The Secret Codewords That Scammers Hate

It wasn't him at all.

BBC Future reported the story in August 2026, in its widely shared feature "The secret codewords that scammers hate". The call follows a pattern that has become painfully familiar: a parent hears their child's voice, terrified, while a stranger on the line demands immediate payment and orders them not to hang up. Every parental instinct fires at once. That is not an accident. That is the design.

The voice was generated by AI. Scammers needed only a short audio clip, likely pulled from a social media video, to build a convincing clone. Voice cloning now requires as little as 20 to 30 seconds of audio to produce a replica that most people cannot distinguish from the real thing. Human detection accuracy for AI-generated audio hovers around 55 to 60 percent, according to research cited by multiple security experts, and under emotional stress those odds get worse.

The calls follow a tight script. First, urgency: no time to think, no time to verify. Second, untraceable payment: cash, gift cards, wire transfers, nothing reversible. Third, isolation: don't call anyone, don't tell your spouse, don't contact the police. The scam only works if you stay alone with the fear. $7,500 in cash is large enough to feel like a real crisis, small enough that some families can access it quickly.

When you believe your child is in danger, your brain fills in the gaps, hearing what it expects to hear. Scammers count on it.

The One Question That Stops It

The BBC Future article lands on the same answer that security researchers and family safety advocates have been circling for years: a secret codeword. An AI can clone a voice. It cannot know a private word that only your family agreed on in advance. If the caller claiming to be your son cannot tell you the family's codeword, that is your answer.

Knowing the strategy is not enough. You have to decide in advance that you will ask for the word, even when you are scared, even when the voice sounds exactly right, even when someone is screaming at you not to hang up. That preparation has to happen before the call.

A single shared password is better than nothing, but it has a real weakness: words can be guessed, overheard, or found. Trust Onion uses three rotating codewords that change every 60 seconds, calculated locally on your phone with no server required. You ask: "What are the words?" If the caller cannot answer with the current three, the call is over.

Before the Next Call

The conversation your family needs is simple. Tell every member about these scams and explain that a voice alone is not proof of identity. Then agree on a verification method and pre-commit to using it. The script is short: "If anyone ever calls claiming to be me and says I'm in trouble, ask them for the words. If they don't know them, hang up and call me directly."

One callback note: hanging up and calling back on a number you already have is sound advice, but a successful callback does not prove the original caller was legitimate. Use a number saved in your contacts or printed on a card, and if you genuinely believe someone may be in danger, alert the authorities.

The Buffalo mother was not unprepared because she was careless. Most families simply have not had this conversation yet. Five minutes is all it takes.

AI can clone a voice. It cannot fake knowing three codewords that change every 60 seconds.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.