The Three Words Check

AI can clone a loved one's voice from a three-second clip. It can copy their texting style, their photo, even their face on a video call. What it cannot do is know a private secret that changes every few minutes and never leaves your family's phones.

The Three Words Check is a simple protocol built on that fact. Every member of your family, friend group, or club sees the same three rotating codewords on their phone. When any call, text, or message asks for money, passwords, or urgent action, you run the check — five steps, under a minute — before you act. The codewords come from Trust Onion, a free app for iPhone and Android with no account required, and the words are generated on each device so there is no server to hack and nothing to intercept.

The protocol works because it replaces the question scammers can beat — "does this sound like them?" — with one they can't: "do they know something only they could know right now?"

1Pause

Every impersonation scam runs on manufactured urgency: an accident, an arrest, a locked account, a deadline in minutes. Urgency is the tell, not a reason to hurry. Say "I'll call you right back" and hang up, or stop replying to the text. Nothing legitimate is lost by taking sixty seconds — a wire transfer or gift card, once sent, is usually gone for good.

2Ask

Ask the one question a clone can't answer: "What are the words?" Anyone genuinely in your group can open their app and read off the three current codewords. A scammer — even one with a perfect voice clone, your relative's photo, and a convincing story — cannot.

3Check

Open your own phone and compare. All three words must match the current rotation. "I don't have my phone," "the app isn't working," or two out of three is a fail. The words rotate on a timer, so even a codeword overheard yesterday has already expired.

4Escalate

When money, passwords, or someone's safety is on the line, go one layer deeper and ask for a Proofie — a verified selfie with the current codewords overlaid, a timestamp, location, and a cryptographic signature locked to the sender's device and biometrics. It can't be pre-generated, faked with AI, or sent from someone else's phone. The setup guide explains how Proofies work.

5Report

A failed check isn't the end — it's intelligence. Warn the rest of your group immediately so nobody else takes the same call. Block the number, then report the attempt to the FTC at reportfraud.ftc.gov and, if money was lost, to the FBI at ic3.gov. You can also see how these scams play out in our real case studies and news tracker.

• Trusting the voice or the photo. The whole reason the protocol exists is that voices, faces, and writing styles can now be faked convincingly. Verify knowledge, not sound.
• Skipping the check because "it's obviously them." The scams that succeed are the convincing ones. Run the check especially when it sounds exactly like your relative.
• Accepting a partial answer. Two words out of three, an old rotation, or "you know I'm bad with the app" all count as a fail. The protocol only works if a fail means stop.
• Letting urgency override the protocol. "There's no time" is the script every scammer uses. Real emergencies survive a sixty-second verification.
• Keeping a failed check to yourself. Scammers work through the whole family list. If you got the call, your parents are probably next — warn the group.
• Using a single static safe word. One fixed word can leak once and be reused forever. Rotating codewords expire on their own.

Verification only helps if it's remembered under pressure. Put the protocol where the pressure happens: on lock screens and next to landlines.

No protocol guarantees you won't be scammed, and we won't claim this one does. The Three Words Check is honest about its boundaries:

• It only covers people in your group. A fake call from "your bank," "the IRS," or "tech support" isn't an impersonation of a family member — for those, hang up and call the organization back on the number printed on your card or statement.
• It depends on everyone actually running the check. The protocol fails silently if one family member decides "this time it's really them" and skips it. Practice it once, out loud, when nothing is wrong.
• A phone in a scammer's hands is a real risk. If a phone is stolen and unlocked, its codewords are visible. That's what the Proofie escalation is for — its biometric signature doesn't transfer with the device.
• It can't recover money already sent. The protocol prevents; it doesn't undo. If money has moved, contact your bank immediately and file at ic3.gov — speed matters more than embarrassment.

• FBI Internet Crime Complaint Center (IC3), 2024 Internet Crime Report — reported fraud losses reached a record $16.6 billion in 2024, with adults over 60 losing nearly $5 billion, the most of any age group.
• FBI, Public Service Announcement I-120324-PSA — criminals use generative AI, including AI-generated audio of loved ones claiming a crisis, to commit fraud on a larger scale; the FBI itself recommends families "create a secret word or phrase" to verify identity.
• Federal Trade Commission, Scammers use AI to enhance their family emergency schemes — consumer alert on voice cloning in family-emergency scams and why calling back on a known number matters.
• Real incidents tracked on this site: AI scam case studies and voice clone scams in the news.

Set up the codewords in about 60 seconds

The protocol needs the codewords, and the codewords need the free app. Follow the family setup guide or the friends & club setup guide, then practice the check once at dinner — before anyone needs it for real.