How to Protect Your Family from AI Scams

Your phone rings at 11 PM. It's your daughter, sobbing, saying she's been in a car accident and needs $5,000 wired immediately for a lawyer. The voice is hers. The panic sounds real. But it's not her. A scammer built a clone of her voice from a 3-second clip pulled off her Instagram, and they're counting on you to act before you think.

This guide gives your family a complete plan: what these scams look like, why your ears can't be trusted, why a family codeword defeats them, and the exact steps to put protection in place tonight. It takes about ten minutes to read and less than an hour to act on.

Once you're set up, teach everyone the Three Words Check — our free five-step verification protocol for the moment a suspicious call or text arrives.

AI impersonation scams are not a future threat — they're a present-tense epidemic that specifically exploits family love and panic.

The playbook is always the same three moves, and knowing them is half the defense:

• Urgency. You must act right now — wire the money, buy the gift cards, before you have time to think or verify.
• Untraceable payment. Cash, gift cards, crypto, wire transfers. Never anything that can be reversed once it moves.
• Isolation. "Don't hang up. Don't call your husband. Don't contact the police." The scam only works while you're alone with the fear.

Grandparent scams, fake kidnapping calls, "Hey Mom, new number" texts — every variant runs on the same engine: a voice or message that sounds like family, plus pressure to act before you verify. Which is why the entire defense comes down to one question your family agrees on in advance.

AI can clone a voice. It can mimic a texting style. It can fake a video call. The one thing it cannot do is know a secret your family never shared publicly.

That's the whole trick. When a caller claims to be your son in trouble, you ask: "What are the words?" A real family member answers instantly. A scammer — no matter how perfect the cloned voice — has nothing to say. The conversation is over in three seconds.

Security researchers, elder-fraud specialists, and BBC Future's August 2026 feature "The secret codewords that scammers hate" all land on the same recommendation (read our take on the BBC piece): agree on a verification word before the call ever comes. It works because it moves the test away from the one thing AI fakes perfectly (how someone sounds) to the one thing it can't touch (what only your family knows).

One caveat matters: a single, fixed password has weaknesses. It can be overheard, guessed from your social media (pet names and birthdays are terrible codewords), or forgotten under stress — and once it leaks, it's compromised forever. That's why the strongest version of this plan uses rotating codewords that change automatically every 60 seconds. A leaked word expires before anyone can reuse it.

1Have the conversation tonight

Tell every member of your family — especially kids and older parents — that a voice alone is no longer proof of identity. Explain the three red flags: urgency, untraceable payment, isolation. Agree as a family: "If anyone ever calls claiming to be one of us in trouble, we ask for the words. No exceptions, no matter how real it sounds." A real emergency will never mind being verified.

2Set up rotating codewords with Trust Onion

You can start with a spoken family password, but rotating codewords are stronger — and free. Trust Onion works on iPhone and Android, takes about 60 seconds, and needs no account:

1. Download the app. Free on the App Store and Google Play. No subscription, no paywall.
2. Create your family group. Tap the + button, create a group (your last name works fine), or join one with an invite code or QR scan.
3. Invite your family. Share the invite code with your spouse, kids, and parents. Everyone who joins sees the same three words at the same time.

Once the group exists, every phone in the family displays the same three rotating words. They change automatically on a timer and are generated locally on each phone — no server, no cloud, no account. Trust Onion never sees your codewords because they never leave your device, and they keep working even with no internet connection.

3Practice the ask

When the call comes, your emotions will work against you — so pre-commit now. A text from an unknown number says "Hey Mom, I dropped my phone in the sink, this is my new number. Can you send $300?" You text back: "What are the three words?" If they can't answer, it's not your son. Run the drill once at dinner so it's muscle memory, not a decision you have to make mid-panic.

The codewords rotate on a timer, so even if a scammer somehow overheard yesterday's words, they've already expired. And because the words are calculated on each device with no server involved, there's no database to hack and no transmission to intercept.

4Escalate to a Proofie when the stakes are higher

Some scams hit harder than a text: a call from your "daughter" claiming she's been kidnapped, a video message from your "husband" stranded overseas. When money or safety is on the line, ask for a Proofie — a verified selfie that proves a real person took it, right now, on their actual phone. It carries the current codewords, a timestamp, GPS location, and a cryptographic signature locked to the sender's device biometrics.

Each family member's phone generates a unique Proof ID tied to their device and Face ID or fingerprint. Every Proofie is signed with it and checked automatically on arrival — a mismatch is rejected on the spot. You can't fake a Proofie with AI: the words rotate too fast to pre-generate one, the biometric signature can't be copied to another device, and the location shows where the sender actually is. Proofies go straight from their phone to yours; Trust Onion never stores or sees them.

5Know what to do if a scam gets through

If someone in your family is targeted: hang up and call the real person directly on a saved number. Never pay by gift card, wire, or cash courier. If money moved, call your bank immediately — minutes matter for reversals. Then report it: the FTC at reportfraud.ftc.gov and the FBI's Internet Crime Complaint Center at ic3.gov. Reports help investigators connect cases and protect other families.

---

What is a family codeword and why does it stop AI voice cloning scams?

A family codeword is a private word or phrase that only your family knows and agrees on in advance. When a caller claims to be a family member in trouble, you ask for the codeword. AI can clone a voice from a few seconds of audio, but it cannot know a secret your family never shared publicly. A wrong or missing answer reveals the scam immediately.

How much audio does a scammer need to clone a family member's voice?

Very little. Modern voice cloning tools can produce a convincing replica from as little as a few seconds of clear audio, and 20 to 30 seconds is more than enough for a clone most people cannot distinguish from the real person. A social media video, a voicemail greeting, or a school event recording is all a scammer needs.

Can I really not tell when a voice on the phone is AI?

Not reliably. Research puts human detection accuracy for AI-generated audio at only about 55 to 60 percent, barely better than a coin flip, and accuracy drops further under emotional stress. When you believe your child or parent is in danger, your brain fills in gaps and hears what it expects. That is why families need a verification plan that does not depend on ears.

What should a family codeword NOT be?

Avoid anything a scammer could find or guess: pet names, birthdays, street names, a favorite sports team, or anything posted on social media. Also avoid words your family will blurt out under pressure to a fake caller. Better still, use rotating codewords that change automatically every 60 seconds, so even a leaked word expires before it can be reused.

Is a rotating codeword better than a single fixed family password?

Yes. A single static password can be overheard, guessed, phished, or forgotten, and once it leaks it is compromised forever. Rotating codewords change every 60 seconds, so a leaked word is useless almost immediately. Trust Onion generates three rotating codewords locally on each family member's phone, with no server involved, so there is nothing to intercept or hack.

What should I do if my family is targeted by an AI voice scam?

Slow down, hang up, and call the real family member directly on the number you already have saved. Never pay with gift cards, wire transfers, or cash couriers. If money was lost, contact your bank immediately, then report the scam to the FTC at reportfraud.ftc.gov and the FBI's Internet Crime Complaint Center at ic3.gov. Reporting helps investigators connect cases.

Do older parents and grandparents need special protection?

Yes. Adults over 60 are the most heavily targeted group, with the FBI reporting nearly $5 billion in fraud losses in that age group in 2024 alone. Grandparent scams specifically exploit a grandchild's cloned voice. Set the plan up with older relatives in person, practice the ask-for-the-words habit together, and make sure they know a real emergency call will never mind being verified.

---

Set up your family's protection today

The whole plan takes about an hour: one dinner conversation, a 60-second app setup, and one practice run. Download Trust Onion, create your group, and share the code with your family — then do the same with your friends or your club. For the story behind the strategy, read why scammers hate secret codewords. The next time something feels off, you'll have a way to know for sure.