives you.
3. If they don’t pick up, call around them. A spouse, a roommate, a parent, a coworker, anyone likely to know where they are. It takes a couple of calls, and it’s worth every second.
4. Move no money while you’re checking. No wire, gift card, cryptocurrency, payment app, or courier pickup, and no reading back a code someone texted you. A real hospital, lawyer, or police department doesn’t need a gift card in the next ten minutes.

A real relative who genuinely blanked on the word loses nothing here. They pass the call-back, and you get to tease them about it later. The only person the rule inconveniences is the one who can’t be reached at the number you already have, and that is exactly the person you shouldn’t be sending money to.

How to test it without scaring anyone

A safe word you set and forget is a safe word you'll fumble when it counts. The fix is a light rehearsal, not a fire drill. Over dinner, ask each person, "What's our word?" and let them answer. That's it. You're checking two things: that everyone remembers it, and that saying it out loud feels ordinary rather than dramatic.

Older relatives deserve extra care here, because they're the ones the grandparent scam targets and because a clumsy "test" can feel like a loyalty exam. Frame it as protecting the whole family, not vetting them. Something like: "I set one up for me too — if you ever get a weird call that sounds like me asking for money, make me say it." That puts you both on the same side of the problem. The playbook for protecting elderly parents from scams goes deeper on having these conversations without stepping on anyone's independence.

Kids and teens can hold a safe word too, and they should. The same cloning trick powers "I lost my phone, text this new number" messages and, further along, the sextortion and blackmail scripts aimed at younger people. Building the habit early makes it stick.

A safe word for kids: the stranger-pickup plan

Plenty of families use the same idea for school pickups: if an adult the child wasn’t expecting says “your mom sent me,” the child asks for the word. It can help, but some child-safety educators are wary of leaning on it. Kidpower, for one, points out that a child who stops to quiz a stranger is still standing next to that stranger, and that kids can be tricked into confirming a guessed word. So for kids, make the word the backup, not the plan.

• Tell them ahead of time who is picking them up. If the plan changes, you tell them, or you tell the school, directly.
• Teach “check first.” The National Center for Missing & Exploited Children’s KidSmartz program teaches kids to always check with a parent or the adult in charge before going anywhere with anyone.
• Put the pickup list in writing with the school, so staff ask for your permission before releasing your child to anyone new.
• If someone unexpected shows up, the child walks to the teacher or front office. The word is never a reason to get in a car. At most, it confirms a change you already made.
• Consider a separate kids’ word from the one the adults use for money emergencies, so a word that slips out on the playground doesn’t compromise both.

Older kids and teens face the online version of the same trick, a stranger in their DMs claiming to be a friend of the family or someone they met once. Our guide to teaching kids about online scams without scaring them breaks those conversations down by age.

Where safe words break, and the backstops

The word is a strong first filter, not a force field. It fails in a few predictable ways, and each has a backstop.

Someone panics and forgets to ask. That's the most common failure, and it's why the second half of the rule matters as much as the word: any request to move money right now, by wire, gift card, or crypto, triggers a call back on a number you already have. Even if the word never comes up, the call-back catches the scam. The FTC's core instruction is exactly this — don't trust the incoming number, reach the person through contact details you already trust.

The scammer talks past it. Real cons don't fold politely. Expect "there's no time for that," or anger, or a claim that they're too hurt to remember. Those reactions are the tell. A genuine relative, once they understand you're scared for them, will happily say the word. Pressure to skip verification is itself the red flag.

The word leaked. Maybe it got texted once, or said on a smart speaker, or a phone got stolen. If you suspect it's out, pick a new one and share it in person. Treat it like any password: rotate it if it's exposed.

What makes all of this work under pressure is that the scam runs on urgency and borrowed authority — the same levers behind nearly every con, which we break down in the psychology of how scammers persuade you and trace step by step in the anatomy of a modern scam. The safe word is powerful precisely because it interrupts the urgency with a slow, boring question the con can't answer.

The same trick hits workplaces

This isn't only a kitchen-table problem. The identical move — a cloned voice plus manufactured urgency — now shows up at work, where the "relative in trouble" becomes "the CEO who needs a wire sent before the deal closes." Finance and payroll staff are the targets, and the ask is a payment change or an urgent transfer that skips the usual checks.

The organizational version of a safe word is a verification phrase plus a hard call-back rule: any change to payment details or any out-of-pattern transfer gets confirmed through a known internal channel before anyone acts, no matter who seems to be asking. It's the same logic that stops vendor-invoice fraud, which we cover in the vendor email compromise playbook. If you run a team, a five-minute call-back policy is one of the cheapest fraud controls you can put in place — and you can pressure-test it the same way you'd test a phishing email, which is what ScamDrill for organizations is built to do.

If you already sent money

First, set down any thought that this was careless. These scripts are engineered to hit when you're frightened and to make hesitation feel like risking your child's safety. Being fooled by that is not a character flaw; it's the design working as intended.

Then move quickly. Contact your bank or the payment provider right away and ask them to stop, reverse, or recall the transfer — speed helps, though recovery is never guaranteed. Gather everything: the number that called, the time, what was said, any payment confirmations. Report it to the FBI's Internet Crime Complaint Center at ic3.gov and to the FTC at reportfraud.ftc.gov. If you're not sure what to do first, our first 60 minutes after a scam walkthrough lays out the order of operations, and the I've been scammed decision tool builds a tailored plan.

One more warning, because it's cruel and common: after a loss, a second wave often arrives — a "recovery" service promising to claw the money back for a fee. It's the same con aimed at the same wound, and no legitimate agency charges you to recover funds. We unpack it in the second scam.

Make it a drill, not a memo

Reading this helps. It does not make anyone immune, because the emergency call is built to erase what you read in a calm hour. Knowledge fades under adrenaline; trained reflexes don't. The point of a safe word isn't the word — it's the pause it forces, practiced enough times that it fires on its own before your fear can override it.

So pick the word tonight. Say it out loud once. Then, every so often, run it: a cloned-voice "emergency" text to a family member who has to ask you for the word before they react. That's the difference between a plan you wrote down and a habit that holds when a voice you love is on the line, asking you to hurry.