The Fake Kidnapping Call That Launched a Family's Mission

The Coughlin family knows the call. Their mother nearly paid a ransom after an AI-generated voice mimicked her daughter crying and begging for help, while a second voice on the line claimed to be holding her captive. The daughter was never in danger. The voice was indistinguishable from the real thing, and that is precisely what makes this scam so hard to dismiss.

Patrick and Ryan Coughlin, the brothers in that family, turned the experience into a company. In July 2026, TechCrunch covered the launch of Savi Security, an app built to detect AI-powered scams across calls, texts, and emails. Savi raised $7 million in seed funding. A family's near-miss became a funded startup, which tells you this is not a fringe problem.

How the Call Works

Voice cloning now requires as little as 20 to 30 seconds of audio: a voicemail, a TikTok, a podcast clip. Once a scammer has the recording, they can generate a convincing reproduction of that person's voice saying anything. The call follows a pattern: a panicked voice you recognize screams for help, a supposed captor gets on the line and tells you not to call the police, and you are kept talking so you cannot verify anything. Every second is designed to override clear thinking. Fear does the rest.

The numbers confirm the scale. According to the Federal Trade Commission, phone scams cost Americans $1.77 billion in 2023 alone, with impersonation scams as the leading category. The World Economic Forum reported that deepfake fraud attempts increased 500% in 2024. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every participant was a deepfake. If that can happen to trained professionals, it can happen to a parent who picks up the phone and hears a child screaming.

Why Your Ears Cannot Save You

Human ability to detect AI-generated audio hovers around 55 to 60 percent accuracy, according to published research conducted under calm, controlled conditions. A panicked parent is not operating under calm conditions. Recognizing a voice is no longer enough.

Families need a second layer of verification that does not depend on how someone sounds. That is what Trust Onion provides: three private rotating codewords, calculated locally on each family member's phone, changing every 60 seconds. No server required. It works offline. When a call comes in claiming to be someone you love, one question settles it: "What are the words?"

A real family member answers immediately. A scammer cannot know the words. An AI voice cannot fake them. They are never posted anywhere and never stored on a server that could be breached. A Trust Onion™ Proofie™, a passkey-signed selfie taken in the app, adds another layer: whoever holds the private key signs the exact photo, binding it to a moment in time, so family members can verify presence beyond a voice alone. Use the Trust Onion app to send, verify, and compare the full signing key against the person's public key in your shared group.

Savi Security's real-time call monitoring has genuine value. Catching a scam while it is happening can stop money from moving. But it requires the app to be running, a live data connection, and a correct real-time identification, all meaningful dependencies when fear is already in the room.

The Coughlin family's mother spent seconds in terror, hearing what she believed was her daughter's voice. Three codewords would have ended that call before the fear had time to take hold. If the caller cannot answer "What are the words?", you know right then, with no analysis required.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

Public by default, under your control. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.