A Couple Lost $800,000 to an AI Scam. Here's How.

The money was gone before the real family member knew anything had happened.

According to CBS News reporting from July 2026, the Atlanta couple's loss was part of a documented national pattern. AI scam losses across the United States have reached nearly $900 million, and that figure covers only reported cases. In South Florida, a separate incident showed the same technology working from a different angle: scammers cloned an attorney's voice and used his professional credibility to deceive the people who trusted him most. Neither case required a data breach or a hacked account. Just audio, a cloning tool, and a family with no way to verify who was actually on the line.

The mechanics are straightforward. AI voice cloning requires as little as 20 to 30 seconds of audio, drawn from a voicemail, a social media clip, or a brief phone call. Scammers feed that sample into a cloning tool, several of which are commercially available and require no technical expertise, then call a family member with a crisis: an arrest, a hospital, a car accident. Something that demands money immediately and punishes hesitation.

The emotional architecture of these calls is deliberate. Research shows humans correctly identify AI-generated voices only about 55 to 60 percent of the time under calm conditions. A scam call is not calm. The urgency is manufactured to short-circuit careful reasoning. When you hear a voice that sounds like someone you love, you don't run a technical analysis. You react. That reaction is the product.

The standard advice, hang up and call your family member back on a known number, is genuinely useful. But a failed callback does not prove the original caller was legitimate: scammers spoof caller ID so the number looks right, and they keep victims emotionally agitated to discourage the pause required to think clearly. Families with no shared verification system in place before the call arrives have nothing to fall back on in the moment.

A Question That Ends the Call

Trust Onion gives families three rotating codewords, calculated locally on each person's phone, that change every 60 seconds on a shared schedule. When a suspicious call arrives, one question settles it: "What are the words?" A real family member answers immediately. A scammer, however convincing the cloned voice, cannot. The words are never stored on a server and cannot be intercepted in transit.

For families who want a visual layer of verification, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. The app captures the photo, adds a fingerprint and QR watermark, then computes a SHA-256 hash of the final image. A standard P-256 WebAuthn passkey signs after Face ID, fingerprint, or device-passcode unlock, binding the full signing key to the exact original photo, the time, and the What3Words location. Verification checks that signature against the person's public key in your shared Trust Onion group. Proofies are public by default and stored securely on AWS; you can add a password or delete one at any time, though copies already downloaded cannot be recalled. Codewords work alongside Proofies, not as part of the signed payload.

What the Atlanta Case Leaves Behind

The five steps that cost one couple $800,000 are the same steps used in every variant of this scam: harvest audio, clone the voice, call with a crisis, request fast payment by wire transfer, gift card, or cryptocurrency, then disappear before anyone asks questions. The technology is not going to become less accessible.

What changes the outcome is a shared system established before the call comes. "What are the words?" is a question a scammer has no answer for, no matter how well they sound like the person you love.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.

Public by default, under your control. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.