Image: FBI

The phone rings and it's your son, or your granddaughter, or your sister. They sound scared. They've been in a crash, or they're stuck somewhere, or they're in trouble with the police, and they need money right now. Please don't tell anyone.

Scams built around a relative in trouble have been around for years. What has changed is the voice. The US Federal Trade Commission warned in a March 2023 consumer alert that a scammer can clone a loved one's voice using a short audio clip, which could come from content posted online, along with a voice cloning program. When the call comes, the scammer sounds just like the person you love.

My advice is to set up a simple defense that costs nothing. It's a family safe word, a private phrase that only your inner circle knows. Below is how I'd pick one, how I'd use it on a real call, and where it falls short.

Why a familiar voice is no longer proof

Starling Bank, a UK bank that has been pushing this idea as part of the Home Office's Stop! Think Fraud campaign, says on its Safe Phrases page that it only takes three seconds of audio for AI to clone someone's voice. That's the bank's claim, and short clips like that are easy to find in a public video, a voice note or a social media post.

The tools are also easy to get. In March 2025, Consumer Reports published an assessment of voice cloning products from six companies, namely Descript, ElevenLabs, Lovo, PlayHT, Resemble AI and Speechify. Its researchers were able to easily create a voice clone from publicly available audio in four of the six. Those four, ElevenLabs, Speechify, PlayHT and Lovo, only asked the researchers to check a box confirming they had the legal right to clone the voice, or make a similar self attestation. Consumer Reports said Descript and Resemble AI took steps to make it harder to create a clone without the speaker's consent.

Consumer Reports also found that four of the six companies, Speechify, Lovo, PlayHT and Descript, needed only a name or email address to open an account. Grace Gedye, a policy analyst at the group, said AI voice cloning tools "have the potential to supercharge impersonation scams."

My takeaway is simple. I wouldn't treat a voice that sounds exactly right as proof of who is on the other end.

What the FBI recommends

On December 3, 2024, the FBI issued public service announcement I-120324-PSA about criminals using generative AI for fraud. It specifically warns that criminals create short audio clips of a loved one's voice to pose as a close relative in a crisis, asking for immediate financial help or demanding a ransom.

The FBI's tips for protecting yourself line up closely with the safe word idea.

• Create a secret word or phrase with your family to verify their identity.
• Listen closely to tone and word choice to tell a real call from a loved one apart from a cloned voice.
• Verify who is calling by hanging up, looking up the contact details yourself, and calling the number directly.
• If possible, limit the amount of your image and voice online, make social media accounts private, and limit followers to people you know.
• Do not send money, gift cards, cryptocurrency or other assets to people you do not know or have met only online or over the phone.

The FTC gives similar advice. Don't trust the voice, call the person at a number you know is theirs, and if you can't reach them, try another family member or their friends. It also says a caller who asks you to wire money, send cryptocurrency or buy gift cards and read out the numbers is showing signs of a scam.

How to pick a good safe phrase

Starling's guidance says a safe phrase can be anything, as long as it is simple yet random, easy to remember, different from your other passwords, and shared with friends and family in person.

In practice, I'd skip anything a stranger could dig up online. Your dog's name, your street, your school mascot and your favorite team are all poor choices, because they may already be sitting on someone's public profile. I'd pick a short, odd pairing of words that has no link to your life.

To help people remember it, Starling suggests keeping it short, making up a mnemonic from the first letters of each word, and, if you must write it down, putting it on paper somewhere safe rather than saving it anywhere digital. To me, that rules out a family group chat, a notes app or an email thread.

Starling also says to change the phrase every now and again, and right away if you think it is no longer private.

What to say when a suspicious call comes in

A plan only helps if you remember it while your heart is racing, so I'd keep mine short.

First, I'd ask for the phrase. Something as plain as "What's our safe word?" is enough. A real family member who knows the plan won't be offended.

If they can't give it, I'd end the call. Starling's advice is to hang up and not make any payment. I wouldn't let the caller keep me talking, or stay on the line while trying to reach someone else.

Next, I'd call back on a number already saved for that person, not a number the caller gives me. Starling also suggests reaching out on another platform to see if they can give you the phrase there. If you can't reach them, the FTC suggests contacting another relative or one of their friends.

I wouldn't treat caller ID as proof either. Starling warns that scammers often use spoofing to make a call or text look like it's coming from someone you know. A familiar name on the screen and a familiar voice on the line can both be fake.

Finally, I'd listen for anything that sounds off. The FBI says to pay attention to tone and word choice, and Starling suggests listening for the vocal habits you know your family has. Those clues help, but in my view the phrase and the callback matter more.

If you think you've been targeted, the FBI asks people in the US to report it at ic3.gov, and the FTC takes reports at ReportFraud.ftc.gov.

Getting kids and older parents on board

The phrase is only useful if everyone who might get or make one of these calls knows it. The FTC's own example is a grandparent getting a panicked call from a grandson, so I'd start with older relatives and the kids or grandkids they would worry about.

Starling's advice is to share the phrase in person. I'd do it at a family dinner or a quick visit rather than over text, which can be forwarded, screenshotted or read over someone's shoulder.

I'd keep the explanation simple. For older relatives, my message would be that if anyone calls asking for money, even if it sounds exactly like a grandchild, they should ask for the phrase and then hang up and call back. For kids, I'd tell them that they may be asked for it too, and they should never share it with anyone outside the family, including friends.

I'd also agree on the rule that goes with it. No money moves on the strength of a phone call alone, no matter how urgent it sounds.

If the phrase leaks, maybe because a child mentioned it to a friend or someone typed it into a chat, I'd change it. Starling says to do that straight away if you think it's no longer private. Then I'd share the new one in person again.

What a safe word can't do

I see a safe word as a check, not a shield. It only works if the person who picks up remembers to ask, and a scared parent on a call about a crying child may forget. That's why I think the callback step matters as much as the phrase.

It also can't stop scams that don't pretend to be family. The FBI's announcement covers many other uses of generative AI in fraud, including fake social media profiles, fake identity documents, and deepfake video calls with people posing as executives or law enforcement. A family phrase does nothing against a fake bank caller or a fake investment pitch.

And it won't keep your voice from being cloned in the first place. For that, the FBI and Starling both suggest thinking about how much of your voice and image is public and tightening privacy settings where you can, which is advice I'd follow too.

Quick checklist

Here's the short version I'd stick on the fridge.

• Pick a short, random phrase that has no link to your life and is different from your passwords.
• Share it in person, and don't save it in a phone, chat or email.
• Ask for it on any call where a relative asks for money or says they're in trouble.
• If they can't give it, hang up and call back on a number you already have.
• Don't trust caller ID or a familiar voice on their own.
• Never send money, gift cards or crypto because of a phone call alone.
• Change the phrase if it leaks, and share the new one in person.
• Report suspected scams at ic3.gov or ReportFraud.ftc.gov.