# Trust Onion — Full machine-readable library > This document is generated from currently published rows on every request. Stable `.md` URLs and feeds are the canonical freshness mechanism. --- title: "Grandparent Scams: How AI Voice Cloning Supercharged an Old Con" published: 2026-09-17 updated: 2026-10-24T00:00:00.000Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/topics/grandparent-scams --- # Grandparent Scams: How AI Voice Cloning Supercharged an Old Con **Cite as:** Grandparent Scams: How AI Voice Cloning Supercharged an Old Con, Trust Onion, 2026-10-24. https://trustonion.io/topics/grandparent-scams The classic "Grandma, it's me — I'm in trouble" phone scam has been rebuilt around AI. Scammers now clone a grandchild's real voice from about 15 seconds of social media audio, call late at night, and manufacture an emergency that demands money immediately. This page explains exactly how the modern grandparent scam works, the tells that give it away, and the simple family verification habit that stops it cold. ## How the modern grandparent scam works 1. **Harvest.** Scammers pull a short voice sample of a grandchild from TikTok, Instagram, YouTube, or a voicemail greeting. About 15 seconds of audio can be enough for a convincing clone. 2. **Target.** They match the grandchild to grandparents using public records, obituaries, and social media family tags. 3. **The call.** Usually late at night. The cloned voice is crying or panicked — a car crash, an arrest, a hospital. Distress masks any imperfection in the clone. 4. **The handoff.** A second voice — a "lawyer," "officer," or "doctor" — takes over and gives payment instructions: wire transfer, gift cards, crypto, or a courier sent to the door. 5. **The secrecy demand.** "Don't tell Mom and Dad." Isolation is the scam's load-bearing wall. Any scammer who asks for secrecy is telling you what to do: check with the family. ## Warning signs specific to grandparent scams - The caller opens with **"It's me"** or **"It's your grandson"** and waits for you to supply the name. - **Urgency plus secrecy** — every legitimate emergency survives a five-minute callback; no real lawyer forbids you from calling the parents. - Payment methods a court or hospital would never use: **gift cards, wire transfers, crypto, or a courier picking up cash**. - The "grandchild" **can't stay on the line** — the clone works in short bursts, so an authority figure quickly takes over. - Caller ID that looks local or even shows the grandchild's number. **Spoofing is trivial; caller ID proves nothing.** ## The one question that defeats it AI can clone a voice. It cannot know a private codeword that your family set up in advance and rotates regularly. When any call claims to be family in trouble, ask: **"What are the words?"** A real grandchild answers instantly. A scammer stalls, deflects ("there's no time for that!"), or hangs up — and every one of those responses is your answer. Set the codewords up *before* you need them, practice once so the question feels natural under stress, and agree as a family that no money ever moves until the words check out. ## If the call already happened - **If you paid:** contact your bank or the gift-card issuer immediately — speed matters more than embarrassment. Report to the FTC at reportfraud.ftc.gov and file with the FBI's IC3. - **If you didn't pay:** still report it. Then hold a two-minute family meeting: agree on codewords, and agree that any "emergency" call gets verified before anything else happens. - **Tell the grandchild whose voice was used.** Their audio is in a scammer's toolkit now; the family on their other side should be warned too. ## Frequently asked questions ### How do scammers get my grandchild's voice? From public social media videos, voicemail greetings, or even a previous scam call where they recorded the grandchild speaking. Modern voice cloning can need only about 15 seconds of clear audio. ### The voice sounded exactly like my grandson. How is that possible? Consumer AI tools can now reproduce tone, accent, and speech habits from a short sample. Crying and panic in the call also hide small imperfections. You cannot rely on your ear — you need a verification step the AI can't fake, like a private family codeword. ### Should I just hang up and call my grandchild back? Yes — calling back on the number you already have for them is a solid backstop. Codewords are faster and work even when the grandchild can't pick up, but the rule is the same: never act on the incoming call alone. ### Are grandparent scams actually common? The FTC receives tens of thousands of family-emergency scam reports each year, and losses have grown sharply since voice cloning became cheap. The real number is higher — many victims never report out of embarrassment. ## Related guides - [How to Protect Your Family from AI Scams](https://trustonion.io/how-to-protect-your-family-from-AI-scams) — Step-by-step setup guide for family codeword protection. - [Voice Clone Scams in the News](https://trustonion.io/voice-clone-scams-in-the-news) — A continuously updated roundup of real reported incidents. ## Queries covered - grandparent scam - grandparent phone scam - grandma scam call - ai grandparent scam - grandson in jail scam - how to protect grandparents from phone scams **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Fake Kidnapping & Virtual Ransom Scams: The Cruelest AI Con" published: 2026-09-17 updated: 2026-09-17T00:00:00.000Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/topics/fake-kidnapping-scams --- # Fake Kidnapping & Virtual Ransom Scams: The Cruelest AI Con **Cite as:** Fake Kidnapping & Virtual Ransom Scams: The Cruelest AI Con, Trust Onion, 2026-09-17. https://trustonion.io/topics/fake-kidnapping-scams In a virtual kidnapping, nobody has been taken — but the phone call is engineered to make you believe otherwise. Scammers play an AI clone of your child screaming, then a "kidnapper" demands ransom before you can hang up or call anyone. The entire scam depends on keeping you on the line and panicked. Here is the script they follow and the pre-agreed family check that breaks it in seconds. ## The virtual kidnapping script, step by step 1. **The scream.** The call opens with a cloned voice — your child or spouse — crying or screaming their own name. It lasts seconds, just long enough to hijack your judgment. 2. **The takeover.** An aggressive "kidnapper" grabs the phone: *"We have your daughter. Do not hang up. Do not call anyone or she gets hurt."* 3. **The clock.** Everything is now, now, now. Ransom must be wired or sent by crypto within minutes. Some crews keep you on the line while you drive to a bank. 4. **The isolation.** You're ordered to stay on the call precisely so you can't do the one thing that instantly kills the scam: contact the "kidnapped" person. 5. **The amount drops.** Real kidnappers don't negotiate themselves down from $50,000 to $800 in ten minutes. Virtual ones do, because any payment is profit. ## Signs the kidnapping is fake - The call comes from an **unknown or out-of-area number** — real abductors using a victim's phone would show their number. - The callers **refuse to put the victim on the line** for a normal conversation or let you ask them anything specific. - **The ransom is payable by wire, gift cards, or crypto** — instruments chosen for speed and irreversibility, not for a real hostage exchange. - Demands to **stay on the line** and not contact anyone. This is the tell: their only leverage is preventing a 30-second verification. - The "victim" is usually someone whose schedule makes them briefly unreachable — traveling, in class, in a flight, at camp. ## What to do during the call 1. **Buy seconds, not minutes.** Say you need to get a pen, put the phone down — do not hang up if you're afraid to, just get a second device. 2. **Text or call the "kidnapped" person from another phone.** In most virtual kidnappings they answer, confused and perfectly safe. 3. **Ask for the family codewords.** A real family member can say them even under duress; a voice clone cannot. If the callers won't put the victim on or the words don't come, it's a scam. 4. **Never say your loved one's name first.** Don't hand the scammer information — make them prove everything. 5. **Call 911 once you've hung up** — even for a confirmed fake. Reports help police track the crews. ## Prepare your family before it happens Virtual kidnapping works because it targets you at your most unrehearsed. Rehearse once: - Set up **rotating family codewords** everyone can recall under stress. - Agree on the rule: **no money moves on any emergency call until identity is verified** — by codeword or by reaching the person directly. - Keep kids' and teens' locations shareable within the family so a second adult can check quickly. - Talk to teens about limiting public voice/video posts; short clips are the raw material for clones. ## Frequently asked questions ### The voice on the phone was definitely my daughter. Could it still be fake? Yes. A short clip of cloned, distressed audio is the core of this scam, and screams are especially easy to fake convincingly. Verify by contacting her directly on another device or asking for your family codewords — never by ear alone. ### Should I hang up on a possible kidnapping call? If you're able to, yes — then immediately call your loved one and 911. If fear keeps you on the line, use a second device to text or call the supposed victim while the scammer talks. Verification, not the phone call, tells you what's real. ### Do virtual kidnappers ever actually have the person? Virtually never — that's why it's called virtual kidnapping. The crews run volume operations from call lists and social media data. Genuine kidnappings for ransom of ordinary families are extraordinarily rare; panicked payment to strangers is the entire business model. ### What number do these calls come from? Usually spoofed numbers — sometimes appearing to be your own child's phone. Caller ID can be faked in either direction, so treat it as zero evidence. ## Related guides - [How to Protect Your Family from AI Scams](https://trustonion.io/how-to-protect-your-family-from-AI-scams) — Step-by-step setup guide for family codeword protection. - [Voice Clone Scams in the News](https://trustonion.io/voice-clone-scams-in-the-news) — A continuously updated roundup of real reported incidents. ## Queries covered - fake kidnapping scam - virtual kidnapping scam - kidnapping ransom call scam - ai kidnapping scam call - fake ransom call what to do **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Cloning Scams: How They Work and How to Beat Them" published: 2026-09-17 updated: 2026-10-24T00:00:00.000Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/topics/voice-cloning-scams --- # AI Voice Cloning Scams: How They Work and How to Beat Them **Cite as:** AI Voice Cloning Scams: How They Work and How to Beat Them, Trust Onion, 2026-10-24. https://trustonion.io/topics/voice-cloning-scams Voice cloning has collapsed from a research lab curiosity to a free phone app. Any voice with about 15 seconds of public audio — a TikTok, a voicemail greeting, a conference talk — can now be reproduced well enough to fool the people who know it best. This hub explains the technology in plain language, the scam patterns built on top of it, and the one defense that doesn't depend on your ears. ## How little audio a clone needs Modern voice models can make a convincing clone from **about 15 seconds** of reasonably clean audio ([NPR](https://www.npr.org/2024/04/04/1242933678/even-openai-says-its-new-voice-cloning-tool-has-major-potential-for-misuse)). Sources scammers actually use: - Social media videos and stories (the #1 source) - Voicemail greetings — scammers call just to record them - Podcasts, webinars, school events, local news interviews - Previous scam calls where the target spoke freely There is no meaningful way to keep a voice off the internet in 2026. Defense has to assume the clone already exists. ## The four scam patterns built on cloned voices - **Family emergency calls** — a child, grandchild, or spouse in sudden trouble needing money now. See our dedicated [grandparent scams](/grandparent-scams) and [fake kidnapping](/fake-kidnapping-scams) pages. - **Executive fraud** — a "CEO" or "CFO" calls or leaves voicemails authorizing urgent wire transfers. Corporate losses per incident run into the millions. - **Account takeover** — clones defeat voice-authentication systems at banks and carriers, or convince support agents to reset credentials. - **Trusted-contact requests** — a cloned friend or colleague asks for a small favor: a code you just received, a quick payment, a password. ## Why detection fails and verification wins You will read tips like "listen for robotic pauses" or "odd breathing." These worked in 2023. Current clones handle laughter, hesitation, and emotion, and phone-line compression erases the remaining artifacts. Deepfake-detection apps are in an arms race they are losing. The durable defense is **out-of-band verification** — proving identity through something the AI cannot generate: 1. **Private rotating codewords** shared in advance. Ask *"What are the words?"* — a clone can mimic a voice, not knowledge it never had. 2. **Callback on a known number**, never the number that just called you. 3. **A hard family/team rule:** no money, credentials, or codes move on the strength of a voice alone. ## Reduce your family's clone surface You can't eliminate voice exposure, but you can raise the cost: - Set social accounts of kids and teens to private; public video is the main harvesting ground. - Use the default robotic voicemail greeting instead of your own voice. - Don't answer unknown callers with a chatty *"Hello? Hello? Who is this?"* — that's a recording session. Say nothing or hang up. - Most importantly: set up codewords *before* the first suspicious call. Prevention configured in two minutes beats detection every time. ## Frequently asked questions ### Can AI really clone a voice from 15 seconds of audio? Yes. OpenAI has said its voice tool can recreate a voice from a 15-second sample, as NPR reported, and similar tools are widely available. The technology is free or nearly free and requires no technical skill. ### Can I tell a cloned voice from a real one? Not reliably. Studies show people often can't tell a cloned voice from a real one, and phone audio makes it harder. Assume you cannot, and verify identity with a codeword or a callback instead. ### Is voice cloning illegal? Using a cloned voice to commit fraud is illegal everywhere. The cloning itself sits in a legal gray zone that varies by state and country — which is why enforcement lags far behind the scams and personal verification habits matter. ### What should I do if my voice has been cloned? Warn the people most likely to be targeted with it — family first — and agree on codewords immediately. Report impersonation to the platform where the audio was posted and file a report at reportfraud.ftc.gov if it's used in a scam. ## Related guides - [How to Protect Your Family from AI Scams](https://trustonion.io/how-to-protect-your-family-from-AI-scams) — Step-by-step setup guide for family codeword protection. - [Protect Your Friends and Club from AI Scams](https://trustonion.io/protect-your-friends-and-club-from-AI-scams) — Set up codeword verification for friend groups, teams, and clubs. - [Voice Clone Scams in the News](https://trustonion.io/voice-clone-scams-in-the-news) — A continuously updated roundup of real reported incidents. ## Queries covered - ai voice cloning scam - voice cloning scam calls - how do voice cloning scams work - can ai clone my voice - voice clone fraud protection **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Impersonation: Preventing Fake Calls, Texts, and Video" published: 2026-09-17 updated: 2026-09-17T00:00:00.000Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/topics/impersonation-prevention --- # AI Impersonation: Preventing Fake Calls, Texts, and Video **Cite as:** AI Impersonation: Preventing Fake Calls, Texts, and Video, Trust Onion, 2026-09-17. https://trustonion.io/topics/impersonation-prevention Voice is only one channel. Scammers now impersonate the people you trust over text messages, emails, and even live video calls with deepfaked faces. Each channel has its own tells, but chasing channel-specific tricks is a losing game — the durable defense is one verification habit that works everywhere. This hub covers the full impersonation landscape and how to close it off. ## The three impersonation channels - **Voice:** cloned calls and voicemails. Covered in depth on our [voice cloning scams](/voice-cloning-scams) hub. - **Text:** "Hi Mom, I broke my phone — this is my new number" messages, spoofed sender IDs, and AI-written messages that copy a person's texting style from leaked chat history. - **Video:** live deepfake video calls. Corporate cases have already lost tens of millions to conference calls where every participant except the victim was synthetic. The common thread: every channel carries an **identity claim you cannot verify through the channel itself**. ## Text impersonation: the highest-volume attack The "new number" text is the workhorse of family impersonation because it needs no voice sample at all: 1. A message arrives from an unknown number claiming to be your child/parent with a broken or lost phone. 2. Small talk builds trust for a day or two. 3. Then the ask: help with a bill, a bank issue, a payment app transfer. Defenses: **contact the person on their original number** (a lost phone doesn't disconnect a phone number from its owner instantly, and other family members can confirm), and ask for the **codewords over text** — knowledge verification works in every channel. ## Video deepfakes: seeing is no longer believing Live face-swap tools can now run inside a video call. Warning signs still worth knowing — lighting that doesn't match the room, edges shimmering when the head turns fast, lip-sync drifting on plosive sounds — but treat them like voice tells: helpful, not sufficient. For any video call that ends in a request for money, credentials, or secrecy: 1. Ask the person to **turn their head fully sideways** and pass a hand in front of their face — current real-time swaps still break on occlusion. 2. Better: **ask for the codewords.** A deepfake renders a face; it doesn't know your shared secret. 3. Confirm big requests on a second channel you initiate. ## One habit that closes every channel Channel-specific tricks age fast. What doesn't age: - **Shared rotating codewords** with the people who might ever be impersonated to you — family, close friends, teammates. Works over voice, text, and video alike. - **You initiate the verification.** Trust contact info you already had, never details supplied inside the suspicious conversation. - **The no-exceptions rule:** urgency + secrecy + money = verify first, always. Legitimate people accept a two-minute check; scammers can't survive one. ## Frequently asked questions ### How can I tell if a text is really from my family member? Don't judge the writing style — AI copies it well. Verify out-of-band: call their original number, check with another family member, or ask for your family's codewords in the chat. A real relative answers instantly; an impersonator stalls or dodges. ### Can a live video call be faked? Yes. Real-time face-swapping tools work inside ordinary video-call apps, and multi-person deepfake conference calls have defrauded companies of tens of millions. Treat video as no more trustworthy than a phone call when money or credentials are requested. ### What's the difference between spoofing and impersonation? Spoofing fakes the technical envelope — the caller ID or sender number. Impersonation fakes the human — voice, face, or writing style. Modern scams combine both, which is why neither caller ID nor your senses are reliable verification. ### Do codewords work for businesses and teams too? Yes — executive impersonation and CEO fraud follow the same playbook as family scams. Teams can use shared verification words or mandatory callback procedures for any payment or credential request, no matter how senior the requester appears. ## Related guides - [How to Protect Your Family from AI Scams](https://trustonion.io/how-to-protect-your-family-from-AI-scams) — Step-by-step setup guide for family codeword protection. - [Protect Your Friends and Club from AI Scams](https://trustonion.io/protect-your-friends-and-club-from-AI-scams) — Set up codeword verification for friend groups, teams, and clubs. - [Voice Clone Scams in the News](https://trustonion.io/voice-clone-scams-in-the-news) — A continuously updated roundup of real reported incidents. ## Queries covered - ai impersonation scam - text message impersonation scam - hi mom scam text - deepfake video call scam - how to prevent impersonation scams - executive impersonation fraud **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Family Safe Word vs. Rotating Codewords: Why Static Words Fail Against AI Scams" published: 2026-09-17 updated: 2026-10-11T00:00:00.000Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/topics/family-codewords --- # Family Safe Word vs. Rotating Codewords: Why Static Words Fail Against AI Scams **Cite as:** Family Safe Word vs. Rotating Codewords: Why Static Words Fail Against AI Scams, Trust Onion, 2026-10-11. https://trustonion.io/topics/family-codewords Every scam on this site — cloned voices, fake kidnappings, "new number" texts, deepfake video calls — fails against the same defense: a private codeword the scammer cannot know. Most advice stops at "pick a family safe word." That is a good start, but a static word has weak points that rotating codewords remove. This page explains the difference, how to choose and practice codewords, and how to use them when a call has your heart pounding. ## Why codewords beat every AI impersonation AI attacks what can be *observed and copied*: your voice, your face, your writing style. A codeword is different in kind — it's **shared private knowledge** that never appears in any public data an AI could train on. That's why one question — **"What are the words?"** — resolves any suspicious contact in seconds, across every channel. The genuine person answers without thinking. The impersonator has exactly three moves: stall, deflect, or hang up. All three are confessions. ## Static family safe word vs. rotating codewords A single family safe word is far better than nothing, and the FBI recommends agreeing on one. But a word that never changes has four predictable failure points: - **Leaked.** It gets typed into a family group chat, a note on a phone, or an email. One compromised account or forwarded screenshot exposes it. - **Overheard.** It gets said out loud on a bus, in a shop, or on a call someone else can hear. A static word that is heard once can be reused for years. - **Forgotten.** Under stress, people blank on a word they chose months ago and have never used. A grandparent who can't recall it may skip the check altogether. - **Socially engineered.** A scammer chats up a child, poses as a teacher, or runs a "security quiz" until someone says it. Once they have it, nobody can tell. **Rotating codewords fix each of these.** Trust Onion shows everyone in your group the same three words, and all three rotate every 60 seconds. They are calculated locally on each device, with no server and no message carrying them, and they keep working offline. - A word that leaks or is overheard has already expired by the time anyone tries to reuse it. - Nobody has to remember anything: the caller opens the app and reads the current words. - A child tricked into revealing the words gives away something that is useless a minute later. - There is no stored list to steal, because the words are never sent or kept on a server. | | Static family safe word | Trust Onion rotating codewords | |---|---|---| | How long a leaked word works | Until you notice and change it | Under 60 seconds | | Overheard in public | Reusable indefinitely | Already expired | | Memory under stress | Must be recalled from months ago | Read from the app | | Social engineering | One slip compromises it | The slip expires within a minute | | Where it lives | People's heads, chats, notes | Calculated on each phone, never sent | | Cost | Free | Free | The rule for using either one is the same: **the caller gives the words first.** The person receiving the call compares them privately and never reads out or hints at their own words to someone who has not yet passed the check. ## Choosing codewords that work under stress If you are starting with a spoken safe word, or want a backup for relatives without a smartphone: - **Use words, plural.** Three words are dramatically harder to guess or socially engineer than one, and still easy to recall. - **Avoid the guessable:** pet names, street names, birthdays, favorite teams — anything visible on social media is not a secret. - **Make them sayable by a scared 8-year-old and a stressed 80-year-old.** Vivid, concrete, slightly absurd words stick: *pickle — trombone — Saturn* beats any password-style string. - **Don't rely on a word that never changes.** Words shared over months of calls and texts slowly leak. Trust Onion removes the problem: its three words rotate every 60 seconds, so no single word stays useful long enough to become a skeleton key. - **Never confirm or deny a guess.** If a caller offers wrong words, don't correct them — end the call and check in through a channel you initiate. ## Getting your whole family on board The system only works if the most scam-targeted family members actually use it. What works: 1. **Frame it as protecting *you*, not doubting *them*.** "If someone fakes my voice, this is how you'll know it's really me." 2. **Practice one round.** Have a family member call and ask the question. Thirty seconds of rehearsal makes the real moment automatic instead of awkward. 3. **Set the money rule together:** no transfers, gift cards, or account codes move on any emergency request until the words check out — no matter how real it sounds. 4. **Include the periphery.** Grandparents, teens with public social accounts, and the relative who answers every unknown number are the primary targets — start with them. ## Using codewords in the moment When a call, text, or video chat makes an urgent request: 1. **Pause.** Urgency is the scam's fuel. One breath. 2. **Ask: "What are the words?"** Say nothing else — don't read out your own words, and don't volunteer names, places, or hints. 3. **All three current words, instantly → proceed.** Anything else — stalling, anger, "there's no time", two out of three — treat as a failed check. 4. **On a failed check, hang up and reach the person directly** on contact info you already had. 5. **Tell the family.** A failed verification means someone is actively targeting your circle; the next call may go to a less-prepared relative. ## Frequently asked questions ### What is a family codeword? A private word — ideally a set of words — that family members agree on in advance and use to verify identity when a call, text, or video chat makes an unusual or urgent request. AI can clone a voice but cannot know a secret it was never exposed to. ### Is a family safe word enough? It is a good start, but a single static safe word can leak through a chat, be overheard, be forgotten under stress, or be talked out of a child, and once it is out it keeps working for the scammer. Rotating codewords close that gap. Trust Onion's three words change every 60 seconds and are calculated on each phone, so a leaked or overheard word has already expired. ### How is this different from a password? It's spoken, human-memorable, and used between people rather than with a website. Good codewords are everyday words a child or grandparent can say under stress — not character strings. With Trust Onion nobody has to memorize them: the three words rotate every 60 seconds and the caller reads the current ones from the app. ### What if a family member forgets the words in a real emergency? Fall back to the second verification layer: hang up and call them back on their known number, or verify through another family member. Forgetting the words fails safe — it costs a minute, not your savings. That's the point of the system. ### Why do Trust Onion codewords rotate every 60 seconds? Because a word that never changes can leak — overheard, mentioned in a compromised chat, or socially engineered out of a child — and keep working for whoever learned it. Rotating every 60 seconds means a leaked word has expired before it can be reused, and automatic rotation removes the need for anyone to remember to change it. ## Related guides - [How to Protect Your Family from AI Scams](https://trustonion.io/how-to-protect-your-family-from-AI-scams) — Step-by-step setup guide for family codeword protection. - [Protect Your Friends and Club from AI Scams](https://trustonion.io/protect-your-friends-and-club-from-AI-scams) — Set up codeword verification for friend groups, teams, and clubs. ## Queries covered - family code word - family codeword for scams - family safe word scam protection - code word to stop ai scams - how to set up a family password - family safe word vs rotating codewords - is a family safe word enough - rotating codewords - static safe word vs rotating code words **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Client Identity Verification for Wealth Management Firms" published: 2026-09-17 updated: 2026-10-24 author: "Trust Onion Editorial Team" canonical: https://trustonion.io/industries/wealth-management --- # Client Identity Verification for Wealth Management Firms **Cite as:** Client Identity Verification for Wealth Management Firms, Trust Onion, 2026-10-24. https://trustonion.io/industries/wealth-management Client identity verification for wealth management firms. Voices, faces and inboxes can now be faked on both ends of a call: attackers pose as clients to move money, and as the firm to get clients to share access or approve transfers. Trust Onion gives a wealth management firm a verification app branded as the firm. Advisers and clients in a trusted group see the same three codewords, generated locally on their devices. All three rotate every 60 seconds, even offline. The caller gives all three current words first; the recipient checks them privately and never reveals the words to an unverified caller. It works both ways: when a client calls, the advisor checks the words; when the firm calls a client, the advisor gives the words and the client checks them before acting. Read the full page: https://trustonion.io/industries/wealth-management --- title: "Customer Identity Verification for Banks" published: 2026-10-24 updated: 2026-10-24 author: "Trust Onion Editorial Team" canonical: https://trustonion.io/industries/banks --- # Customer Identity Verification for Banks **Cite as:** Customer Identity Verification for Banks, Trust Onion, 2026-10-24. https://trustonion.io/industries/banks Customer identity verification for banks. Fraudsters pose as the bank to its customers, and as customers to the bank, and a cloned voice, a spoofed number or a stolen inbox can pass the checks staff rely on. Trust Onion gives a bank a two-way human identification tool under its own brand: an app in the bank's name, published under the bank's own App Store and Google Play accounts. A customer and the bank's staff see the same three codewords, generated locally on their devices. All three rotate every 60 seconds, even offline. The caller gives all three current words first; the recipient checks them privately and never reveals the words to an unverified caller. For doubtful requests, staff can ask for a Proofie™, a live selfie signed by the customer's passkey. Because the app carries the bank's own name, customers can tell a real call from the bank apart from an impostor, instead of being asked to trust a third-party consumer app. Read the full page: https://trustonion.io/industries/banks --- title: "Identity Verification for Registered Investment Advisers" published: 2026-10-28 updated: 2026-10-28 author: "Trust Onion Editorial Team" canonical: https://trustonion.io/industries/registered-investment-advisers --- # Identity Verification for Registered Investment Advisers **Cite as:** Identity Verification for Registered Investment Advisers, Trust Onion, 2026-10-28. https://trustonion.io/industries/registered-investment-advisers Identity verification for registered investment advisers. Cloned voices and hijacked inboxes let criminals pass the checks advisers rely on, and the request reaches your team sounding exactly like your client. Trust Onion puts identity verification in an app branded as your firm. The firm and the client share three codewords that rotate every 60 seconds. When the client calls, your adviser asks "What are the words?" and checks the answer before acting. A voice clone can copy how the client sounds, but not the three words on their phone. For doubtful requests, a Proofie™, a live selfie signed by the client's passkey, adds proof. It works both ways: clients can verify your firm, too. Nothing replaces your callback, your dual approval or your custodian's own checks. Read the full page: https://trustonion.io/industries/registered-investment-advisers --- title: "How to Protect Your Family from AI Scams" published: 2026-09-17 updated: 2026-10-11T00:00:00.000Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/how-to-protect-your-family-from-AI-scams --- # How to Protect Your Family from AI Scams **Cite as:** How to Protect Your Family from AI Scams, Trust Onion, 2026-10-11. https://trustonion.io/how-to-protect-your-family-from-AI-scams AI voice cloning and impersonation scams work by creating urgency before a family has time to verify who is contacting them. ## The family protection plan 1. Set three private family codewords and agree that they are never shared publicly. 2. Ask **"What are the words?"** before money, credentials, or secrets move. 3. Call back using a number already saved in your contacts, not a number supplied by the suspicious caller. 4. Make a family rule that urgency and secrecy are reasons to verify, not reasons to skip verification. 5. Report attempted fraud and contact the bank or payment provider immediately if money was sent. ## Why this works A cloned voice, text style, or video face can imitate what an attacker observes. A private rotating codeword is knowledge the attacker does not have. Trust Onion's three codewords rotate every 60 seconds, so a static safe word's weak points (leaks, overhearing, forgetting) don't carry over. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "How to Protect Your Friends and Club from AI Scams" published: 2026-09-17 updated: 2026-10-11T00:00:00.000Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/protect-your-friends-and-club-from-AI-scams --- # How to Protect Your Friends and Club from AI Scams **Cite as:** How to Protect Your Friends and Club from AI Scams, Trust Onion, 2026-10-11. https://trustonion.io/protect-your-friends-and-club-from-AI-scams Friend groups, sports clubs, volunteer teams, and workplaces can use the same out-of-band verification habit as a family. ## Set up a team verification rule Choose private words known only to the group, decide who can approve urgent requests, and require a callback or codeword check before sending money, access codes, or sensitive files. ## Use the rule across every channel The check works for voice calls, text messages, email, and video meetings. Caller ID, a familiar writing style, and a convincing face are not proof of identity. --- title: "The Three Words Check — Verification Protocol for AI Voice Clone Scams" published: 2026-09-17 updated: 2026-10-11T00:00:00.000Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/family-verification-protocol --- # The Three Words Check — Verification Protocol for AI Voice Clone Scams **Cite as:** The Three Words Check — Verification Protocol for AI Voice Clone Scams, Trust Onion, 2026-10-11. https://trustonion.io/family-verification-protocol The Three Words Check is a five-step family protocol for calls and messages that feel urgent, secret, or financially risky. ## The five steps 1. **Pause.** Do not let the caller's urgency choose your next action. 2. **Ask:** "What are the words?" 3. **Do not provide hints.** A genuine family member should know the words without coaching. 4. **If the check fails, stop the transaction and contact the person through a known channel.** 5. **Report the attempt and update the family rule if needed.** The caller gives the words first; the person receiving the call compares them privately and never reveals their own words to an unverified caller. A single static family safe word can leak, be overheard, or be forgotten, and keeps working for whoever learns it. Trust Onion's three codewords rotate every 60 seconds and are calculated locally on each device, so an overheard word has already expired. Compare the two approaches: https://trustonion.io/topics/family-codewords **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Voice Clone Scam Pulse Methodology & Corrections" published: 2026-09-17 updated: 2026-09-17 author: "Trust Onion Editorial Team" canonical: https://trustonion.io/voice-clone-scam-pulse/methodology --- # Voice Clone Scam Pulse Methodology & Corrections **Cite as:** Voice Clone Scam Pulse Methodology & Corrections, Trust Onion, 2026-09-17. https://trustonion.io/voice-clone-scam-pulse/methodology Voice Clone Scam Pulse includes verified, published case studies with source attribution and structured incident fields. Dates, locations, losses, and attack methods reflect the source reporting. Unknown values remain unknown rather than being guessed. Aggregate USD totals include only explicitly disclosed USD losses; other currencies are shown verbatim and never converted. Corrections are documented on the editorial standards page. --- title: "Voice Clone Scam Pulse Facts" published: 2026-11-01T12:41:44.148Z updated: 2026-11-01T12:41:44.148Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/voice-clone-scam-pulse --- # Voice Clone Scam Pulse Facts **Cite as:** Voice Clone Scam Pulse Facts, Trust Onion, 2026-11-01. https://trustonion.io/voice-clone-scam-pulse Voice Clone Scam Pulse currently contains 35 verified incidents across 5 countries. The database includes 6 prevented incidents and 6 incidents with explicitly disclosed USD losses totaling $890,670. Only published case studies that pass the source-attribution quality gate enter the public database. Other currencies and unknown losses are not converted or guessed. --- title: "O2 Blocks 3 Million Scam Calls a Week. The Rest Still Get Through." published: 2026-11-02T00:05:03.566Z updated: 2026-11-02T00:05:03.656Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/o2-hiya-ai-scam-call-blocking-three-million-weekly --- # O2 Blocks 3 Million Scam Calls a Week. The Rest Still Get Through. **Cite as:** O2 Blocks 3 Million Scam Calls a Week. The Rest Still Get Through., Trust Onion, 2026-11-02. https://trustonion.io/blog/o2-hiya-ai-scam-call-blocking-three-million-weekly Since 2024, O2's Hiya-powered system has flagged more than 1.6 billion suspected scam and spam calls on its UK network. That number tells you how large the problem is, not how much of it is solved. The scale is real. O2, now part of Virgin Media, has rolled out a free AI-assisted fraud call blocking service to all its UK customers, built on technology from voice security company Hiya. According to The Fast Mode's January 2026 report, the system monitors the network in real time, refines its detection based on customer reports and call behaviour analysis, and is expected to stop more than 3 million fraudulent calls every week before they reach a phone. That is a serious piece of infrastructure. And it still leaves a gap that matters. Network-level filtering catches calls that match known patterns: numbers on blocklists, traffic that behaves like a dialler, signatures Hiya has already seen and catalogued. What it cannot catch is a targeted call from a number that looks clean. A scammer who researches a specific household, or a fraudster running a voice-cloned impersonation of a colleague to authorise a wire transfer, does not look like bulk spam traffic. Those calls arrive sounding personal, urgent, and entirely plausible. ## The Calls That Get Through AI can clone a voice from about 15 seconds of audio, according to NPR's April 2024 reporting on voice synthesis tools. A call that mimics a CFO asking a finance officer to approve an urgent vendor payment, or a grandparent hearing what sounds like a grandchild stranded abroad, does not trigger a spam filter. It sounds like someone they know, and studies show people often cannot tell a cloned voice from a real one. That is the gap network blocking does not close. For families, the question worth asking is not only whether a call was blocked, but what to do when one gets through and sounds real. A three-word check gives everyone a practical way to handle that moment: if someone calls claiming to be a family member in trouble, ask for the family's three rotating codewords. A cloned voice cannot know words it never heard, and because they change every 60 seconds, an overheard word expires before it can be used. ## The Same Problem in a Finance Context Security and finance teams face an equivalent version of this. A call from a number that belongs to the CEO, arriving in business hours with a familiar voice, sits well outside what a carrier-level spam filter is designed to catch. The same principle applies: a shared three-word challenge between the executive and the approver gives the person receiving the request a way to check before any funds move. If they cannot give the words, treat the request as unverified, hang up, and call back on a number you already know. A failed callback does not prove the original caller was legitimate; the caller must still provide the team's private codewords. --- O2's 3-million-calls-a-week figure is not a reason to feel complacent. It is a measure of the volume that makes it worthwhile to think past the filter. The calls worth worrying about are not the ones that look like spam. They are the ones that sound like someone you trust. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - O2's Hiya-powered AI blocks over 3 million scam calls per week, but targeted impersonation calls can still get through network-level filters. - AI can clone a voice from about 15 seconds of audio, making voice verification alone unreliable for both families and finance teams. - A three-word rotating codeword check gives people a practical way to verify a caller that no network filter can provide. ## Frequently asked questions ### How does O2's AI scam call blocking work? O2 uses Hiya-powered AI to monitor network traffic in real time, flagging calls that match known scam patterns. The system refines its detection using customer reports and call behaviour analysis, and is expected to block more than 3 million fraudulent calls per week. ### Can AI call blocking stop voice cloning scams? Network-level filters catch bulk and pattern-matched spam but are not designed to detect targeted AI voice-cloning calls. A caller impersonating a known person from a clean number can still get through, which is why a separate identity check matters. ### How can families verify a caller is really who they say they are? Shared rotating codewords give families a way to check. If someone calls claiming to be a family member, ask for the family's private codewords. If they cannot give them, treat the call as unverified and call back on a number you already know. ### How can finance teams protect against executive impersonation calls? A three-word rotating challenge shared between an executive and the approver gives teams a practical check before acting on urgent requests. If the caller cannot provide the words, hang up and verify through an independently sourced contact method. ### Is O2's scam call blocking service free? Yes. According to The Fast Mode's January 2026 report, O2 has rolled out the Hiya-powered fraud call blocking service free of charge to all its UK customers. ## More from Trust Onion See how Trust Onion gives families and finance teams a practical way to verify identity with three rotating codewords, free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "The Scambaiter Who Makes AI Bots Bankrupt Each Other" published: 2026-10-30T00:05:02.346Z updated: 2026-10-30T00:05:02.519Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/scambaiter-kitboga-ai-bots-bankrupt-each-other --- # The Scambaiter Who Makes AI Bots Bankrupt Each Other **Cite as:** The Scambaiter Who Makes AI Bots Bankrupt Each Other, Trust Onion, 2026-10-30. https://trustonion.io/blog/scambaiter-kitboga-ai-bots-bankrupt-each-other A scambaiter named Kitboga found a way to make AI phone scam bots talk to each other until the scammers run out of money, one costly token at a time. Every response an AI scam bot generates costs the scammer real money in compute tokens. Kitboga, a well-known scambaiter, figured out that if you patch two of those bots together on a live call, they will happily deceive each other in an endless loop, and the meter keeps running on the scammer's bill. The tactic, covered by Boing Boing on October 29, 2026, is as elegant as it is absurd. AI-powered call centers have replaced the old model of hiring rooms full of people to cold-call potential victims. The AI agents are cheap to run at scale, but not free. Each conversational turn costs tokens, and Kitboga's merge trick turns that cost structure against the operation itself. These are no longer one-person operations running a script from a kitchen table. They are automated systems built on the same large-language-model technology that powers legitimate business tools, optimized to sound credible and keep a target on the line long enough to hand over money or account access. ## The Voice Is the Trap AI scam calls work because the voice sounds right. It can answer follow-up questions, adapt to objections, and stay calm under pressure. Caller ID can be spoofed to show a bank name or a number you recognize. A familiar tone is not proof of anything, and neither is a number on your screen. That gap is what a private three-word challenge closes. Trust Onion gives anyone a simple way to verify a caller who claims to be their bank, a government agency, or someone they know personally. The caller either knows the current words or they do not, and no AI agent patched in from a scam call center will know them. ## What Kitboga's Trick Reveals The merge technique works because the bots have no way to detect they are talking to each other rather than a human. That same blind spot is worth keeping in mind from the other direction. When an AI scam bot calls you, it has no idea what private information you and your bank or your family have agreed on in advance. If a caller claims urgency, whether it is a frozen account, a suspicious charge, or a relative in trouble, slow down. Hang up and call back on a number from your card, your bank's official app, or an independently sourced contact. A successful callback does not prove the original caller was legitimate either; if someone claiming to be a person you know called you, they still need to know your private Trust Onion three words before you act on anything they asked. Kitboga's bots drained each other's budgets because neither one could produce a secret the other was holding. The scam call that hits your phone operates on exactly the same weakness. The best counter-tactic available to an ordinary person is quieter than merging two bots together, but it ends the call just as fast. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - AI-powered scam call centers charge real money per token, and scambaiter Kitboga exploits that by making two bots drain each other's budgets. - A convincing voice and a spoofed caller ID are not proof of identity, no matter how legitimate the call sounds. - A private challenge that only the real caller can answer, like Trust Onion's three rotating codewords, stops AI scam calls that a human voice alone cannot. ## Frequently asked questions ### How does Kitboga make AI scam bots bankrupt each other? By merging two live AI scam calls together, the bots talk to each other in a loop. Every response costs the scammer tokens, so the bots keep running up the bill until the operation runs out of budget. ### Can AI phone scammers fake any voice or caller ID? Yes. AI can clone voices to sound like a bank representative or someone you know, and caller ID can be spoofed to show a familiar number or name. Neither is reliable proof of who is actually calling. ### How can I verify a phone call is really from my bank or someone I trust? Hang up and call back using a number from your card, statement, or the institution's official app. For people you know personally, a shared private challenge like Trust Onion's three rotating codewords adds a check no AI caller can fake. ### What is Trust Onion and how does it stop AI scam calls? Trust Onion is a free app that gives you three private codewords that rotate every 60 seconds. Anyone claiming to be someone you know or a trusted contact must supply the current words, which no scam bot can know. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords, free to use, and no AI agent will ever know them. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Can Clone Your Grandchild's Voice. It Can't Know the Words." published: 2026-10-29T00:08:54.740Z updated: 2026-10-29T00:08:54.838Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-grandparent-scam-voice-cloning-family-code-word --- # AI Can Clone Your Grandchild's Voice. It Can't Know the Words. **Cite as:** AI Can Clone Your Grandchild's Voice. It Can't Know the Words., Trust Onion, 2026-10-29. https://trustonion.io/blog/ai-grandparent-scam-voice-cloning-family-code-word A mother spent five hours on the phone believing she was helping her daughter, then wired $5,400 to strangers. The voice on the line was not her daughter at all. The call came with urgency and tears. A voice that sounded exactly like her daughter told her there had been an accident, that she was in trouble, that she needed money right away, and please, please don't tell anyone. Convinced by every inflection and every sob, the mother did what any parent would do. She wired the money. The Northern Kentucky Tribune reported the case in October 2026, citing a warning from Coveron about how the classic grandparent scam has been transformed by AI voice cloning tools that are cheap, fast, and widely available. The grandparent scam has existed for decades. A caller pretends to be a grandchild or family member in crisis, an arrest, a car accident, a hospital stay, and asks for immediate cash. What has changed is the voice. Scammers can now clone a real person's voice from a short audio sample pulled from social media, a voicemail, or a public video. The result sounds like the real person, not a vague approximation but a genuine match in tone, pace, and feeling. Coveron's warning points to two signals that should make anyone pause: urgency and secrecy. Scammers push hard on both because stopping to verify is the one thing that breaks the con. The fabricated emergency creates panic. The plea to keep it quiet cuts off the natural instinct to call another family member and ask whether any of this is real. ## What Experts Recommend Coveron and others advising on this scam suggest hanging up and calling the family member back on a number you already have saved. That step matters and is worth taking. A callback alone does not prove the original caller was fake, though. If someone calls again claiming the situation has changed, the person on the line still needs to know your family's private codewords before you do anything. That is where a shared set of family codewords becomes useful. Trust Onion lets families set three rotating codewords that change every 60 seconds, calculated on each person's phone with no server involved. When an unexpected call arrives claiming to be a grandchild in trouble, any family member can pause and ask: what are the words? A real grandchild knows them. A cloned voice does not. ## The Red Flags to Know Experts consistently point to the same pattern. The caller says it is an emergency. The caller says not to tell anyone. The caller says to move fast. Real family members in real trouble do not ask you to keep a crisis secret from the rest of the family. That combination of pressure and secrecy is the scam working as designed. If you are not sure and someone may genuinely be in danger, contact local authorities. Do not send money, gift cards, or wire transfers before speaking to another family member through a number you trust. Treat any caller who resists a verification question as a red flag, not a reason to hurry. The five hours that mother spent on the phone represent five hours in which one question could have ended everything. Asking for the words takes three seconds. The answer either comes or it does not. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - AI voice cloning lets scammers fake a family member's voice convincingly enough to fool a parent for hours. - Urgency and secrecy are the scam's two main weapons; treat either one as a reason to slow down and verify. - A family codeword that changes every 60 seconds is something a cloned voice can never know. ## Frequently asked questions ### How do scammers clone a family member's voice? They use AI tools that require only a short audio sample, often pulled from social media videos or public posts. The resulting clone can match tone, pace, and emotional sound closely enough to fool close relatives. ### What should I do if I get a call from a family member claiming to be in trouble? Pause before acting. Ask for your family's shared codewords, then hang up and call the family member back on a number you already have saved. A failed callback does not prove the original caller was real; the caller still needs to know your private words. ### What is a family code word and how does it stop this scam? A family code word is a private word or phrase that only real family members know. Trust Onion uses three rotating codewords that change every 60 seconds. A scammer with a cloned voice has no way to know them. ### How much money do grandparent scams typically take? Losses vary widely. The case reported by the Northern Kentucky Tribune in October 2026 involved a single victim who wired $5,400 after a five-hour call. Nationally, losses from grandparent and impersonation scams total hundreds of millions of dollars each year. ### What are the warning signs of an AI voice cloning scam? The main red flags are urgency, a request for secrecy, and pressure to send money quickly by wire or gift card. Real family emergencies do not require you to hide the situation from other relatives. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Set up your family's free Trust Onion account at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "A $40,000 Jury Duty Scam That Targeted a Gresham Grandfather" published: 2026-10-29T00:03:11.659Z updated: 2026-10-29T00:03:11.758Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/gresham-man-loses-40000-jury-duty-scam-multnomah-county --- # A $40,000 Jury Duty Scam That Targeted a Gresham Grandfather **Cite as:** A $40,000 Jury Duty Scam That Targeted a Gresham Grandfather, Trust Onion, 2026-10-29. https://trustonion.io/blog/gresham-man-loses-40000-jury-duty-scam-multnomah-county A 79-year-old man in Gresham, Oregon got a voicemail from someone calling himself 'Lieutenant White' of the Multnomah County Sheriff's Office, and within days he had withdrawn $40,000 in cash and fed it into a Bitcoin machine at a Southeast Portland convenience store. The voicemail said he had missed jury duty. An arrest warrant had been issued. The only way to make it go away was to pay a fine, immediately, over the phone. The caller knew enough to sound official, and the threat of handcuffs is a powerful thing to hold over anyone. This is the script behind a scam the Multnomah County Sheriff's Office warned the public about after the October 2026 incident. The victim made two separate $20,000 cash withdrawals, driving to a convenience store each time to deposit the bills into a Bitcoin machine. Real law enforcement, the Sheriff's Office noted plainly, will never demand payment over the phone to resolve a warrant or avoid arrest. The scam works because it skips the parts where doubt usually lives. There is no face, no badge to examine, no lobby to sit in. There is only a voice on a recording, a title, and a deadline. Older adults are targeted because they tend to take institutions seriously, and a call from a sheriff carries weight that a call from a stranger does not. ## How the pressure is built Scammers posing as law enforcement follow a reliable script. They name a real agency, invent a specific officer's name, cite a believable infraction like missed jury duty, and then move fast. Speed is the tool. Every minute the victim spends waiting is a minute they might use to call a family member or look up the real number for the Sheriff's Office. The $40,000 was gone before any of that happened. If you get a call like this, hang up and call the agency back using a number you find independently, from the official website or a phone book, not a number the caller provides. A scammer can set up a fake callback line, so use only a number you source yourself, and tell a family member what happened before you do anything else. ## What a family can do right now The most useful thing a family can put in place is a simple shared secret. Trust Onion gives families three rotating codewords that change every 60 seconds, calculated locally on each phone with no server involved. If an older parent gets a frightening call from someone claiming to be a grandchild in trouble, or an official demanding action, the family's three words give them a reason to pause and a way to check: call a trusted family member and ask, "What are the words?" A scammer cannot answer that question. A cloned voice cannot answer it either. The Multnomah County Sheriff's Office was clear: no real deputy will ever ask you to pay a fine through a Bitcoin machine. A 79-year-old man in Gresham now knows that, and it cost him $40,000 to learn it. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - Real law enforcement will never demand payment over the phone or direct you to a Bitcoin machine to avoid arrest. - Scammers use urgency and official-sounding titles to prevent victims from pausing to verify before acting. - A family's three rotating codewords give older adults a simple way to pause any suspicious call and check with someone they trust. ## Frequently asked questions ### Will police really call me if I miss jury duty? Courts typically send written notices by mail for missed jury duty. A phone call demanding immediate cash payment to avoid arrest is a scam. Contact your local court directly using a number from their official website if you have concerns. ### Why do jury duty scammers ask for Bitcoin or gift cards? Bitcoin machines and gift cards are nearly impossible to trace or reverse, making them the preferred payment method for scammers. No legitimate government agency will ever ask you to pay a fine this way. ### How can I help an elderly parent recognize a fake police call? Remind them that real officers never demand phone payment to drop a warrant. Set up a simple family verification plan so they know to call you before acting on any frightening call from an unknown number. ### What are the three rotating codewords and how do they help? Trust Onion gives families three private codewords that change every 60 seconds on each person's phone. If a caller claims to be a family member or triggers alarm, an older adult can call a trusted relative and ask for the current words. A scammer cannot answer. ### What should I do if I already sent money to a scammer? Contact your bank immediately, then file a report with your local police and the FTC at reportfraud.ftc.gov. If you used a Bitcoin machine, note the machine's operator information, as some transactions can be flagged before they clear. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "A Fake Kidnapping Call Cost a Scottsdale Man $4,000" published: 2026-10-28T00:03:06.114Z updated: 2026-10-28T00:03:06.208Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/fake-kidnapping-call-scottsdale-man-scammed-4000 --- # A Fake Kidnapping Call Cost a Scottsdale Man $4,000 **Cite as:** A Fake Kidnapping Call Cost a Scottsdale Man $4,000, Trust Onion, 2026-10-28. https://trustonion.io/blog/fake-kidnapping-call-scottsdale-man-scammed-4000 A Scottsdale man was jolted awake by a call appearing to come from his father's number, only to hear a stranger's voice claiming his parents were being held at gunpoint. Before Virginia police confirmed his parents were safe at home, he had already sent more than $4,000 via Apple Pay. The call came late at night and showed his father's name on the screen. When the man answered, a stranger told him his parents were captives and demanded money immediately. Terrified and texting 911 at the same time, he sent funds to two Apple Pay numbers, hoping to buy his family's safety. Virginia police confirmed the truth: his parents were home, unharmed, and completely unaware any of this was happening. The number had been spoofed. The voices, the urgency, the threat of a gun, all of it was manufactured. By the time the picture became clear, $4,000 was gone. According to an AARP Arizona specialist cited in the FOX5 Vegas report, virtual kidnapping scams are built to stop victims from pausing long enough to check. The fear is the product. Scammers keep the call going, keep the pressure rising, and keep the target from doing the one thing that would end it: reaching the people they love through another channel. ## How the Con Works Spoofing a phone number is straightforward enough that scammers do it at scale. When a familiar name appears on the screen, the brain reads it as safety, not danger. The stranger on a spoofed call inherits all the trust attached to that number, at least long enough to extract a payment. A callback feels like the obvious answer, but a failed callback does not prove the original caller was legitimate. Anyone running this scam knows that returning a call to a spoofed number may reach the real person, but the caller can claim the "kidnappers" let them go, or that the situation has changed. Families should confirm safety through a completely independent contact method and alert authorities immediately if someone may genuinely be in danger. --- The faster fix is a question only a real family member can answer. If every person in a family shares three private rotating codewords through Trust Onion, a suspicious call ends in seconds: "What are the words?" A stranger on a spoofed line cannot answer. The words change every 60 seconds and are calculated on each person's device, so there is nothing to steal and nothing that expires slowly enough to be useful. ## What AARP Says Families Should Know The AARP Arizona specialist's point is worth sitting with: the scam works by manufacturing fear fast enough that reason can't catch up. Any tool that slows the panic, or gives a family a shared signal that requires no explanation, directly undercuts that mechanism. The Scottsdale man did everything a frightened person would do. He tried to reach 911. He tried to protect his family. The scam was designed to move faster than those instincts, and the people running it counted on exactly the kind of love that makes a son wire money at midnight without stopping to think. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - Scammers spoofed a father's phone number to trick his son into sending $4,000 before police confirmed the parents were safe at home. - Virtual kidnapping scams rely on manufactured urgency to stop victims from independently verifying the threat, so any tool that creates a pause disrupts the con. - A shared family question, 'What are the words?', lets anyone quickly confirm they are speaking to a real loved one, not a stranger on a spoofed line. ## Frequently asked questions ### What is a virtual kidnapping scam? A virtual kidnapping scam is a call in which fraudsters claim to have a family member hostage and demand immediate payment. No one is actually taken; the threat is fabricated to create fear and rush the target into sending money before they can verify anything. ### How do scammers spoof a family member's phone number? Caller ID spoofing tools let anyone display any number they choose when placing a call. The technology is widely available, which is why seeing a familiar name on your screen is no longer reliable proof of who is actually calling. ### Should I call back on the same number if I get a suspicious call? Calling back the same number is a reasonable first step, but a successful callback does not prove the original call was safe. Use a completely independent contact method, like a number you look up separately, and alert authorities right away if you believe someone may be in genuine danger. ### How can my family protect ourselves from fake kidnapping calls? Share a private verification signal only your family knows. Trust Onion gives every family three rotating codewords that change every 60 seconds. A simple 'What are the words?' on any suspicious call instantly confirms whether you are speaking to a real family member or a scammer. ### What should I do if I receive a ransom or kidnapping call? Stay as calm as possible, text or call 911 immediately, and try to reach the supposed victim through a separate, known contact. Do not send money until you have confirmed the situation independently. Ask your family's private codewords if you use a shared verification system. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set up takes minutes, it's free, and the next time a call sounds wrong, one question tells you everything. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Cloned Her Daughter's Voice. She Wired $5,400 to Mexico." published: 2026-10-26T00:04:44.914Z updated: 2026-10-26T00:04:45.008Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-fake-kidnapping-family-safe-word --- # AI Cloned Her Daughter's Voice. She Wired $5,400 to Mexico. **Cite as:** AI Cloned Her Daughter's Voice. She Wired $5,400 to Mexico., Trust Onion, 2026-10-26. https://trustonion.io/blog/ai-voice-cloning-fake-kidnapping-family-safe-word A California mother spent five hours on the phone believing her daughter had been kidnapped, then wired $5,400 to Mexico. The daughter was fine. The voice was not hers. The call came in like any other. A panicked voice, recognizably her daughter's, crying on the other end of the line. A man then took over, demanding money and threatening harm if she hung up. For the next five hours, the mother stayed on the phone, terrified, doing exactly what she was told. The California mother's daughter was never in danger. The voice her mother heard was a clone, built from audio scraped online and fed through AI. By the time it was over, $5,400 had been wired to Mexico. This is how the scam works now. Criminals record a few seconds of someone's voice from a social media video or voicemail, run it through widely available software, and produce a replica convincing enough to fool a parent under pressure. The fake daughter sobbed. The fake kidnapper threatened. The mother had no reason to doubt what her own ears were telling her. ## Why a Familiar Voice Is So Effective Kimberly Hyun, a marketing professor at the University of Cincinnati who studies consumer decision-making, told Fortune that a familiar voice lowers our cognitive defenses in ways a stranger's voice simply does not. When the brain recognizes someone it loves, it stops asking questions. That is not foolishness. It is how human trust is wired, and it is exactly what these scams exploit. The FTC has tracked a sharp rise in impersonation scams. Victims lose thousands of dollars in minutes because the emotional shock of a loved one in danger short-circuits the pause that might otherwise prompt skepticism. The standard advice after a call like this is to hang up and call your loved one directly on a number you already have. That is worth doing. But a callback alone does not prove the original caller was fake. A well-prepared scammer may have spoofed a line or kept the real person temporarily unreachable. After you confirm your loved one is safe, report the original call to the FTC and local police. --- What would have stopped this before a single dollar moved is a question the mother could have asked: "What are the words?" That is the idea behind Trust Onion. Families share three private codewords that rotate every 60 seconds, calculated on the device and never sent to a server. If a call comes in from someone claiming to be a loved one in trouble, one question ends the test instantly. A cloned voice cannot answer it. A live scammer cannot guess it. The words change before stolen ones can be reused. ## What Families Can Do Right Now A safe word, as Fortune and Professor Hyun both recommend, is a meaningful starting point. A single static word is better than nothing, but a word that never changes can be overheard, guessed from context, or extracted under pressure over a long call. A verification system whose answer rotates every minute removes that risk. The California mother's five hours on the phone cost her $5,400 and something harder to measure: the certainty that hearing her daughter's voice meant her daughter was there. That certainty is gone now, for her and for every other parent who has read her story. The technology that faked that voice is not expensive or rare. The thing that makes it beatable is equally simple: a shared secret the AI was never in the room to hear. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - AI can clone a loved one's voice from just a few seconds of audio found online, making fake kidnapping calls terrifyingly convincing. - A familiar voice lowers our instinct to question, which is why these scams work even on alert, attentive parents. - Three private codewords that rotate every 60 seconds give families a verification check no cloned voice can pass. ## Frequently asked questions ### How do scammers clone someone's voice for a fake kidnapping call? They record a few seconds of audio from social media videos or voicemails, then run it through widely available AI software to produce a convincing replica. Even a short clip is often enough to generate a voice that fools a parent under emotional stress. ### What should I do if I get a call saying a family member has been kidnapped? Stay as calm as you can, ask a verification question only your real loved one could answer, then hang up and call that person directly on a number you already have. A successful callback confirms they are safe, but always report the original call to the FTC and local police. ### Does a safe word actually stop AI voice cloning scams? A shared secret the scammer was never present to hear is the one thing a cloned voice cannot provide. A word or phrase that rotates frequently is harder to steal or guess under pressure than a single static code word. ### How much money do people lose to AI impersonation scams? Individual losses vary widely. In the California case reported by Fortune in October 2026, a mother wired $5,400 to Mexico after a five-hour call. The FTC tracks impersonation scams as one of the fastest-growing fraud categories. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. If a call ever sounds wrong, one question tells you the truth. Free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Colorado Gets 27M Robocalls a Month. Now They Pay $4,000 Each." published: 2026-10-21T00:05:54.647Z updated: 2026-10-21T00:05:54.741Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/colorado-robocall-scams-4000-per-call-ai-fraud --- # Colorado Gets 27M Robocalls a Month. Now They Pay $4,000 Each. **Cite as:** Colorado Gets 27M Robocalls a Month. Now They Pay $4,000 Each., Trust Onion, 2026-10-21. https://trustonion.io/blog/colorado-robocall-scams-4000-per-call-ai-fraud A Colorado man lost $3,000 to a romance scam in 2025, and according to the Colorado Public Interest Research Group, he was not far from the new average: scammers are now stealing up to $4,000 per successful robocall. Twenty-seven million unwanted calls land on Colorado phones every month. That figure, reported by Denver7 in October 2026, has barely moved despite years of do-not-call enforcement and carrier-level filtering. What has changed is how much each successful scam pays out. The Colorado Public Interest Research Group puts the average loss at up to $4,000 per robocall scam and $2,000 per scam text. Advocates point directly at AI as the reason yields are climbing. The technology lets scammers spoof voices with enough accuracy that a call can sound like a banker, a relative, or a government agent. Caller ID can be faked in seconds. The calls have gotten easier to trust and harder to dismiss. The Colorado man who lost $3,000 in a 2025 romance scam heard a voice that felt real, built over weeks through messages and calls that seemed consistent. By the time money moved, the relationship felt genuine. That is the architecture of the modern phone scam: patience, a convincing voice, and a story that holds together just long enough. ## How the Con Stays Alive Robocall scams still work partly because of volume. Twenty-seven million calls a month in one state means scammers can afford a low hit rate and still profit. AI lowers the cost of sounding credible further: a scammer no longer needs a skilled actor or a native accent, because software handles the voice and a script handles the story. The tells that once gave scams away, an odd pause, a strange accent, a slightly wrong word, are getting harder to catch. Familiar voices, official-sounding names, and matching caller IDs were never proof of identity, but they felt like it. They still feel like it, which is the problem. A private three-word challenge that changes every 60 seconds is a different kind of check. Trust Onion lets you set up shared codewords with anyone you communicate with regularly: a bank contact, a family member, a colleague. When a call arrives claiming to be someone you trust, you ask for the words. AI can clone a voice. It cannot know three codewords calculated locally on your phone that were never in any recording. ## What Actually Stops the Call If you get a suspicious call, hang up and call back on a number you find independently. Look up the number on the institution's official website, app, or a card or statement you already have. Do not call back a number the caller provides. A successful callback does not confirm the original caller was legitimate; it only confirms the institution exists. Contact authorities if you believe someone may be in danger. The deeper fix is a verification method that does not depend on the call at all. When the check is a private word only the real person could know, a convincing voice stops being enough. Colorado's 27 million monthly calls are not going away soon. But the question "What are the words?" takes about three seconds to ask. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - Colorado receives 27 million unwanted robocalls per month, and AI is driving average losses up to $4,000 per successful scam call. - AI voice-spoofing makes robocalls sound like people you trust, so a familiar voice or matching caller ID is no longer proof of identity. - A private codeword challenge that rotates every 60 seconds gives you a check that a cloned voice cannot pass. ## Frequently asked questions ### How much money do robocall scams steal on average? According to the Colorado Public Interest Research Group, scammers now steal an average of up to $4,000 per successful robocall scam and up to $2,000 per successful scam text. ### How does AI make phone scams more dangerous? AI lets scammers spoof voices convincingly and fake caller ID, making calls sound like a bank, a relative, or an official. This lowers the cost of running a believable scam and raises the average payout. ### What should I do if I get a suspicious call from someone claiming to be my bank? Hang up and call back using a number from the bank's official app, website, or a card or statement you already have. Do not use any number the caller provides. A successful callback does not confirm the original call was legitimate. ### How do rotating codewords stop voice-cloning scams? Trust Onion generates three private codewords on your device that change every 60 seconds. A caller claiming to be someone you trust must know the current words. AI can copy a voice but cannot access codewords that were never recorded or shared online. ### How many robocalls does Colorado receive each month? According to Denver7 reporting from October 2026, Colorado receives approximately 27 million unwanted robocalls per month. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Set up your private three rotating codewords free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Cloned a Florida Sheriff's Voice. The Scam Fooled Callers." published: 2026-10-21T00:02:47.920Z updated: 2026-10-21T00:02:48.007Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-cloned-florida-sheriff-voice-fake-arrest-warrant-scam --- # AI Cloned a Florida Sheriff's Voice. The Scam Fooled Callers. **Cite as:** AI Cloned a Florida Sheriff's Voice. The Scam Fooled Callers., Trust Onion, 2026-10-21. https://trustonion.io/blog/ai-cloned-florida-sheriff-voice-fake-arrest-warrant-scam A scammer borrowed a real sheriff captain's voice, his actual photo, and his name to leave voicemails warning people they had active arrest warrants and needed to pay immediately to stay out of jail. The calls sounded official. The voice belonged to Captain Steve Moser of the Osceola County Sheriff's Office. So did the photo attached to the message. Neither came from him. Scammers used AI to clone Captain Moser's voice and paired it with his real photograph to build a fake authority figure who could demand money without raising suspicion. Recipients heard a credible law enforcement officer explain that they had missed jury duty or that a warrant had been issued in their name. The fix, the voice said, was simple: pay now, often in cryptocurrency, and the problem goes away. By mid-October 2026, the Osceola County Sheriff's Office had recorded roughly 40 law enforcement impersonation cases for the year and issued public warnings. The scam works because it layers real details, an actual name, a real face, a cloned voice, over a fake threat. ## How the Con Works The formula is straightforward. Start with a public figure whose name and face are findable online. Feed recordings of that person's voice into AI software that can reproduce it. Attach a real photo. Send voicemails at scale. The caller ID may show a number that looks local or official. The pressure tactic is a courthouse classic: you are already in trouble, time is short, and the only way out costs money. Cryptocurrency payments are favored because they move fast and cannot be reversed. Victims who call back on the number provided may reach another scammer playing a different role in the same scheme. If you receive a call like this, hang up. Call the sheriff's office or agency back on a number you find yourself, from their official website or a local directory. Reaching a legitimate-sounding person does not prove the original call was real. Real law enforcement agencies do not demand payment over the phone to resolve warrants or missed jury duty. ## The Problem with Familiar Voices AI can clone a public official's voice from recordings freely available online and attach a real photo. What it cannot do is produce a private three-word code that you and a trusted contact set up in advance. Trust Onion gives anyone that kind of check: a rotating codeword challenge that works on a phone call and cannot be faked by a voice clone or a stolen photo. If someone calls claiming to represent anyone you need to trust, a simple "what are the words?" ends the uncertainty in seconds. The Osceola County Sheriff's Office is urging anyone who receives one of these calls to report it to local authorities and not to send money. Captain Moser's name and voice were used without his knowledge or consent, and the real department will not ask for payment over the phone under any circumstances. The same software that cloned one captain's voice is already being pointed at other public figures' recordings. The tool is cheap, the audio is plentiful, and the only thing standing between a convincing fake and a transferred payment is whether the person on the other end of the call knows to ask a question the clone cannot answer. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - Scammers cloned a real Florida sheriff captain's voice and photo to demand fake warrant payments, with roughly 40 law enforcement impersonation cases recorded in Osceola County in 2026. - Real law enforcement agencies do not call to demand cryptocurrency or immediate payment to resolve warrants or missed jury duty. - A private rotating codeword challenge can verify a caller's identity in seconds, even when their voice and photo have been cloned by AI. ## Frequently asked questions ### Can scammers really clone a real police officer's voice? Yes. AI voice-cloning software can reproduce someone's voice from publicly available recordings. Scammers in Osceola County, Florida did exactly this with a real sheriff's captain in 2026, pairing the cloned voice with his actual photo to make fake warrant calls sound official. ### What should I do if I get a call saying I have an arrest warrant? Hang up. Call the agency back using a number you find yourself, such as the official website or a local directory. Real law enforcement does not call to demand payment or cryptocurrency to clear a warrant or missed jury duty. ### Does calling back on an official number prove the original call was legitimate? No. Reaching a real agency confirms the agency exists, but it does not prove the original caller was genuine. Treat the original call as suspicious regardless of what a callback reveals. ### How can I tell if a call from an authority figure is real? Caller ID and a familiar-sounding voice are not reliable proof. Verify through an official number you find yourself, and consider using a private shared challenge, like Trust Onion's three rotating codewords, with anyone you need to confirm is who they claim to be. ### Why do these scammers ask for cryptocurrency? Cryptocurrency payments move quickly and cannot be reversed once sent, making them ideal for fraud. Any caller demanding crypto to resolve a legal matter should be treated as a scam. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords that change every 60 seconds give you a check no cloned voice can pass, and it's free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Decoys Are Wasting Scammers' Time at Scale" published: 2026-10-19T00:06:50.627Z updated: 2026-10-19T00:06:50.721Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-decoys-wasting-scammers-time-apate-fraud-intelligence --- # AI Decoys Are Wasting Scammers' Time at Scale **Cite as:** AI Decoys Are Wasting Scammers' Time at Scale, Trust Onion, 2026-10-19. https://trustonion.io/blog/ai-decoys-wasting-scammers-time-apate-fraud-intelligence An Australian startup has sent thousands of AI agents undercover into scam calls, messages, and emails, burning an estimated 17 years of fraudsters' time before a single real victim could be reached. The agents don't just hang up. They play along. Apate.ai, based in Australia and backed by $8.15 million in seed funding announced in October 2026, deploys AI personas that vary by age, gender, accent, and language, stretching conversations long enough to extract what matters: bank account numbers, crypto wallet addresses, phone numbers, and the brands being impersonated. By the time a scammer realizes nothing is coming, the intelligence has already moved to Apate's clients. Those clients are the institutions closest to the damage. Banks, telecom companies, government agencies, and utilities buy the resulting data to flag threats before their customers encounter them. The company reports its agents have now engaged scammers across 2.5 million conversations, and that volume is the point: patterns across millions of live fraud attempts tell a defender things that a handful of victim reports never could. ## What the Intelligence Actually Shows Scammers running phone and message fraud depend on a simple asymmetry. They make hundreds of attempts; most people have no idea what a current scam script sounds like. Apate's approach flips part of that equation by feeding real-time intelligence about active scripts, impersonated brands, and campaign infrastructure to the organizations best placed to disrupt them. For fraud teams, the practical implication is straightforward: upstream intelligence shortens the window between when a campaign launches and when defenses catch up. A bank that knows a scammer is currently impersonating its brand using a specific callback number can act before customers dial back on a number a fraudster gave them. (Returning a call to a number a scammer provided, even one that appears legitimate, does not prove the original contact was real. Always verify through a number from your card, statement, or the official app.) The harder problem is the last meter: the moment a voice or message reaches an individual. Intelligence flowing to a bank's fraud team does not automatically reach the customer on the phone, the employee about to approve a wire, or the parent taking a call from what sounds like their child. That gap is where a simple in-the-moment check still matters. Trust Onion's three rotating codewords give anyone, a family, a finance team, an executive and their assistant, a way to challenge a caller before any money moves or any information is shared. The words rotate every 60 seconds and are calculated locally on each device, so a cloned voice or spoofed caller ID is useless without them. ## The Human Moment Intelligence Can't Reach Apate's model is a serious contribution to the fraud-intelligence stack, and 17 years of wasted scammer time is a genuine measure of disruption. But fraud operations adapt: new numbers, new brands, new scripts. The scam that reaches someone today may not yet appear in any database. The caller who claims to be from your bank, the CFO asking for an urgent wire, the voice that sounds exactly like your brother, all of them can be challenged with three words that no intelligence feed could have handed them in advance. Seventeen years of scammers' time wasted is a striking number. The next call is still coming. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - Apate.ai has deployed AI agents across 2.5 million scammer conversations to gather live fraud intelligence sold to banks, telecoms, and government agencies. - Upstream intelligence narrows the window for defenders but does not protect individuals at the exact moment a convincing call or message arrives. - Three rotating codewords that change every 60 seconds give families and security teams a real-time identity check that no scam script can prepare for. ## Frequently asked questions ### How does Apate.ai's fraud intelligence platform work? Apate.ai deploys AI agents that pose as potential victims across calls, messages, emails, and social media. The agents keep scammers engaged long enough to extract details like bank accounts and impersonated brands, then sell that intelligence to banks, telecoms, and government agencies. ### Can fraud intelligence services protect me during a scam call in real time? Intelligence platforms help institutions flag threats before campaigns spread, but that data does not automatically reach you during a live call. A real-time identity check, like asking a caller for a shared private codeword, is the most direct protection in the moment. ### How can finance teams verify an executive request before approving a wire transfer? A shared three-word challenge, rotated every 60 seconds and calculated locally on each device, lets a finance employee verify an executive caller on the spot. A cloned voice or spoofed caller ID cannot supply words the real person has not shared. ### What should I do if I get a suspicious call from someone claiming to be my bank? Hang up and call back using a number from your card, statement, or the bank's official app. Do not use a number the caller gave you. A successful callback does not prove the original call was legitimate; the caller must still pass any private verification your family or team has set up. ### What is Trust Onion and how is it different from fraud intelligence tools? Trust Onion is a free app that generates three private rotating codewords shared between people who trust each other. It works offline with no server, so it protects individuals at the exact moment of a call, complementing the upstream intelligence that services like Apate provide to institutions. ## More from Trust Onion See how Trust Onion gives people and teams a practical way to verify identity with three rotating codewords that change every 60 seconds, free for families and organizations alike. Visit trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "A Cloned Voice Cost a Mumbai Retiree ₹50 Lakh" published: 2026-10-18T00:01:59.464Z updated: 2026-10-18T00:02:12.092Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/mumbai-ai-voice-cloning-scam-senior-citizen-50-lakh --- # A Cloned Voice Cost a Mumbai Retiree ₹50 Lakh **Cite as:** A Cloned Voice Cost a Mumbai Retiree ₹50 Lakh, Trust Onion, 2026-10-18. https://trustonion.io/blog/mumbai-ai-voice-cloning-scam-senior-citizen-50-lakh A 69-year-old Mumbai resident handed ₹50 lakh in cash to a courier after a WhatsApp caller, sounding exactly like a trusted community figure, said he was stranded in New Delhi and needed an urgent loan. The voice on the other end of the WhatsApp call was familiar. It belonged, or seemed to belong, to someone the victim respected. The caller said he was stuck in New Delhi, needed money quickly, and asked the 69-year-old to arrange a loan. To make the story hold, the scammers sent a temporary location pin through WhatsApp, a small detail that made the repayment plan feel real. Then the pin disappeared. The cash did not. According to the Free Press Journal, ₹50 lakh was physically handed to a courier. Mumbai cybercrime police are now investigating the fraud. The victim did nothing wrong. The voice was convincing because AI voice-cloning tools can replicate a person's tone, cadence, and accent from a short audio sample, enough to fool someone who genuinely knows the real speaker. ## How the Con Worked Fraudsters identify a person their target trusts, then build urgency around a scenario that explains why normal verification is impossible: a stranded traveler cannot video call, cannot come to the door, needs money before a deadline. The temporary WhatsApp location pin added a layer of theater, suggesting a real address for repayment, before it was quietly deleted once the cash was on its way. The voice was the anchor. Once the victim believed they were speaking to someone they knew, every other part of the story followed naturally. That is the precise vulnerability AI voice-cloning exploits: it does not need to defeat a security system. It only needs to defeat a person's trust in their own ears. --- ## What Would Have Stopped It One question, asked at the start of the call, would have ended this scam immediately: "What are the words?" Trust Onion gives families three private codewords that rotate every 60 seconds, calculated locally on each person's phone without touching any server. A caller claiming to be a trusted friend or relative either knows the current words or they do not. An AI-cloned voice has no way to know them. If the person on the line cannot answer, the call is not real. For older adults who receive unexpected calls asking for money, the habit is simple: pause before acting, ask for the words, and if the caller hesitates or deflects, hang up. If you are genuinely worried someone may be in danger, call them back on a number you already have saved, or contact a family member directly. A callback alone does not prove the original caller was who they claimed to be; the caller must still know your family's private three words. The scammers never needed to steal a password or break into an account. They needed thirty seconds of audio and a story about being stranded. The location pin that vanished from WhatsApp was the one honest moment in the entire call. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - AI voice-cloning tools can replicate a trusted person's voice convincingly enough to fool someone who knows them well. - Urgency, a familiar voice, and a small convincing detail like a location pin are enough to move a scam from a phone call to a cash handover. - Asking 'What are the words?' before sending any money gives families a check that a cloned voice cannot pass. ## Frequently asked questions ### How did scammers fake a voice so convincingly in the Mumbai case? AI voice-cloning tools can copy a person's tone and accent from a short audio sample, enough to fool someone who genuinely knows the real speaker, even over WhatsApp. ### What should an elderly person do if they get an unexpected call asking for money? Pause before acting. Ask the caller a private verification question, or use a family codeword system. If the caller cannot answer, hang up. Call back on a number you already have saved, but know a callback alone does not confirm the original caller was legitimate. ### Can AI clone a voice well enough to fool family members? Yes. Researchers and law enforcement have documented multiple cases where cloned voices fooled people who knew the real speaker personally, including over phone and WhatsApp calls. ### What are Trust Onion's three rotating codewords and how do they help? Trust Onion gives families three private words that change every 60 seconds on each person's device, with no server involved. A caller must know the current words to pass the check, and an AI-cloned voice cannot. ### How do I protect an elderly parent from AI voice scams? Set up a shared verification system before a scam call ever arrives. Agree on a question only real family members can answer, or use a rotating codeword app like Trust Onion, and practise the habit together. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free, works offline, and takes less than a minute to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "She Lost $45,000 to a Fake Cop. The Call Sounded Real." published: 2026-10-15T00:06:31.785Z updated: 2026-10-18T05:19:44.039Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/woman-loses-45000-jury-duty-scam-arizona --- # She Lost $45,000 to a Fake Cop. The Call Sounded Real. **Cite as:** She Lost $45,000 to a Fake Cop. The Call Sounded Real., Trust Onion, 2026-10-18. https://trustonion.io/blog/woman-loses-45000-jury-duty-scam-arizona An Arizona woman drove to four different banks and withdrew $45,000 in cash after a caller claiming to be a police officer told her she had missed jury duty and would be arrested if she didn't pay immediately. The caller knew how to sound official. He told the Arizona woman she had failed to appear for jury duty, that a warrant had been issued, and that she could avoid jail only by paying citation fees and bond money right away. According to WFSB's October 2026 report, she paid $16,000 in fabricated citation fees, then visited four banks to pull out another $35,000 in supposed bond funds. The total came to $45,000. This is a law-enforcement impersonation scam, and investigators across the country have watched it spread sharply in recent years. The caller creates urgency, invokes real fear of arrest, and keeps the target on the phone long enough that hanging up starts to feel like the riskier choice. The Arizona woman went public with her story to warn others, telling WFSB, "It sounds so realistic." ## How the Con Works The scam runs on two pressure points: shame and fear. Telling someone they missed jury duty implies negligence. Threatening a warrant turns that shame into panic. Once a target is panicked, a scammer can walk them through almost any instruction, including driving from bank to bank so no single branch flags an unusually large cash withdrawal. Caller ID is useless as a defense. Scammers routinely spoof government phone numbers so the display shows a real police department or courthouse. A familiar-looking number is not proof the caller is who they claim to be. A private challenge can close that gap. Trust Onion gives anyone a way to verify a caller who claims to be a person or institution they know, using three rotating codewords that change every 60 seconds and are calculated locally on the phone. A real police officer calling from a legitimate case cannot supply words generated privately on your device. That gap ends the call. ## What Would Have Stopped It If the Arizona woman had paused and called the courthouse or police department back using a number from their official website, the scam likely would have collapsed. One note: a failed callback does not prove the original caller was legitimate on its own. Anyone directing you to pay cash or gift cards before you can verify their identity through an independently sourced number is a red flag, and if you believe someone may be in danger, contact authorities directly. Real courts and police departments do not demand immediate cash payment over the phone to avoid arrest. They do not ask you to visit multiple banks in a single afternoon. They do not threaten jail unless you stay on the line. Those details, taken together, are the scam's own fingerprints. The Arizona woman is sharing her story because she wants the next person to stop before the first bank visit. That moment, the pause before the withdrawal, is exactly where a calm question saves everything. ## Key takeaways - Scammers impersonating law enforcement use urgency and fear of arrest to pressure victims into withdrawing large amounts of cash. - Caller ID can be spoofed to show real government numbers, so a familiar display is not proof of a caller's identity. - A private challenge, such as Trust Onion's three rotating codewords, can stop an impersonation call that a familiar voice or official tone cannot. ## Frequently asked questions ### What is a jury duty phone scam? Scammers call pretending to be police or court officials, claim you missed jury duty, and demand immediate cash payment to avoid arrest. No legitimate court or police department collects fines or bond money this way over the phone. ### How can I tell if a call from a police officer or court is real? Hang up and call back using a number from the official agency website or a physical card. Do not use a number the caller gives you. Real officials will not pressure you to stay on the line or pay cash immediately. ### Can caller ID be faked to show a real police number? Yes. Scammers routinely spoof government phone numbers so the display looks legitimate. A number that matches a real police department or courthouse is not proof the caller is genuine. ### What should I do if I think I'm being scammed by someone pretending to be law enforcement? End the call, do not send any money, and contact the relevant agency directly using a number you find independently. If you believe someone is in immediate danger, call 911. ### How do Trust Onion's three rotating codewords help against impersonation scams? The codewords are private and generated on your device, so a scammer posing as anyone, including an official, cannot know them. Asking for the words instantly exposes a caller who cannot produce them. ## More from Trust Onion Trust Onion gives you a simple way to verify anyone who claims to be someone you know or a trusted institution. Three private rotating codewords add a check beyond caller ID, a familiar voice, or an official-sounding title. Try it free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Moncton Man Jailed 33 Months for Grandparent Scam Ring" published: 2026-10-12T00:02:03.616Z updated: 2026-10-18T05:23:14.887Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/moncton-man-prison-grandparent-scam --- # Moncton Man Jailed 33 Months for Grandparent Scam Ring **Cite as:** Moncton Man Jailed 33 Months for Grandparent Scam Ring, Trust Onion, 2026-10-18. https://trustonion.io/blog/moncton-man-prison-grandparent-scam A 39-year-old defendant from Moncton, New Brunswick, was sentenced to 33 months in a U.S. federal prison and ordered to pay $256,000 in restitution after his crew spent three weeks collecting cash from roughly 20 elderly Americans who believed a grandchild was in trouble. The calls follow a script that has worked for years. A grandparent picks up the phone and hears a panicked voice: a grandchild is in jail, needs bail money now, and please don't tell Mom and Dad. The voice sounds right. The urgency sounds real. In 2023, the defendant's operation collected $256,000 from about 20 people before it ended. The defendant did not make the calls himself. According to the CBC, he recruited people to pose as bail bondsmen, sent them into the United States to knock on doors and collect cash in person, then laundered and distributed the money to co-conspirators. The scheme ran for three weeks. He was arrested in Costa Rica in January 2025 and extradited to the United States, where he pleaded guilty to wire fraud and money laundering conspiracies. The in-person collection is what made this version of the scam so effective. By the time someone arrived at the door with a receipt and a firm handshake, the grandparent had already been convinced on the phone. The cash hand-off felt like the last step in rescuing someone they love. ## What Makes the Voice So Convincing AI can now clone a voice from a short audio sample. A grandchild's voicemail, a birthday video, a few seconds of a graduation speech: any of it is enough. The cloned voice cries, stammers, and begs. It says exactly what a frightened grandchild would say, and it is completely fake. The one thing an AI voice cannot do is know a private secret shared between two people. That is where three rotating codewords come in. Trust Onion is a free app that gives every family member three words that change every 60 seconds, calculated on the phone with no server involved. If a grandparent gets a distressing call from someone who sounds like a grandchild, they can pause and ask: "What are the words?" A real grandchild knows. A cloned voice has no answer. If the caller cannot answer, hang up and call your grandchild back on a number you already have saved. A successful callback does not, on its own, prove the original caller was legitimate. The person who answers must still know your family's private three words. ## A Sentence Is Not the End of the Scam The defendant's 33-month sentence is real accountability, and the $256,000 restitution order recognizes the harm done to real people. But the script he used is still in circulation, and the people running it are rarely arrested in Costa Rica. Most are never found. The roughly 20 elderly Americans who lost money in three weeks were not careless. They were targeted by a professional operation built to exploit the one thing most grandparents cannot ignore: the sound of a grandchild in trouble. The best protection is a question the grandchild can always answer and a stranger never can. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - A Moncton defendant was sentenced to 33 months in U.S. federal prison and ordered to repay $256,000 stolen from about 20 elderly victims in a three-week grandparent scam. - Scammers sent fake bail bondsmen to collect cash in person, making the fraud feel more real and harder to question in the moment. - A grandparent can stop any suspicious call by asking 'What are the words?' because three rotating family codewords are something a cloned voice can never know. ## Frequently asked questions ### What is the grandparent scam and how does it work? A caller pretends to be a grandchild in legal trouble, asks for cash bail, and urges the grandparent to keep it secret. In the case of the Moncton defendant, fake bail bondsmen then arrived in person to collect the money. ### Can AI really clone my grandchild's voice? Yes. AI can produce a convincing voice clone from a short audio sample, such as a voicemail or social media video. The cloned voice can cry, stammer, and beg in ways that are very hard to distinguish from the real person. ### How can an elderly person tell if a distressing call is really from a grandchild? Ask a question only that grandchild could answer. Trust Onion gives families three rotating codewords that change every 60 seconds. If the caller cannot name the words, the call is not genuine. ### What should I do if I get a call like this? Stay calm, do not send money, and ask for the family codewords. Then hang up and call your grandchild directly on a number you already have. If you think someone may be in real danger, contact local authorities. ### What happened to the Moncton defendant? The defendant, 39, of Moncton, New Brunswick, pleaded guilty to wire fraud and money laundering conspiracies. He was sentenced to 33 months in U.S. federal prison and ordered to pay $256,000 in restitution to his victims. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free, works offline, and takes about two minutes to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "FBI: Fake Cops Stole $1.6 Billion in 18 Months" published: 2026-10-11T00:06:37.091Z updated: 2026-10-11T06:11:44.874Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/fbi-scammers-impersonating-police-1-6-billion --- # FBI: Fake Cops Stole $1.6 Billion in 18 Months **Cite as:** FBI: Fake Cops Stole $1.6 Billion in 18 Months, Trust Onion, 2026-10-11. https://trustonion.io/blog/fbi-scammers-impersonating-police-1-6-billion Between January 2025 and July 2026, nearly 61,000 people received a call from someone claiming to be a federal marshal, a sheriff's deputy, or a government agent. Together they lost $1.6 billion, roughly $26,000 each. The script barely varies. A caller says you missed jury duty. There is a warrant. Pay immediately by gift card, wire transfer, or cryptocurrency, or face arrest. Hang up and the warrant gets worse. According to the FBI's Internet Crime Complaint Center, that premise, repeated at industrial scale across 18 months, produced one of the largest phone-fraud hauls on record. Impersonating a law enforcement officer is a federal crime, but scammers run it as a business anyway. The IC3 report documents fake jury duty threats, expired license demands, and video calls targeting foreign nationals, where scammers display fake badges, official-looking uniforms, and staged government office backgrounds. AI is making every element of these presentations more convincing by the month. ## Why Neither Eyes Nor Ears Can Save You The FBI flagged AI as a factor driving more believable impersonations. Voice tools can clone a voice from a short audio sample and produce real-time conversation, matching regional accents, cadence, and tone. Deepfake video is advancing just as quickly. In 2024, engineering firm Arup lost $25 million after an employee wired funds following a video call populated entirely by deepfake colleagues, showing that visual confirmation is no longer reliable. Caller ID spoofing costs almost nothing. A call can appear to originate from a real police precinct, courthouse, or federal agency. A caller can know your name, your address, and details scraped from public records. None of that makes them who they claim to be. The standard advice still applies: hang up, find the official number from the agency's website or a physical document you already have, and call back. Do not use any number the caller provides. One limit worth knowing: a successful callback confirms you reached the real agency, but it does not prove the original caller was legitimate. If you believe someone is in danger or a crime is being committed, contact local law enforcement directly. --- For calls involving someone you personally know, a bank you use, or any institution you have a relationship with, the problem is harder. Familiar voice? Not proof. Recognized face on screen? Not proof. Official-sounding badge number? Not proof. Trust Onion gives people a way to verify anyone claiming to be someone they know or a trusted institution before complying with anything. Each shared group generates three private rotating codewords, calculated locally on your device every 60 seconds. No server is involved. When a call feels wrong, one question settles it: "What are the words?" A real person answers instantly. A scammer cannot. The words they might have guessed expired before they finished dialing. This works beyond family too: set up a group with your bank contact, your accountant, or anyone you interact with regularly, and the same question applies to a fake cop, a fake federal agent, or a fake bank representative. ## What Real Law Enforcement Will Never Do Real law enforcement does not demand immediate payment over the phone. Real government agencies do not accept gift cards, wire transfers, or cryptocurrency as fines. Real federal agencies do not threaten arrest if you hang up. Report any call like this to the FBI's Internet Crime Complaint Center at ic3.gov. The FBI's own numbers make the stakes plain: $1.6 billion gone in 18 months, from people who believed the badge was real. ## Key takeaways - Scammers impersonating police and government officials stole $1.6 billion from nearly 61,000 victims in 18 months, an average loss of $26,000 per victim, according to the FBI's IC3. - AI voice cloning and deepfake video mean neither a familiar-sounding voice nor a face on screen is reliable proof of identity, as the Arup case, where a single deepfake video call cost $25 million, demonstrated. - Hanging up and calling back on an independently sourced number is smart, but a successful callback does not prove the original caller was legitimate; a private codeword challenge is a faster, harder-to-fake check. ## Frequently asked questions ### How do I know if a call from a police officer or federal agent is real? Hang up and call the agency back using a number from their official website or a physical document, not one the caller provides. Real law enforcement will not demand immediate payment by gift card, wire, or cryptocurrency, and will not threaten arrest for hanging up. A successful callback confirms you reached the real agency but does not prove the original caller was legitimate. ### How much money did scammers steal impersonating police in 2025 and 2026? According to the FBI's IC3, scammers impersonating law enforcement and government officials stole $1.6 billion between January 2025 and July 2026, based on nearly 61,000 complaints. The average loss per victim was $26,000. ### Can AI fake a police officer's voice on a phone call? Yes. AI voice cloning tools can replicate voices and accents convincingly from short audio samples. The FBI flagged AI as a factor making impersonation scams harder to detect by ear alone. Visual confirmation is equally unreliable: deepfake video calls have already been used to steal tens of millions of dollars. ### What is jury duty fraud and how does it work? Scammers call claiming you missed jury duty and that a warrant has been issued for your arrest, then demand immediate payment to clear it. No real court or law enforcement agency collects fines this way over the phone. ### How can I verify that someone claiming to be from my bank or a government agency is real? Find the official contact number independently using the agency's website, your bank card, or a statement. Do not use numbers the caller provides. Trust Onion lets you add a private three-word challenge so anyone in your verified group can prove who they are instantly, before you comply with anything they ask. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Verify For Free **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Your Bank Is Calling. Or Is It? How AI Scams Fool Everyone" published: 2026-10-10T00:11:30.685Z updated: 2026-10-11T06:11:44.885Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-bank-scams-what-your-bank-will-never-ask --- # Your Bank Is Calling. Or Is It? How AI Scams Fool Everyone **Cite as:** Your Bank Is Calling. Or Is It? How AI Scams Fool Everyone, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-bank-scams-what-your-bank-will-never-ask She heard her bank's name, saw her bank's number on the screen, and spoke to someone who knew her account details. She lost thousands of dollars, and the call was fake from the first word. The caller was polite. The number matched the one on the back of her debit card. The details were right. The request came late, after trust had been built, and by the time something felt wrong, money was already moving. This is not a story about carelessness. It is a story about a system. Scammers now combine AI voice cloning, caller ID spoofing, and stolen personal data to impersonate banks at a scale and quality that catches careful people off guard. The American Bankers Association launched its 'Banks Never Ask That' campaign specifically because so many people still do not know what a legitimate bank call looks like, and because the fakes have gotten very good at filling that gap. The technology behind the scam is straightforward. Voice cloning requires as little as 20 to 30 seconds of audio, which can come from a voicemail greeting, a social media video, or a recorded customer service call. Caller ID spoofing lets anyone display any number they choose, including the one printed on your card. Personal details pulled from data breaches supply the name, last four digits, and recent transactions that make the opener feel real. By the time the conversation starts, the scammer already sounds like the real thing. ## What Banks Will Never Ask According to the American Bankers Association, real banks do not ask you to share a one-time passcode sent to your phone, move money to a safe or temporary account, convert funds to cryptocurrency or gift cards, provide your full account password or PIN, or download remote access software so someone can fix a fraud issue. If a caller asks for any of these things, the call is a scam. Scammers know these rules too, so they script around them. They create urgency, tell you your account is already compromised, and give you just enough real detail to hold your trust until the ask arrives. Human ability to detect AI-generated voices hovers around 55 to 60 percent accuracy, according to researchers studying audio deepfakes. Even attentive people get it wrong roughly half the time. ## The Callback Trap Hanging up and calling your bank back using the number on your card is still the right move. Do it before taking any action the caller requested, and use the bank's official app or a number from your card or statement, never a number the caller provided. If you believe someone may be in danger, contact local authorities. But a successful callback does not prove the original caller was legitimate. It only confirms the official line is real. The scam call still happened, and if you shared a code or moved money before hanging up, the damage may already be done. Caller ID tells you what number is displayed. It does not tell you who is actually on the line. That gap is where AI scams live, and most people currently have no tool to challenge a caller to prove their identity in the moment. Trust Onion fills that gap for personal contacts. A private three-word challenge rotates every 60 seconds, is calculated on your device, and never touches a server. A cloned voice cannot fake the current words, and a spoofed number cannot supply them. For bank calls specifically, your bank will not know your Trust Onion words; any caller claiming to be your bank must still be verified through the official app or a number from your card. Pressure is a manipulation tool. Real fraud teams give you time to verify. If a call demands immediate action, that urgency is itself the red flag worth trusting. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - AI voice cloning and caller ID spoofing can make a fake bank call nearly indistinguishable from a real one, with human detection accuracy hovering around 55 to 60 percent. - Your bank will never ask for a one-time passcode, instruct you to move money, or request cryptocurrency over an inbound call. - Hanging up and calling back on an independently sourced number is the right move, but a successful callback does not prove the original caller was legitimate. ## Frequently asked questions ### What does a real bank call versus a fake one actually sound like? They can sound identical. AI voice tools produce calm, professional audio, and human detection accuracy hovers around 55 to 60 percent. Real banks never demand immediate action, one-time passcodes, or fund transfers. If a call creates urgency or asks for sensitive codes, hang up and call back using the number on your card or statement. ### If I call my bank back using the official number, am I safe? Calling back on a number you independently sourced is the right move, but it only confirms the official line is real. It does not confirm the original caller was legitimate. Take no action requested by the original caller before completing that independent callback. ### Can caller ID spoofing actually show my real bank's number? Yes. Caller ID spoofing lets anyone display any number they choose, including the number printed on your debit or credit card. A familiar number on screen is not proof the caller is who they claim to be. ### What is the 'Banks Never Ask That' campaign? A consumer education initiative from the American Bankers Association. It highlights requests real banks never make over inbound calls: asking for one-time passcodes, instructing customers to move money, or requesting cryptocurrency purchases. ### How do three rotating codewords help with bank impersonation scams? Your bank will not know your private Trust Onion words, which is the point for personal contacts. For bank calls, the words serve as a reminder that any caller must be verified through official channels. A voice or number alone is not proof of identity. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Verify For Free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "That Call From Your Relative Begging for Money? It Might Be AI" published: 2026-10-10T00:06:13.177Z updated: 2026-10-11T06:11:45.033Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-scam-relative-phone-call --- # That Call From Your Relative Begging for Money? It Might Be AI **Cite as:** That Call From Your Relative Begging for Money? It Might Be AI, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-cloning-scam-relative-phone-call A California woman heard her daughter's voice on the phone, crying and begging for help. It was an AI clone built from audio scraped off the internet, and it cost her $5,400 before she realized what had happened. The call that took $5,400 from a California mother began with a sound she knew by heart: her daughter's voice, frightened, asking for help. By the time she understood it was a clone, the money was gone. This is not a rare case. The FTC received more than 36,000 reports of imposter scams involving phone calls in 2023, with losses totaling over $1.3 billion. The Better Business Bureau has flagged AI voice cloning as one of the fastest-growing tools in these schemes. The scam works because it targets something faster than rational thought: the sound of someone you love in danger. Building that sound takes almost nothing. Twenty to thirty seconds of audio from a birthday video on Facebook, a TikTok, or a voicemail is enough for a fraudster to clone a convincing copy of your family member's voice, copying cadence, accent, and the specific way someone trails off at the end of a sentence. --- The call follows a fixed script. There has been an accident, an arrest, a medical emergency. Money is needed immediately. You must not call anyone else, must not tell your spouse, must not hang up. Wire transfer, gift cards, cryptocurrency: methods chosen because they are nearly impossible to reverse. Every second you stay on the call is a second you are not calling your actual family member to check. Researchers have found that people correctly identify cloned audio as fake only about 55 to 60 percent of the time, barely better than a coin flip. Under stress, that accuracy drops further. When you believe your child is in danger, your brain is not running a careful audio analysis, and telling yourself "I would recognize a fake" is not a reliable defense. The scam is designed to bypass exactly that kind of rational evaluation. ## What to Do When the Call Comes If a call arrives that feels urgent and involves a loved one asking for money, slow down. The urgency is manufactured. Hang up and call your family member directly using a number you already have saved. Do not use any number the caller provides. One important limit: a successful callback does not prove the original caller was legitimate. Anyone can spoof a number or construct a story, so the person on the callback must still be able to verify who they are. If you believe someone may genuinely be in danger, contact local authorities and do not let a scammer's instructions stop you from calling for help. ## Three Words That End the Scam What stops this kind of call is not better ears or more skepticism. It is a private verification system your family sets up before the emergency happens. Trust Onion gives every family three rotating codewords that change every 60 seconds. The words are generated on your device and never touch a server. When a call feels wrong, you ask one question: "What are the words?" Your real family member knows the answer instantly. A scammer, no matter how convincing the cloned voice sounds, has no way to know three private codewords already rotating to the next set. AI can clone a voice. It cannot clone a secret your family keeps between yourselves. The families who fall for these scams are not careless people. They are parents whose instinct to help kicked in before their guard could go up. By the time the real family member called back to say everything was fine, the money was already gone. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - AI voice cloning requires just 20 to 30 seconds of audio and can convincingly copy a loved one's voice, including cadence and accent. - People correctly identify cloned audio as fake only about 55 to 60 percent of the time, and that accuracy drops further under the stress of a fake emergency call. - A successful callback does not prove the original call was legitimate; the caller must still verify their identity, and families should contact authorities if someone may genuinely be in danger. ## Frequently asked questions ### How do AI voice cloning scams work? Fraudsters collect a short audio sample from social media or voicemails, then use AI to clone it. They call a family member pretending to be that person in a fake emergency, pushing for fast money transfers before anyone can verify the situation. ### Can you really not tell if a voice on the phone is AI? Research shows people correctly identify cloned voices as fake only about 55 to 60 percent of the time. Under stress, that accuracy drops further, which is why emotional urgency is a core part of how these scams are designed. ### What should I do if I get a suspicious call from a family member asking for money? Hang up and call your family member directly using a number you already have saved. Do not use any number the caller provides. A successful callback does not prove the original call was legitimate. If you believe someone is in real danger, contact local authorities. ### How do Trust Onion codewords stop an AI voice cloning scam? Trust Onion gives your family three private codewords that rotate every 60 seconds on your device. During any suspicious call, ask "What are the words?" Your real family member knows the answer instantly. A scammer using a cloned voice has no way to know them. ### Is Trust Onion free to use? Yes. Trust Onion is free. Codewords are generated on your device, work offline, and never touch a server. Setup takes a few minutes and is designed to be simple enough for any family to use. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set it up free at trustonion.io before the next call comes. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Four Seniors Lost $50K to One Scammer Pretending to Be Family" published: 2026-10-09T00:06:14.443Z updated: 2026-10-11T06:11:44.803Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/edmonton-grandparent-scam-four-winnipeg-seniors-50000 --- # Four Seniors Lost $50K to One Scammer Pretending to Be Family **Cite as:** Four Seniors Lost $50K to One Scammer Pretending to Be Family, Trust Onion, 2026-10-11. https://trustonion.io/blog/edmonton-grandparent-scam-four-winnipeg-seniors-50000 Four seniors in their 80s. One suspect. More than $50,000 in cash, credit cards, jewellery, and coins handed over at the door. The fourth victim lost $14,000 in a single weekend. The phone rings. A voice says it's your grandson. He's in trouble, needs bail money right now, and please don't tell anyone. Then someone knocks on your door to collect. Winnipeg police identified a fourth victim of this scheme in October 2026. She is in her 80s and lost $14,000 between August 17 and 18. Three other seniors in the same city had already lost a combined $37,000 to the same suspect, bringing the total past $50,000. A 29-year-old Edmonton man has been charged in connection with all four incidents. The script works because it exploits something real. The caller needs very little: a first name, a vague story about an arrest, enough urgency to sound plausible. "Don't tell anyone." "I need it today." "Please, just help me." Each phrase is designed to shut down the instinct to pause. Hesitating feels like failing someone you love, so most people don't hesitate. --- The Winnipeg cases appear to involve a person impersonating a grandchild by voice alone, no AI required. But the same scam now runs with AI-cloned voices. Modern voice-cloning tools can produce a convincing imitation from as little as 20 to 30 seconds of audio, often pulled from a social media video or voicemail. When a grandparent hears what sounds exactly like their grandson's voice, doubt disappears. The Federal Trade Commission reported that Americans lost more than $10 billion to fraud in 2023, with imposter scams ranking as the top category. ## One Question That Could Stop It Each of the four victims did exactly what felt right, and no one should feel ashamed of that. The scam is designed to make helping feel like the only option. But there is a moment in every one of these calls where a single question could end it. Not a long conversation, not a quiz. Just: "What are the words?" Trust Onion is a free app that gives families three private rotating codewords, calculated on each family member's phone and changing every 60 seconds. No server is involved and they work without an internet connection. A real grandson knows them. A scammer does not, no matter how convincing the voice sounds. If a parent or grandparent gets a call like this, ask for the words first. If the caller cannot supply them, hang up and call your grandchild directly on a number you already have. Keep in mind that a successful callback alone does not prove the original caller was legitimate; when you reach your grandchild, they still need to say the family's three words before anyone hands over anything. Report suspicious calls to local police and the Canadian Anti-Fraud Centre at 1-888-495-8501. ## Talk Before It Happens Seniors who know the grandparent scam exists are far less likely to fall for it. A calm, direct conversation goes a long way: "There are people who call and pretend to be me or my kids. Here is what to do if that ever happens." Also worth saying plainly: legitimate bail situations involve lawyers, not strangers collecting cash at your door. If someone arrives on your doorstep after a distressing phone call asking for valuables, that is the scam, not the emergency. The four seniors in Winnipeg were not careless. They were caring. Scammers count on love and loyalty. A cloned voice cannot answer "What are the words?" A suspect in Edmonton cannot answer it. Only the real person can. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - A 29-year-old Edmonton man is accused of defrauding four Winnipeg seniors in their 80s out of more than $50,000 by posing as their grandson and collecting cash, credit cards, jewellery, and coins at their doors. - AI voice-cloning tools can copy someone's voice from as little as 20 to 30 seconds of audio, making phone verification by sound alone unreliable; the FTC reported Americans lost over $10 billion to fraud in 2023, with imposter scams the top category. - Asking 'What are the words?' gives any grandparent an instant way to verify a caller, because Trust Onion's three rotating codewords change every 60 seconds and cannot be supplied by a scammer or a cloned voice. ## Frequently asked questions ### What is the grandparent scam and how does it work? A caller pretends to be a grandchild in crisis, often claiming they need bail money, and asks the grandparent not to tell anyone. A second person then visits the home to collect cash or valuables. In Winnipeg, four seniors in their 80s lost a combined $50,000 this way. ### How can a grandparent tell if a caller is really their grandchild? Ask for the family codewords. Trust Onion gives families three private rotating codewords that change every 60 seconds. A scammer cannot supply them, no matter how convincing the voice sounds. A real grandchild knows them instantly. ### Can AI clone a grandchild's voice to fool a grandparent? Yes. AI voice-cloning tools can produce a convincing imitation from as little as 20 to 30 seconds of audio, often pulled from social media. Trusting a voice alone is no longer enough. A shared family codeword is a more reliable check. ### What should a grandparent do if they get a suspicious call from someone claiming to be family? Ask for the family codewords. If the caller cannot provide them, hang up and call your grandchild directly on a number you already have. A successful callback alone does not prove the original caller was legitimate; the grandchild still needs to say the three words. Report suspicious calls to local police and the Canadian Anti-Fraud Centre at 1-888-495-8501. ### How much money have seniors lost to grandparent scams? In the Winnipeg cases reported in October 2026, four seniors in their 80s lost a combined $50,000 to one suspect. The FTC reported Americans lost over $10 billion to fraud in 2023, with imposter scams ranking as the top category. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free, works offline, and takes about two minutes to set up for the whole family at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "1 in 5 CFOs Fear Deepfake Impersonation. Half Can't Catch It." published: 2026-10-09T00:02:17.900Z updated: 2026-10-11T06:11:44.990Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/cfo-deepfake-impersonation-fear-survey-2026 --- # 1 in 5 CFOs Fear Deepfake Impersonation. Half Can't Catch It. **Cite as:** 1 in 5 CFOs Fear Deepfake Impersonation. Half Can't Catch It., Trust Onion, 2026-10-11. https://trustonion.io/blog/cfo-deepfake-impersonation-fear-survey-2026 Only half of CFOs and senior finance leaders say they could identify an AI fraud attempt before funds leave the account. That is not a technology gap. It is an authorization gap, and it sits inside the wire transfer process right now. In February 2024, an employee at the engineering firm Arup wired $25 million after joining a video call where every other participant, including a convincing replica of the CFO, was a deepfake. The employee saw a face, heard a voice, and followed instructions. Detection failed completely because the attack was designed to defeat it. That case is no longer an outlier. In October 2026, Early Warning Services' fraud prevention unit Certos published findings from a survey of 230 senior financial leaders: 81% said their organization experienced attempted fraud involving AI-generated or AI-enhanced content in the past year. Eighty-four percent said AI-enabled fraud is harder to detect than traditional fraud. One in five named executive deepfake impersonation as their single biggest concern. And only 50% expressed confidence they could catch an AI fraud attempt before funds move. The other half cannot. ## Why Detection Is a Race Most Organizations Are Losing Voice cloning now requires as little as 20 to 30 seconds of audio, and executives post earnings calls, conference keynotes, and podcast appearances publicly. Human detection accuracy for AI-generated audio hovers around 55 to 60%, barely above chance. Detection thresholds that worked in 2023 are not the thresholds needed in 2026. The Certos data describes the attack pattern precisely. An impersonator poses as a senior executive, contacts a finance team member by phone or video call, and invokes urgency: a deal closing, a regulatory deadline, a confidential acquisition. The finance team member can comply quickly or slow the process down and risk looking obstructionist to someone who sounds exactly like the CFO. Most authorization processes are built around identity signals AI can now replicate: voice, caller ID, familiarity with how the executive speaks. These are no longer reliable controls. ## The Operational Fix The answer is not another layer of software trying to detect what an AI-generated voice sounds like. It is a shared secret the impersonator cannot access because it was never transmitted over any channel an attacker can intercept. Trust Onion closes this gap with rotating codewords. Three words, generated locally on each device, change every 60 seconds, with no server and no internet required. When a caller claims to be the CFO authorizing a wire transfer, the finance team member asks one question: "What are the words?" The real executive knows the current three words. An impersonator does not. The words were never spoken on a public call, never sent over email, and never stored on a server that could be breached. They expire automatically. Finance teams need to establish, before any attack occurs, that every executive request for a wire transfer, vendor banking change, or urgent payment will include this challenge, with no exceptions. This is an operational policy, not a technology project. The CFOs who are confident they would catch an AI fraud attempt likely have some version of an out-of-band verification step already in place. The 50% who are not confident probably do not. --- The Certos survey covers 230 senior financial leaders across a range of organization sizes. Eighty-one percent experienced attempted AI fraud in the past year, which means attempted fraud is now the norm, not the exception. Wire transfers above certain thresholds are often unrecoverable within hours. Vendor payment redirections can sit undetected for weeks. The finance team member who receives the call is not naive. They are operating without the tools to verify the caller's identity. That is an organizational gap, not a personal one. AI can clone a voice. It cannot produce three words that change every 60 seconds, were never transmitted externally, and exist only on the devices of verified personnel. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - 81% of senior finance leaders experienced attempted AI fraud in the past year, and only 50% are confident they could identify an attempt before funds move, according to Early Warning Services' Certos unit. - Voice cloning requires as little as 20 to 30 seconds of audio, and human detection accuracy for AI-generated audio hovers around 55 to 60%, barely above chance. - A rotating codeword challenge gives finance teams an authorization control that does not depend on detecting a fake voice: the real executive knows the current words, and an impersonator cannot. ## Frequently asked questions ### How common is deepfake impersonation fraud targeting CFOs and finance teams? According to a 2026 Certos survey of 230 senior financial leaders, 81% reported their organization experienced attempted fraud involving AI-generated or AI-enhanced content in the past year, and 21% named executive deepfake impersonation as their top concern. ### Can finance teams reliably detect AI-generated voice calls? Research suggests human detection accuracy for AI-generated audio is approximately 55 to 60%, barely above chance. The 2026 Certos survey found 84% of finance leaders believe AI-enabled fraud is harder to detect than traditional fraud. ### What is a codeword protocol and how does it stop executive impersonation fraud? A codeword protocol requires a caller to supply a shared rotating secret before any financial authorization is granted. Because the words are never transmitted externally and change every 60 seconds, an impersonator cannot produce them even with a perfect voice clone. ### How does Trust Onion protect against CFO impersonation on wire transfer calls? Trust Onion generates three rotating codewords locally on each verified user's device. A finance team member asks the caller for the current words before approving any transfer. A real executive knows them. An impersonator does not. ### What should a finance team do if a caller claiming to be an executive cannot provide the codewords? Do not authorize the transfer. End the call and contact the executive through a separately verified channel, such as a known direct number or a confirmed messaging platform. Note that a successful callback does not prove the original caller was legitimate. Alert your security or compliance team to the attempt. ## More from Trust Onion Add Trust Onion's rotating codeword check to executive and wire-transfer approvals: a finance team member challenges any caller with "What are the words?" before a payment is authorized, and a real executive will always have the answer. Protect Your Business Free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Cloned Her Daughter's Voice. Then the Nightmare Began." published: 2026-10-08T00:02:44.868Z updated: 2026-10-18T05:23:17.146Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-scam-kidnapping-hoax --- # AI Cloned Her Daughter's Voice. Then the Nightmare Began. **Cite as:** AI Cloned Her Daughter's Voice. Then the Nightmare Began., Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-voice-scam-kidnapping-hoax A California mother and Navy veteran wired $5,400 across four transfers while believing her 37-year-old daughter was being held by a Mexican drug cartel. Her daughter was at her desk the entire time. The call came with a frantic voice and a threat: a Mexican drug cartel had taken her daughter. Then her daughter herself came on the line, crying and begging her mom for help. The California mother and her husband didn't hang up. For five and a half hours, the caller kept them moving, location to location, dictating every step. Wire money here. Go there. Don't call the police. They sent $5,400 through MoneyGram and Western Union in four transfers. Then the mother called her daughter directly. Her daughter picked up. She'd been at her desk all day. The voice the mother had heard was AI. This is what virtual kidnapping looks like now. Scammers can clone a voice from a few seconds of audio pulled from a social media video or a voicemail, and produce an imitation convincing enough to fool the people who know that voice best. The FTC has warned about these scams for years, and AI voice cloning has made them harder to detect by ear. Americans reported losing more than $1.3 billion to imposter scams in 2023 alone, according to the FTC. The mother is a Navy veteran. She is not naive. She is exactly the kind of person who doesn't get fooled, and she was fooled completely for five and a half hours, because what she heard sounded like her daughter. ## Why the Scam Holds Kidnapping hoaxes are built to short-circuit rational thinking. Keeping victims on the move stops them from pausing or reaching someone who might talk them down. A continuous call stops them from hanging up and dialing their loved one directly. And hearing what sounds like your daughter crying changes everything. Logic takes a back seat. Urgency does the rest. The right instinct is to hang up and call your loved one on a number you already have saved. But a successful callback has a limit: if someone then calls you back through an unfamiliar number claiming to be them, that does not prove the original call was legitimate. Scammers sometimes anticipate the callback and work around it. Your loved one still needs to prove it's really them. Use common sense, and call 911 if you believe someone may genuinely be in danger. --- That's where three private codewords make the difference. Trust Onion is a free app that gives families three rotating codewords, shared only within the group, calculated locally on each phone and never sent to a server. The words change every 60 seconds and work offline. AI can clone her daughter's voice. It cannot know codewords that live only on her daughter's phone and rotate every minute. One question, "What are the words?", exposes a fake caller instantly. ## What the Mother Did Right The California mother and Navy veteran did not do anything wrong. She heard her daughter's voice and tried to protect her child. She was targeted by scammers who used AI tools specifically built to defeat a parent's instincts. If you receive a call like this, do not wire money through MoneyGram, Western Union, Zelle, or gift cards. Once that money moves, it's gone. Try to reach your family member on a number you already have. Report the call to the FTC at ReportFraud.ftc.gov and to your local FBI field office. Voice cloning technology is widely available, and the people running these scams use it at scale. The answer isn't suspicion of every call. It's having a simple system in place before a call like this ever comes. Five and a half hours and $5,400 later, the mother found out her daughter was fine. One question, asked at the start, could have ended it in seconds. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning can convincingly imitate a loved one's voice using only a short audio sample from social media or a voicemail, making fake kidnapping calls nearly impossible to detect by ear alone. - Calling your loved one back on a known number is the right first move, but a successful callback alone does not prove the original caller was legitimate, so your loved one still needs to verify their identity. - Three private rotating codewords, shared only within your family and changing every 60 seconds on your device, give you an instant verification test that no AI-cloned voice can pass: just ask, "What are the words?" ## Frequently asked questions ### How do AI voice cloning scams work? Scammers use a short audio sample, sometimes just seconds from a social media video or voicemail, to generate an AI-cloned voice that sounds like your family member. They use that voice during a fake emergency call to make the threat feel real and keep you from thinking clearly. ### What should I do if I get a fake kidnapping call? Stay calm, avoid wiring money, and immediately try to reach your loved one on a number you already have saved. Call 911 if you believe someone is genuinely in danger. Report the scam to the FTC at ReportFraud.ftc.gov and to your local FBI field office. ### Can AI clone my family member's voice? Yes. Current AI tools can generate a convincing voice clone from as little as a few seconds of audio. Public social media posts, voicemails, and video calls are common sources scammers use to collect that audio. ### How do family codewords stop a voice cloning scam? Trust Onion gives your family three private rotating codewords that change every 60 seconds, calculated only on your devices. AI can fake a voice but cannot know private codewords it has never seen. Asking "What are the words?" exposes a fake caller instantly. ### Is Trust Onion free to use? Yes. Trust Onion is free. The codewords are generated on your device, never sent to a server, and work offline. You can set up a family group and start verifying each other in minutes. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set up your family group free today, so if a suspicious call ever comes, one question ends it: "What are the words?" **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "The Voice Was Her Friend's. He Was Home. She Lost Thousands." published: 2026-10-06T00:04:18.065Z updated: 2026-10-18T05:19:31.830Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-scam-orlando-fake-jailhouse-emergency --- # The Voice Was Her Friend's. He Was Home. She Lost Thousands. **Cite as:** The Voice Was Her Friend's. He Was Home. She Lost Thousands., Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-voice-cloning-scam-orlando-fake-jailhouse-emergency A woman's phone rang and her friend was on the other end, voice shaking, saying he'd caused a drunk-driving crash involving a pregnant woman and needed bail money fast. The real man was home, unaware any of this was happening. Scammers sent couriers to the woman's front door in Orlando to collect the cash. No wire transfer, no bank flag, no delay. Just strangers at the door with bags, and thousands of dollars gone. The call came in October 2026. The voice sounded exactly like her friend. It told her he'd hit a pregnant woman while drunk driving, that he was in jail, and that he needed money immediately. AI voice-cloning tools can replicate a person's voice from seconds of audio pulled from a voicemail, a video, or a social media clip, producing a call that sounds like someone you trust, because it does. Every detail of this scam was designed to stop the woman from pausing. The voice triggered instant recognition. The emergency created tunnel vision. The drunk-driving-and-pregnant-woman combination made the situation feel like something to handle quietly and fast, not something to run past a mutual friend. The courier removed the last barrier before she could reconsider. ## Why the Jailhouse Story Works The "jailhouse emergency" framing is common for a reason. It explains why her friend can't be reached on his regular phone, creates immediate financial pressure, and discourages the target from calling anyone else who might slow things down. According to the Federal Trade Commission, impersonation scams cost Americans more than $1.1 billion in 2023. AI voice-cloning has since lowered the cost and skill required to run a convincing impersonation to almost nothing. A short audio sample, freely available on social media, and an off-the-shelf AI tool is enough. Caller ID can be faked. A familiar voice can now be cloned. Neither is a reliable check on its own. --- When a call like this comes in, hang up and call back on a number already in your contacts. Do not use a number the caller gives you. One important caveat: a successful callback does not prove the original caller was legitimate. If you reach your friend and he has no idea what you're talking about, the first call was a scam. If you can't reach him, treat the situation as unverified and contact a mutual friend or family member before sending anything. Do not send cash or let a courier collect money at your door. Legitimate bail processes do not work that way. If you believe someone may genuinely be in danger, call local police. ## The Check a Cloned Voice Cannot Pass Trust Onion generates three private rotating codewords shared only between you and the people you trust. The words change every 60 seconds, are calculated locally on your device, and never touch a server. When someone calls claiming to be a friend or anyone you know, you ask: "What are the words?" A convincing AI voice clone of her friend cannot answer that. He can. The woman had no way to verify the caller in the moment. A shared three-word check with her friend would have ended that call before the courier ever arrived at her door. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice-cloning can replicate a person's voice from just seconds of audio, making a familiar voice on the phone an unreliable trust signal on its own. - The jailhouse emergency scam uses urgency, shame, and physical cash couriers to prevent victims from pausing to verify. Hang up, call back on a number you already have, and contact a mutual friend before sending anything. - A private three-word challenge shared in advance with Trust Onion asks 'What are the words?' and no cloned voice can answer it. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers collect a short audio sample from social media or voicemail, feed it into an AI tool, and call you using a voice replica. The clone can sound convincingly like the real person, making a familiar voice an unreliable way to verify who is actually calling. ### What should I do if I get a call saying a friend is in jail? Hang up and call your friend directly using a number already in your contacts. Contact a mutual friend or family member to independently confirm the story. Do not send cash or let a courier collect money at your door before verifying. If you believe someone is in real danger, call local police. ### Can caller ID tell me if a call is fake? No. Caller ID can be spoofed to display any number or name. A familiar number on the screen does not confirm the person calling is who they claim to be. ### How does Trust Onion protect against voice cloning scams? Trust Onion generates three private rotating codewords shared only between you and people you trust. The words change every 60 seconds and are calculated locally on your device. Asking "What are the words?" gives you a check that a cloned voice cannot pass, because the AI has no way to know your private codewords. ### Is Trust Onion free to use? Yes. Trust Onion is free. Codewords are generated on your device, work offline, and never touch a server. Setup takes only a few minutes before you ever need it. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Setup takes minutes and it's free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "A Friend's Voice Asked for Money. It Wasn't His Friend." published: 2026-10-05T00:09:31.294Z updated: 2026-10-18T05:19:37.703Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/bhopal-ai-voice-cloning-scam-security-guard-35000 --- # A Friend's Voice Asked for Money. It Wasn't His Friend. **Cite as:** A Friend's Voice Asked for Money. It Wasn't His Friend., Trust Onion, 2026-10-18. https://trustonion.io/blog/bhopal-ai-voice-cloning-scam-security-guard-35000 A 50-year-old security guard from Bhopal's TT Nagar area sent ₹35,000 across three separate transfers before he thought to call his actual friend. The line connected. His friend had no idea what he was talking about. The caller sounded exactly like someone the security guard trusted. The tone was right, the phrasing was right, and the urgency felt real. A QR code arrived shortly after the call. The security guard scanned it, transferred funds, then did it again, then a third time. TT Nagar police registered a case and launched an investigation after the security guard reported the fraud in April 2026. The voice that made the whole thing believable was almost certainly AI-generated. For a security guard, ₹35,000 is a serious sum to lose to a recording. ## Why Your Ears Cannot Protect You Voice cloning once required hours of audio and expensive equipment. Today, a convincing clone can be built from as little as 20 to 30 seconds of audio: a voicemail, a video clip, a fragment of a birthday call. Researchers studying deepfake audio detection have found that human accuracy at identifying fake voices hovers around 55 to 60 percent, barely better than a coin flip. The security guard did not fail some obvious test. He heard a familiar voice and responded the way any caring person would. Caller ID offered no protection either, since scammers routinely spoof numbers so the call appears to come from a known contact. The voice matched. The number matched. The urgency felt real. The QR code completed the trap. Payment via QR is fast, skips the moment where a victim might pause to type an account number, and is hard to trace once scanned. Three separate transfers suggest the scammer kept individual amounts small enough to avoid triggering suspicion. --- The callback revealed the fraud. It did not prevent it. By the time the security guard reached his actual friend, the money was already gone. Calling back on a number you already have is a useful step, but it confirms a crime after the fact rather than before money moves. A failed callback does not prove the original caller was legitimate; scammers sometimes work in pairs or target people who are traveling and hard to reach. If you believe someone may actually be in danger, contact local authorities. ## The Check That Would Have Stopped This What would have prevented it is a shared verification check that no AI clone can pass. Trust Onion gives you and the people in your life a set of three private rotating codewords calculated locally on your phone, with no server involved. If someone calls claiming to be your friend and asks for money, you ask: "What are the words?" A real friend who has Trust Onion set up with you answers instantly. A cloned voice cannot. The same check works when a caller claims to be from your bank, your landlord, or your employer. Familiar-sounding is not the same as verified. The security guard's story is not a story about someone who was careless. It is a story about a technology that has outpaced the instincts human beings rely on every day. The ears that once protected us are no longer enough. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - A Bhopal security guard lost ₹35,000 in April 2026 after a scammer used an AI-cloned voice of his friend to request urgent transfers via QR code. - Voice cloning now requires as little as 20 to 30 seconds of audio, and human accuracy at detecting fake AI voices is only around 55 to 60 percent, meaning your ears alone are not a reliable defense. - A callback can reveal fraud after the fact but does not prevent it; a shared private codeword check like Trust Onion's three rotating words is the verification that must happen before money moves. ## Frequently asked questions ### How did the Bhopal security guard lose money to a voice cloning scam? A scammer called the security guard using what appeared to be an AI-cloned version of his friend's voice, claimed urgent financial need, and sent a QR code. The security guard made three separate transfers totaling ₹35,000 before calling his actual friend and discovering the fraud. ### How can I tell if a caller is using an AI-cloned voice? You usually cannot tell by listening. Human detection accuracy for AI-generated voices is only around 55 to 60 percent. The safest approach is a pre-agreed private verification check, like Trust Onion's three rotating codewords, before sending any money or sensitive information. ### Is calling back the person enough to stay safe from voice cloning scams? Calling back on a number you already have is a useful step, but it confirms fraud after the fact rather than before money moves. A failed callback does not prove the original caller was legitimate. A shared private codeword check is faster and more reliable protection. ### What should I do if someone calls me pretending to be a friend and asks for money? Slow down, do not transfer anything immediately, and hang up. Call your friend back using a saved number. If you have Trust Onion set up, ask for the three words. If someone may be in danger, contact authorities. Report any fraud to your bank and local cyber crime cell right away. ### How does Trust Onion protect against AI voice cloning scams? Trust Onion gives you and anyone you choose a set of three private codewords that rotate every 60 seconds, calculated locally on your phone. A caller who cannot provide the current words, no matter how convincing their voice sounds, cannot be verified as the real person. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Set up your free three rotating codewords at trustonion.io and make "What are the words?" the question that protects you. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "FBI: $1.6 Billion Lost to Fake Cops and Government Impersonators" published: 2026-10-05T00:05:37.652Z updated: 2026-11-01T12:41:41.381Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/fbi-warning-government-impersonation-scams-2026 --- # FBI: $1.6 Billion Lost to Fake Cops and Government Impersonators **Cite as:** FBI: $1.6 Billion Lost to Fake Cops and Government Impersonators, Trust Onion, 2026-11-01. https://trustonion.io/blog/fbi-warning-government-impersonation-scams-2026 Between January 2025 and July 2026, the FBI received nearly 61,000 complaints, with combined losses of $1.6 billion, about callers who sounded like federal agents, local police, and government officials. The callers were scammers, not officials. The number on the screen matched a real federal agency. The voice was authoritative. The caller knew the victim's name and said there was a warrant out for their arrest. According to the FBI's Internet Crime Complaint Center, nearly 61,000 complaints about scenes like that were filed in eighteen months, with reported losses that exceeded $1.6 billion. The FBI issued a formal public service announcement about these schemes, and the figures make the case plainly: government impersonation is now one of the most costly fraud types in the country. The calls follow a reliable pattern. A supposed agent tells the target their Social Security number has been compromised, their bank account is under investigation, or they face imminent arrest. Sometimes the caller claims to be a foreign official with jurisdiction over a financial transaction. The demand that follows is always urgent: pay a fine, wire money, buy gift cards, hand over personal information to "clear your name." The pressure is designed to prevent the target from pausing long enough to think. Callers spoof real agency numbers deliberately, because a familiar-looking number drops a person's guard before a word is spoken. Spoofing requires minimal technical skill and almost no money. In some cases, scammers now use AI tools and fake video backgrounds to appear more convincing during video calls, presenting what looks like a federal office and an official in it. --- AI voice cloning sharpens the threat further. Modern tools can produce a convincing clone from [about 15 seconds of audio](https://www.npr.org/2024/04/04/1242933678/even-openai-says-its-new-voice-cloning-tool-has-major-potential-for-misuse), and the result can be nearly indistinguishable from the real person. Studies show people often can't tell a cloned voice from a real one. A scammer posing as a government contact you have spoken to before no longer needs to sound generic. The FBI's warning notes that victims are often told to keep the call secret, avoid speaking with family or friends, and act immediately. That isolation is intentional. A person who hangs up to check with someone else is a person who might escape. Any instruction to stay on the line and act now is itself a signal. No legitimate law enforcement agency or government body will call out of the blue and demand immediate payment to avoid arrest. That is not how legal processes work. If you receive a call like this, hang up. Find the agency's official number through their website or official documentation and call back yourself. One important limit: a successful callback does not prove the original caller was legitimate. If you believe someone may be in danger, contact emergency services directly. Report suspicious calls to the FBI's IC3 at ic3.gov. ## A Check Scammers Cannot Fake Spoofed numbers, AI-generated voices, fake credentials, realistic video backgrounds: the technical barriers to impersonation have fallen sharply. What scammers cannot produce is something they were never given. Trust Onion gives people a private three-word challenge to verify the people in their trusted group, such as family and close friends. The words rotate every 60 seconds. If a caller claims to be someone in that group, one question helps: "What are the words?" A cloned voice and a spoofed number do not come with the current words. Banks, agencies, and government offices sit outside that group, so verify them through official channels, using a number from their website, a card, or a statement. The FBI's numbers are not edge cases. $1.6 billion across 61,000 complaints in eighteen months is a sustained, professional operation. The callers are skilled and patient, and they need only a few minutes of panic to succeed. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - The FBI's Internet Crime Complaint Center recorded nearly 61,000 complaints and over $1.6 billion in losses from government impersonation scams between January 2025 and July 2026. - Scammers spoof real agency phone numbers and use AI voice tools and fake video backgrounds to appear convincing, making caller ID and familiar voices unreliable identity checks. - No real law enforcement agency will call unsolicited and demand immediate payment to avoid arrest; hanging up and calling back on an independently sourced number is smart, but does not prove the original caller was legitimate. ## Frequently asked questions ### How do scammers fake government phone numbers? Scammers use widely available spoofing tools to display any number they choose, including real FBI, SSA, or police department numbers. Caller ID shows what the caller sends, not who they actually are. ### Will a real government agency ever call me and ask for payment? No. Legitimate federal and local agencies do not call unsolicited to demand immediate payment or gift cards to avoid arrest. If a caller makes that demand, it is a scam. ### What should I do if I get a call from someone claiming to be law enforcement? Hang up. Find the agency's official number independently from their website or official documentation, call back yourself, and verify the claim. A successful callback does not prove the original caller was legitimate. Report suspicious calls to ic3.gov. ### How can AI voice cloning make these scams more dangerous? AI can clone a voice from about 15 seconds of audio, according to NPR's reporting on OpenAI's Voice Engine. Scammers can produce a convincing imitation of an official or someone you know, and studies show people often can't tell a cloned voice from a real one. ### How does Trust Onion help protect me from impersonation scams? Trust Onion gives you and your trusted group, such as family and close friends, a private three-word challenge. The words rotate every 60 seconds. If someone claiming to be in your group can't answer "What are the words?", treat the call as unverified. For agencies and banks, use official channels instead. ## More from Trust Onion Verify the people in your trusted group with Trust Onion. Verify For Free **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Cloning Is Already Inside Your Organization" published: 2026-10-04T00:06:30.480Z updated: 2026-10-11T06:11:46.544Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-workplace-fraud-enterprise --- # AI Voice Cloning Is Already Inside Your Organization **Cite as:** AI Voice Cloning Is Already Inside Your Organization, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-cloning-workplace-fraud-enterprise Sixty-two percent of organizations have already experienced a deepfake attack, according to Gartner, and the tool behind most of them requires nothing more than a short audio clip of your CEO speaking at a conference. The average cost of a successful vishing incident is $1.5 million in incident response alone. The call sounds exactly right: the cadence, the vocabulary, the slight hesitation before a number. Your finance team has no technical signal to flag it. AI voice cloning synthesizes a speaker's voice from recorded audio, and it now takes just 20 to 30 seconds of source material to produce a convincing replica capable of placing a real-time call to anyone inside your organization. Spam filters, call authentication systems, and email security tools don't apply here. The attack arrives as a voice. SoSafe's security awareness research confirms that cloned voices bypass technical filters entirely, which makes organizational training and verification protocols the primary defense. Most organizations don't have one that holds up. ## Four Ways This Attack Hits the Workplace The most financially damaging variant is CEO fraud. A cloned voice of the CEO or CFO calls a finance team member directly, requests an urgent wire transfer, and asks them to keep the transaction confidential until it clears. The urgency is manufactured; the authority sounds real. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every participant was a deepfake, including a synthetic version of a senior company officer. Voice-only attacks require even less infrastructure and are harder to detect in the moment. IT help desk manipulation works the same way. An attacker clones the voice of a known employee, calls the help desk to request a password reset or MFA bypass, and the operator complies because the voice gives them no reason to stop. The help desk operator is doing exactly what they're trained to do. MFA pressure attacks need no technical exploit at all. A cloned executive voice instructs an employee to approve a multi-factor authentication prompt, framing it as an IT systems test or an urgent access need. The employee approves manually, and the attacker captures the session. Voice cloning also serves as one layer inside multi-stage phishing campaigns. An employee receives a phishing email, then gets a follow-up call from a cloned executive voice confirming the email is legitimate. Written and voice confirmation together create a false sense of legitimacy that single-channel attacks can't match. ## The Procedural Gap Most organizations have invested in email filtering, endpoint protection, and network monitoring. None of those cover a phone call. The gap is procedural: most finance or IT workflows have no standard step that requires a caller to prove their identity before a high-stakes action is taken. Voice recognition is not identity verification. What feels like confirmation is actually familiarity, and AI exploits that difference directly. Trust Onion gives finance teams a concrete step that works even when the voice sounds exactly right. Every verified member of the organization shares access to three rotating codewords that update every 60 seconds, calculated locally on each device with no server connection required. When a call arrives claiming to be the CFO and requesting a wire transfer, a vendor payment change, or any urgent financial action, the finance team member asks one question: "What are the words?" The real CFO knows the answer. An impersonator does not. Words rotate on a schedule, so a compromised set expires automatically within 60 seconds, leaving no window for an attacker to use them later. A Proofie™, a selfie signed using your passkey in the Trust Onion app, can add a visual layer to the same verification workflow for higher-stakes confirmations. If a caller pressures your team to skip verification or move faster than process allows, slow down. Calling back on a known number is reasonable, but a successful callback does not prove the original caller was legitimate. Use a number sourced independently from the official directory, not one the caller provided. If you cannot complete verification through a trusted channel, do not authorize the transaction. Alert your security or compliance team immediately if you believe an impersonation attempt has occurred. The $1.5 million incident response figure doesn't include the wire amount itself, reputational damage, or regulatory scrutiny. The cost of a verification protocol is not comparable. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - According to Gartner, 62% of organizations have already experienced a deepfake attack, and successful vishing incidents cost an average of $1.5 million in incident response alone. - AI voice cloning bypasses technical filters entirely, making procedural verification the primary defense: before any wire approval or vendor change, ask "What are the words?" - A successful callback does not prove the original caller was legitimate; always use a number sourced independently from a trusted company directory, not one provided by the caller. ## Frequently asked questions ### How do criminals use AI voice cloning to commit CEO fraud? Attackers clone an executive's voice from publicly available audio, then call finance teams directly to authorize wire transfers or vendor payment changes. The call sounds authentic because the voice is a convincing replica, giving employees no technical signal to flag the request as fraudulent. ### Can calling back on a known number confirm a caller's identity? Not reliably. A successful callback does not prove the original caller was legitimate. Always use a number sourced independently from a trusted company directory, not one provided by the caller, and complete a separate identity verification step before authorizing any transaction. ### What is a rotating codeword protocol for voice fraud prevention? A rotating codeword protocol assigns a set of time-based words to verified personnel. Before authorizing any high-stakes action, a team member asks the caller to provide the current words. Words rotate every 60 seconds, so a cloned voice with no access to the codewords cannot pass verification. ### How common are deepfake attacks on businesses? According to Gartner, 62% of organizations have already experienced a deepfake attack. Successful vishing incidents cost an average of $1.5 million in incident response, separate from any funds transferred during the attack. ### What should a finance team member do if an executive call feels suspicious? Ask the verification question before taking any action. If the caller cannot provide the current codewords, do not authorize the transaction. Hang up, contact your security or compliance team, and reach the executive through a number sourced independently from your company directory. ## More from Trust Onion Add Trust Onion's rotating codeword check to your executive and wire-transfer approval workflows: before any wire approval, vendor change, or executive override, a finance team member asks "What are the words?" and only the real executive can answer. Protect Your Business Free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Scammers Are Impersonating the FBI's Own Fraud Hotline" published: 2026-10-03T00:09:42.546Z updated: 2026-10-11T06:12:43.259Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/scammers-impersonating-fbi-ic3-cybercrime-complaint-center --- # Scammers Are Impersonating the FBI's Own Fraud Hotline **Cite as:** Scammers Are Impersonating the FBI's Own Fraud Hotline, Trust Onion, 2026-10-11. https://trustonion.io/blog/scammers-impersonating-fbi-ic3-cybercrime-complaint-center You reported a scam to the FBI. Then someone claiming to be the FBI called back, said they'd found your money, and asked for a payment to release it. According to an August 2026 warning, that caller was a scammer. Someone who lost money to online fraud already knows how it feels to be fooled once. Recovery scammers count on that person wanting, badly, to believe the next call is different. The FBI's Internet Crime Complaint Center, IC3, is the official channel for reporting online fraud. It is legitimate, well-known, and trusted by millions of Americans. That trust is what scammers are now stealing. According to KPTV's August 2026 report on the FBI's public warning, scammers monitor social media for people who post about filing IC3 complaints, then contact those same victims posing as IC3 agents. The pitch is consistent: your funds have been located, and a payment is needed to release them. It is a second crime dressed as a rescue. ## How They Make It Look Real The FBI's warning identifies five methods used in combination: phone calls from numbers that appear official, emails mimicking IC3 branding, fake IC3 websites built to look nearly identical to the real one, AI deepfake videos of what appear to be real federal agents, and AI voice cloning. Voice cloning now requires as little as 20 to 30 seconds of audio. With enough publicly available recordings of real officials, scammers can generate a voice that clears every instinct a person has. The caller sounds right. The email looks right. The website looks right. The psychology of targeting fraud victims twice is deliberate. People who have already lost money want a resolution. When someone calls claiming to be with the FBI and says the funds are waiting, skepticism drops. Shame about the first scam can also make people reluctant to question a follow-up that seems official. This is not a character flaw. It is something these scammers build their entire model around. --- The real IC3 does not call victims to announce that lost funds have been recovered. It does not request fees, payments, or wire transfers in exchange for returning money. Any call making those claims is a scam. To reach IC3, type ic3.gov directly into your browser. If you receive a suspicious call from someone claiming to be with the FBI or IC3, hang up, then contact the FBI through ic3.gov or a number found independently at fbi.gov, not one the caller provided. One critical note: reaching a real agent when you call back confirms you dialed the right organization, but it does not prove the original caller was legitimate. Report the original contact so investigators can track the pattern. If someone may be in immediate danger, contact local law enforcement. ## A Check AI Cannot Fake For most of history, a familiar voice on a phone meant something. Caller ID meant something. Neither carries the same weight now. AI can clone a voice from a short audio sample, and caller ID can be spoofed to show any number, including government numbers. The answer is a verification layer these tools cannot reach. Trust Onion lets anyone verify a caller before trusting a call, email, or message. Three private rotating codewords, calculated locally on your phone with no server required, change every 60 seconds. A real contact you have set up in Trust Onion can answer. A scammer with a cloned voice, a spoofed number, and a fake website cannot know three private words that expire in under a minute and were never transmitted anywhere. If you believe you were contacted by someone impersonating IC3 or the FBI, report it at ic3.gov. Do not send money, do not provide personal information, and do not call back on any number the caller gave you. The FBI's own cybercrime division is now being impersonated with the same AI tools it warns the public about. That detail alone should settle the question of whether any caller, however official they sound, deserves your trust before you verify. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Scammers monitor social media to identify fraud victims and re-target them with fake IC3 recovery offers, making people who have already lost money the most vulnerable. - The FBI will never call to announce that lost funds have been recovered or ask for any payment to release them, and any such call is a scam to report at ic3.gov. - AI voice cloning, deepfake video, spoofed caller ID, and fake websites are all used together, making a private rotating codeword challenge the one check these tools cannot defeat. ## Frequently asked questions ### Is the FBI actually calling people to say their lost money was recovered? No. The real FBI and IC3 do not call victims to announce fund recovery or request payment fees. Any such call is a scam. Report it at ic3.gov. ### How do scammers find out I reported fraud to the FBI? They monitor social media. If you post publicly about reporting a scam or filing an IC3 complaint, scammers can identify you as a target and reach out posing as agents. ### How can I verify if a call is really from a government agency? Hang up and call back using a number found independently at fbi.gov or ic3.gov, never one the caller provided. Reaching a real agent confirms the line is official, but does not prove the original call was legitimate. ### Can AI voice cloning really fool people on a phone call? Yes. Voice cloning now requires as little as 20 to 30 seconds of audio and can produce a voice indistinguishable from the real person. Caller ID can be spoofed simultaneously to show an official-looking number. ### What is Trust Onion and how does it help with scam calls? Trust Onion is a free app that lets you verify a caller using three private rotating codewords that change every 60 seconds. A scammer using a cloned voice or fake number cannot know these words, so asking for them ends the scam. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords are free, simple, and impossible to fake. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Clones Your Doctor's Voice. Then Asks for Gift Cards." published: 2026-10-02T00:07:38.128Z updated: 2026-10-11T06:12:43.046Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-doctor-voice-scam-mandarin-speakers-victoria --- # AI Clones Your Doctor's Voice. Then Asks for Gift Cards. **Cite as:** AI Clones Your Doctor's Voice. Then Asks for Gift Cards., Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-doctor-voice-scam-mandarin-speakers-victoria Victoria Police issued a warning in September 2026 about scammers using AI voice cloning to impersonate GPs, surgeons, and other doctors, targeting Mandarin-speaking residents in Victoria. At least 10 people reported losses since early September, with some individuals losing up to $50,000. The call comes from your doctor's number. The voice is right. The name they use is yours. And they need you to buy gift cards immediately. Victoria Police confirmed at least 10 reports of this scam since early September 2026, with individual victims losing up to $50,000. Scammers clone a medical professional's voice using AI, use victims' real names to establish credibility, then manufacture a crisis: a billing discrepancy, a legal matter tied to medical records, a payment needed to release test results. The ask is always gift card codes sent by text. Researchers call the structure "authority plus urgency," and it works in sequence. A voice that sounds like your GP or specialist contacts you by name, possibly referencing a real clinic. A problem materialises that demands immediate action. Then comes the payment request in gift cards, which is where the scam departs from anything a real medical office would ever do. Once the codes are shared, the call ends. Gift cards are the payment of choice because they are instant, irreversible, and nearly impossible to trace. --- The sophistication lives in the opening steps. AI voice cloning now requires as little as 20 to 30 seconds of audio. A doctor who has appeared in a clinic welcome video, a local news segment, or a recorded voicemail greeting has likely provided enough source material. The resulting clone can hold a real-time conversation, respond to questions, and shift tone on demand. Caller ID is equally unreliable: scammers routinely spoof numbers to display a familiar clinic name. Hearing the right voice and seeing the right number on screen creates a convincing illusion even for careful people. Targeted campaigns against specific language communities are not accidental. Scammers choose them deliberately, often because language barriers create hesitation around reporting, or because trust in authority figures like doctors runs high. A cloned voice that sounds like a real, local professional adds another layer. If the caller already knows your name and mimics someone you have seen in person, questioning the call feels almost rude. Victoria Police advise hanging up and calling back on a number found independently, such as one from the clinic's official website, a card, or a statement. That is good advice, but a successful callback does not prove the original caller was legitimate. Scammers sometimes answer follow-up calls using the same spoofed number. Always source the number yourself, and if someone may be in danger, alert authorities. One check cuts through what voice cloning and spoofed caller ID cannot fake: a shared secret the scammer does not know. Trust Onion gives you three private rotating codewords, calculated locally on your phone, that only you and the people you trust can access. If someone calls claiming to be your doctor, your bank, or your insurer, one question settles it: "What are the words?" A real person you have verified with beforehand will know. A scammer with a cloned voice and a spoofed number will not. The words rotate every 60 seconds. Even if someone overheard them once, they expire fast. Voice cloning can replicate how someone sounds. It cannot replicate a shared secret that changes every minute and lives only on your device. Victoria Police urge anyone who received one of these calls to report it to ScamWatch at scamwatch.gov.au and to local police. Anyone who has already sent gift card codes should contact their bank immediately. The scammers targeting Mandarin-speaking Victorians are counting on the gap between hearing a trusted voice and questioning what you are actually being asked to do. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Victoria Police confirmed at least 10 reports of AI voice scam calls targeting Mandarin-speaking residents since early September 2026, with individual losses up to $50,000. - Scammers clone a doctor's voice using AI, use victims' real names to appear credible, then apply what researchers call "authority plus urgency" to pressure victims into buying gift cards and sharing the codes by text. - A shared private verification check, like Trust Onion's three rotating codewords, stops impersonation calls because a cloned voice cannot answer "What are the words?" with a secret that changes every 60 seconds. ## Frequently asked questions ### How can scammers sound exactly like my doctor on the phone? AI voice cloning tools can replicate a person's voice from as little as 20 to 30 seconds of audio. Clinic videos, news interviews, or voicemail greetings can provide enough source material. The resulting clone can hold a real-time conversation and respond naturally. ### Why do scammers ask for gift cards instead of a bank transfer? Gift card codes are instant, irreversible, and nearly impossible to trace. Once you share a code, the funds are effectively untraceable. No legitimate business, medical practice, or government agency will ever request payment in gift cards. ### How do scammers know my real name? Personal data is widely available through data breaches, purchased lists, and public records. Knowing your name does not mean the caller is legitimate. It is a technique to build false credibility, not evidence of a real relationship. ### Is calling back on an official number enough to stay safe? Calling back on a number found independently is a good step, but it does not prove the original caller was legitimate. Scammers can use spoofed numbers. Always source the number from an official website, card, or statement, and use a private verification method like Trust Onion's three rotating codewords for anyone you communicate with regularly. ### What should I do if I already sent gift card codes to a scammer? Contact your bank immediately and report the incident to ScamWatch at scamwatch.gov.au and to local police. Acting quickly improves the chances of limiting further loss, though gift card payments are very difficult to reverse. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords, free, and it works offline. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Wisconsin Seniors Lose $38K Per Scam. AI Is Why." published: 2026-10-02T00:02:42.205Z updated: 2026-10-11T06:12:43.041Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/wisconsin-ai-scams-targeting-seniors --- # Wisconsin Seniors Lose $38K Per Scam. AI Is Why. **Cite as:** Wisconsin Seniors Lose $38K Per Scam. AI Is Why., Trust Onion, 2026-10-11. https://trustonion.io/blog/wisconsin-ai-scams-targeting-seniors The voice on the phone sounds exactly like a grandson. He's scared, in trouble, needs money now. Wisconsin consumer protection officials reported in October 2026 that AI-powered scams are hitting older adults at median losses exceeding $38,000 per incident. That call is no longer rare, and it is no longer easy to detect. AI voice cloning requires about 20 to 30 seconds of audio. A birthday video on Facebook. A clip from a local news interview. A saved voicemail. That is enough to build a convincing copy of a grandchild's voice, and then the call comes in. Wisconsin advocates, consumer protection officials, and state lawmakers held a public awareness push in October 2026, warning that this technology is actively being used against older adults across the state. They called on Congress and major tech platforms, including Meta, to take legal responsibility for the infrastructure these scams run on. The formula behind the call is consistent even when the voice sounds unique. > "Grandma, it's me. I'm in trouble. Please don't tell Mom and Dad." First comes the emergency: a car accident, an arrest, a hospital abroad. Then comes the secrecy: "Please don't call Mom. She'll freak out. I just need you to help me quietly." That step isolates the target and cuts off any chance to verify the story with another family member. Then comes the ask: gift cards, a wire transfer, or cash handed to a courier at the door. The urgency never lets up. By the time the real grandchild calls on a Sunday afternoon, the money is gone. State officials in Wisconsin pointed to lower average digital literacy as a contributing factor. Many older adults grew up in a world where a voice on the phone was simply a voice on the phone. The $38,000 median loss figure is not a rounding error. That is retirement savings, handed over to someone who cloned a voice in under a minute. Because older adults are often too embarrassed to report the loss, or worry about losing financial independence if family finds out, real totals are likely far higher than what gets recorded. --- One standard piece of advice is to hang up and call the family member back on a number already saved in your contacts. That step is worth taking. But a successful callback does not prove the original call was fake. Sophisticated scammers sometimes pressure victims to call back on a "lawyer's" number instead. Always use a number from your own contacts, never one the caller provides. If you believe someone may actually be in danger, call 911 directly. A callback is one layer of protection, not the whole plan. ## "What Are the Words?" Trust Onion gives families three private codewords that rotate every 60 seconds, calculated locally on each phone with no internet connection required. When a suspicious call comes in, the person on the receiving end simply asks: "What are the words?" A real grandchild who has the app will know them instantly. A scammer with a cloned voice cannot answer. The words changed 40 seconds ago anyway. No voice analysis, no complicated process. One question, and three words confirm it is really them. ## What Families Can Do Today Talk about the scam before it happens. A conversation at the dinner table, describing how the call unfolds, is the single most effective preparation. Set up Trust Onion together: it is free, takes a few minutes, and once it is running every family member has a shared way to verify any call without relying on memory or judgment under pressure. Report any incident to the FTC at ReportFraud.ftc.gov and to Wisconsin's Department of Agriculture, Trade and Consumer Protection. Remind older family members that it is always acceptable to pause a call and ask a question. A real grandchild will understand. A scammer will push back, and that reaction is information in itself. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Wisconsin consumer protection officials reported in October 2026 that AI scam losses among older adults exceed $38,000 per incident at the median, and real totals are likely higher because many incidents go unreported. - AI voice cloning requires only 20 to 30 seconds of audio, making it easy for scammers to fake a grandchild's voice convincingly enough that even close family members often cannot detect it by ear. - Asking "What are the words?" using Trust Onion's three rotating codewords stops a cloned voice cold, but families should also call back on a known number and dial 911 if they believe someone may genuinely be in danger. ## Frequently asked questions ### How are AI scams targeting seniors in Wisconsin? Scammers use AI voice cloning to imitate a grandchild or family member in distress, then pressure older adults to send money quickly and secretly. Wisconsin officials reported in October 2026 that median losses exceed $38,000 per incident. ### Can you tell if a phone call is using a cloned AI voice? Often, no. Voice cloning technology has advanced to the point where even close family members cannot reliably detect a fake voice by ear. Human detection accuracy hovers around 55 to 60 percent, barely better than a coin flip. ### What should a grandparent do if they get a suspicious call from a grandchild? Ask "What are the words?" If the caller can't answer, hang up and call back on a number already saved in your contacts, not one the caller provides. A successful callback alone doesn't prove the original call was fake. If someone may be in real danger, call 911. ### What is Trust Onion and how does it protect older adults from scams? Trust Onion is a free app that gives families three private codewords rotating every 60 seconds. When an unexpected call comes in, the older adult asks for the words. A real family member knows them instantly. A scammer with a cloned voice does not. ### Why are seniors more vulnerable to AI voice cloning scams? Wisconsin officials cited lower average digital literacy and the genuine trust older adults place in family voices. Scammers exploit that trust by layering in secrecy and urgency, cutting the older adult off from checking the story with anyone else. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free, works offline, and takes minutes to set up. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone and Fake WhatsApp Cost Italian Bank €95M" published: 2026-10-01T00:09:11.367Z updated: 2026-10-11T06:12:44.102Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-clone-fake-whatsapp-italian-bank-wire-fraud --- # AI Voice Clone and Fake WhatsApp Cost Italian Bank €95M **Cite as:** AI Voice Clone and Fake WhatsApp Cost Italian Bank €95M, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-clone-fake-whatsapp-italian-bank-wire-fraud A spoofed WhatsApp message and an AI-cloned voice were all it took to convince the chairman of Fideuram, one of Italy's largest private banks, to authorize roughly €95 million in wire transfers to accounts in China and Hong Kong. International investigators recovered about €53 million. Around €36 million has not been found. Paolo Molesini received two things in quick succession: a written message appearing to come from Intesa Sanpaolo CEO Carlo Messina via WhatsApp, and a phone call from someone who sounded exactly like a senior partner at a trusted law firm. Both were fabricated. Together, they were enough. The fraud unfolded in late September 2026 and stripped Fideuram of approximately €95 million. International cooperation recovered about €53 million. Around €36 million passed through overseas accounts, was converted to cryptocurrency, and has not been traced. The design was deliberate. A single spoofed message is easier to question. A single voice call, however convincing, invites a second opinion. Running both simultaneously manufactured the appearance of independent corroboration: a written instruction from the CEO, a verbal endorsement from legal counsel. Two sources, two channels, one fraudulent outcome. ## How the Channels Reinforced Each Other Voice cloning now requires as little as 20 to 30 seconds of audio to produce a convincing replica. Earnings calls, investor presentations, and media interviews give fraudsters ample raw material to clone a named executive or professional. WhatsApp spoofing adds a written layer that looks familiar, and each channel made the other more believable. This exploits a specific cognitive shortcut: corroboration implies legitimacy. When two trusted contacts appear to confirm the same instruction at the same time, the instinct to pause and verify weakens. According to the FBI's Internet Crime Complaint Center, business email and voice compromise schemes produced losses exceeding $2.9 billion in 2023 alone. Attacks on senior executives follow a different logic than standard phishing. Fraudsters do not need to compromise systems. They need to compromise judgment. A chairman authorizing a large international transfer is doing something within his normal authority. The action itself is not unusual. Only the instruction behind it is fraudulent. ## The Gap Standard Controls Cannot Close Most organizations build fraud controls around transaction size and destination. Those controls address the payment, not the authorization behind it, which is where this fraud actually occurred. The attacker did not defeat a technical system. The attacker replaced a person. A common response to cases like this is to call back on a known number before approving any large transfer. That step is worth taking, but a successful callback only confirms you reached the real person on a second attempt. It does not prove the original caller was legitimate. Verification must happen before approval, not after the funds have moved. If someone appears to be under duress during a high-stakes approval, alert authorities directly. Voice and written communication are treated as inherently trusted channels. Both can be fabricated. Both were fabricated here. Trust Onion addresses this with rotating three-word codewords, shared only within a verified chain of personnel and calculated locally on each device with no server dependency. Before any wire authorization, the finance team member asks one question: "What are the words?" The real executive knows them. An impersonator does not. A cloned voice cannot answer. For a higher-stakes visual check, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. Verification checks the passkey signature against the full public key, the original photo's SHA-256 hash, and the signed record, binding that key to the exact image and the date, time, and location at signing. It does not, by itself, guarantee the intended person's physical presence. In the Fideuram scenario, a codeword challenge inserted before the transfer authorization would have stopped the payment chain before the first euro left the account. €36 million is still missing. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Fraudsters combined a spoofed WhatsApp message and an AI-cloned voice to steal approximately €95 million from Fideuram chairman Paolo Molesini in 2026, with around €36 million still untraced after conversion to cryptocurrency. - The two-channel approach manufactured the appearance of independent corroboration, making the fraudulent instruction far more convincing than either channel could have achieved alone. - A rotating codeword challenge inserted before any wire authorization would have exposed the impersonator before a single euro moved, because a cloned voice cannot produce words it does not have. ## Frequently asked questions ### How did fraudsters steal €95 million from an Italian bank using AI? Attackers used a spoofed WhatsApp message impersonating Intesa Sanpaolo CEO Carlo Messina and an AI-cloned voice impersonating a law firm partner to convince Fideuram chairman Paolo Molesini to authorize large international wire transfers. The two channels made the instruction appear to come from two independent trusted sources simultaneously. ### What is a two-channel voice and text fraud attack? A two-channel attack combines a written message, such as a WhatsApp or email, with a phone or audio call to create the appearance of independent corroboration. When two seemingly separate trusted contacts confirm the same instruction, targets are far less likely to challenge it before acting. ### How can finance teams verify executive wire transfer requests? Finance teams should require a codeword challenge before approving any wire transfer or payment instruction change. Rotating codewords shared only with verified personnel cannot be obtained from public audio, spoofed messages, or AI-cloned voices. The real executive knows the current words; an impersonator does not. ### Does calling back on a known number confirm a caller's identity? A successful callback confirms you reached the real person on a second attempt, but it does not prove the original caller was legitimate. For high-stakes approvals, verification must happen before the transfer is authorized, not after funds have already moved. ### How much of the Fideuram fraud money was recovered? International cooperation recovered approximately €53 million of the roughly €95 million transferred. Around €36 million remains untraced after passing through overseas accounts and being converted to cryptocurrency. ## More from Trust Onion Add Trust Onion's rotating codeword check to executive and wire-transfer approvals: before any wire, vendor change, or urgent payment instruction, your team asks "What are the words?" and only the real executive can answer. Protect Your Business Free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Banks Say You Authorized It. AI Scams Are Why That's Devastating." published: 2026-10-01T00:04:35.809Z updated: 2026-10-11T06:12:44.580Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/banks-say-you-authorized-it-ai-scams-cost-victims-everything --- # Banks Say You Authorized It. AI Scams Are Why That's Devastating. **Cite as:** Banks Say You Authorized It. AI Scams Are Why That's Devastating., Trust Onion, 2026-10-11. https://trustonion.io/blog/banks-say-you-authorized-it-ai-scams-cost-victims-everything The Consumer Financial Protection Bureau recorded a 1,317% spike in domestic money transfer complaints in 2025. The reason, in most cases, is the same: the victim moved the money themselves. The call sounds exactly right. A calm, professional voice identifies itself as your bank's fraud department, names your account, describes suspicious activity, and tells you to move your funds to a safe account immediately. You do it. Then you learn your bank will not give it back, because in the eyes of federal law, you authorized the transfer. This is the loophole that AI-powered impersonation has turned into a highway. The Electronic Fund Transfer Act protects consumers from unauthorized transfers. When a scammer tricks you into initiating the transfer yourself, banks classify the transaction as authorized, and authorized transfers are largely your problem. Courts have often agreed. A 2025 Senate investigation found that major U.S. banks reimbursed less than half of the fraud losses reported through Zelle. The CFPB's 1,317% figure is not a typo. More than thirteen times the baseline, in a single year, driven by AI voice synthesis tools that can replicate any voice from as little as 20 to 30 seconds of audio. A voicemail, a social media video, a recorded greeting is enough. Human detection accuracy for cloned voices hovers around 55 to 60 percent, barely better than a coin flip. --- The script follows a pattern. The caller has details: your name, your bank, sometimes recent transactions pulled from data breaches. They describe an emergency. A new device was just linked. Act now or lose everything. Then comes the instruction to wire funds, move money, or purchase gift cards. The specifics vary. The pressure does not. The moment you initiate that transfer, the legal clock resets against you. Caller ID spoofing means the call can display your actual bank's number, the same digits printed on your card. So the standard advice, "hang up and call the number on the back of your card," is necessary but not sufficient on its own. Hanging up is the right first move. But a callback alone does not tell you whether the original call was real. Use a number from your physical card, an official statement, or the bank's official website, never one the caller provides. A successful callback to the real bank number does not prove the original caller was legitimate. If you believe someone is in immediate danger, alert authorities. ## When the Voice Is Someone You Know AI scams now fake two signals people have always trusted: the caller ID match and the familiar voice. For calls from people you know personally, Trust Onion adds a check that neither AI nor a spoofed number can pass. The app generates three private rotating codewords shared only between you and your trusted contacts, calculated locally on your device, no server required. The words change every 60 seconds. If someone calls claiming to be a person you know, ask: "What are the words?" A real person with your Trust Onion setup answers instantly. A cloned voice cannot. For calls from institutions like a bank, there are no shared codewords, which is exactly why the callback discipline matters so much: hang up, find the number independently, and take your time before moving a dollar. ## What to Do When the Call Comes Urgency is the mechanism. The moment a caller tells you to act fast or lose everything is precisely when you should stop. Hang up. Call back on a number you sourced yourself. If someone claims to be a person you know, ask for the words. Report scam calls to the FTC at reportfraud.ftc.gov. The legal protection most people assume they have may not apply the moment they initiate that first transfer. The 1,317% spike in complaints is not a statistic about other people. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - The CFPB recorded a 1,317% spike in domestic money transfer complaints in 2025, driven largely by AI-powered impersonation scams. - When scammers trick you into moving your own money, banks classify the transfer as 'authorized' and often deny refunds under current federal law. - AI voice cloning can replicate any voice from 20 to 30 seconds of audio, and human detection accuracy for cloned voices hovers around 55 to 60 percent, barely better than a coin flip. ## Frequently asked questions ### Why won't my bank refund money I lost to a phone scam? If you initiated the transfer yourself, even after being deceived, banks classify it as authorized. Federal protections under the Electronic Fund Transfer Act apply mainly to unauthorized transfers, leaving scam victims with limited recourse. A 2025 Senate investigation found major U.S. banks reimbursed less than half of fraud losses reported through Zelle. ### How do AI voice cloning scams work on the phone? Scammers generate a convincing voice from as little as 20 to 30 seconds of audio, then call victims while impersonating a bank, agency, or known person. Caller ID can be spoofed to show a real bank number. Human detection accuracy for cloned voices hovers around 55 to 60 percent, barely better than a coin flip. ### Is hanging up and calling back my bank enough to stay safe? Hanging up is the right first move. Call back using a number from your card or an official statement, never one the caller provided. But a successful callback to a real bank number does not confirm the original call was legitimate. Take your time and trust your instincts before moving any money. ### How can I verify a caller is really from my bank or someone I know? For people you trust personally, a shared private verification code adds a check beyond voice or caller ID. For institutions like banks, hang up and call back on an independently sourced number. Never act on financial instructions from an unverified caller, and remember that a callback alone does not prove the original caller was legitimate. ### How much has AI phone fraud increased recently? The CFPB reported a 1,317% increase in domestic money transfer complaints in 2025 compared to the prior two-year average. AI voice cloning tools now require as little as 20 to 30 seconds of audio to clone a voice convincingly, and human detection accuracy for cloned voices hovers around 55 to 60 percent. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords, free forever, no server required. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "How a Cloned Voice Moved €95 Million Out of an Italian Bank" published: 2026-09-29T00:03:51.094Z updated: 2026-10-09T00:17:06.715Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-clone-wire-fraud-italian-bank-95-million --- # How a Cloned Voice Moved €95 Million Out of an Italian Bank **Cite as:** How a Cloned Voice Moved €95 Million Out of an Italian Bank, Trust Onion, 2026-10-09. https://trustonion.io/blog/ai-voice-clone-wire-fraud-italian-bank-95-million A fake WhatsApp message and a cloned voice were enough to move €95 million out of one of Italy's most prominent private banks. The chairman of Fideuram, Paolo Molesini, received what appeared to be a message from Intesa Sanpaolo CEO Carlo Messina, followed by a phone call from someone posing as a senior law firm partner. Molesini authorized the transfers. The bank later recovered approximately €53 million through international cooperation. Roughly €36 million was converted to cryptocurrency and is still missing. ## The Attack, Step by Step The fraud against Fideuram followed a pattern that is becoming more common in corporate finance: a trusted name, a plausible story, and a sense of urgency. Fraudsters sent a WhatsApp message impersonating Carlo Messina, CEO of Intesa Sanpaolo, Fideuram's parent group. The message established context and credibility. Then came the phone call, a voice cloned to sound like a senior law firm partner, providing what sounded like authoritative legal cover for a series of overseas wire transfers. Molesini instructed Fideuram's finance department to move the funds to accounts in China and Hong Kong. The total: €95 million. The bank's anomaly detection systems eventually flagged the transfers. With international law enforcement cooperation, about €53 million was recovered. The remaining €36 million had already been converted into cryptocurrency and is gone. Milan prosecutors placed at least one foreign national under investigation for computer fraud. Molesini resigned. ## Why This Attack Worked The combination of a text message and a follow-up phone call is deliberate. The message primes the target. The voice call closes the deal. Voice cloning now requires as little as 20 to 30 seconds of audio. Executives give speeches, appear in earnings calls, and conduct media interviews, so their voices are publicly available. A motivated fraudster can build a convincing audio model from material that is already online. The law firm impersonation added a second layer of apparent authority. The caller was not asking for the transfer; the caller was confirming it was legally sanctioned. That framing shifts the psychology: the target is no longer approving an unusual request, they are complying with an already-established decision. This is a social vulnerability, not a technical one. The attack exploited the normal way senior executives communicate, through trusted names, informal channels, and verbal authorization. ## The Scale of the Problem The Fideuram case is not an outlier. In February 2024, engineering firm Arup lost $25 million after an employee joined a video call where every participant, including the CFO, was a deepfake. The employee transferred funds based on instructions given during that call. According to the FBI's Internet Crime Complaint Center, business email compromise and related fraud schemes cost U.S. organizations more than $2.9 billion in 2023 alone. Voice fraud is pushing that figure higher. The World Economic Forum reported a 500% increase in deepfake fraud attempts in 2024. The common thread across these incidents is not a failure of technology. It is a failure of verification. Organizations have no standard protocol for confirming, in real time, that the person authorizing a significant financial action is actually who they say they are. ## What Finance Teams Are Missing Most organizations rely on one or more of the following when handling executive payment requests: caller ID or contact name recognition, familiarity with the executive's voice, the apparent logic of the request, or a follow-up email confirming the instruction. None of these hold. Caller ID can be spoofed. Voice can be cloned. A plausible story is part of the attack design. A follow-up email from a compromised or spoofed account confirms nothing. Calling back the number that contacted you is not a reliable check either. Fraudsters can maintain spoofed lines or use intermediaries who stay in character. If you verify through a callback, use a number sourced independently from your organization's own records, not the number that appeared in the original call or message. The underlying problem is structural. Finance teams have no shared secret with the executives they take instructions from, nothing that the real executive knows and a fraudster cannot fake. ## The Operational Control That Stops This Trust Onion gives finance teams exactly that: a shared secret that rotates every 60 seconds and cannot be guessed, cloned, or intercepted. The concept is straightforward. Everyone in a verified authorization chain carries three rotating codewords, generated locally on each device with no server required. When an executive calls to authorize a wire transfer, a vendor payment change, or any high-stakes action, the finance team member asks one question: "What are the words?" The real CFO answers correctly. An impersonator cannot. The words that were valid 90 seconds ago have already expired, so a recorded answer from a previous call is useless. A Proofie™ is a selfie signed by your passkey the moment you take it. Share the link, and anyone can check in their own browser that your key signed this exact photo, after a known moment, and that nothing has changed since. A standard P-256 WebAuthn passkey signs after Face ID, fingerprint or device-passcode unlock. The signature must carry both user-presence and user-verification flags. This is not a crypto-wallet signature. Identity is the full signing public key, not its shortened label. Save a previously trusted key to recognize later Proofies from the same key. This does not automatically verify a real-world identity or detect AI-generated images. Signed time and place cannot be changed undetected; they are not independent proof of physical whereabouts or exact capture time. Family codewords work alongside Proofies, not as an overlay or signed field. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved. If Fideuram's finance department had been operating under a codeword protocol, the fraudster's cloned voice would have hit a wall the moment someone asked: "What are the words?" The call would have ended there. The €95 million would not have moved. ## Building the Habit Before the Attack Arrives Adding an executive verification layer is not complicated. The challenge is making it a standing operational requirement before a fraud attempt, not a reaction to one. The policy is simple: no wire transfer, no vendor account change, no large payment approval proceeds without the caller providing the current codewords. The policy applies regardless of who is calling, the CEO included, especially the CEO. This removes the social pressure that makes these attacks effective. A finance team member does not need to judge whether the caller sounds right, whether the story is plausible, or whether questioning a senior executive will cause offense. The question is neutral and non-negotiable: "What are the words?" Trust Onion is free to deploy, works offline, and requires no integration with existing systems. Any finance team can activate it today. The €36 million still missing from Fideuram's accounts shows what happens when authorization depends entirely on trust in a voice. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Fraudsters used a cloned voice and a fake WhatsApp message to authorize €95 million in wire transfers from Fideuram in 2026. - Roughly €36 million was converted to cryptocurrency before recovery efforts and remains missing. - Voice cloning requires as little as 20 to 30 seconds of audio, making any public-facing executive a potential target. - A callback to the number that called you does not confirm the original caller was legitimate; always use independently sourced contact information. - A rotating codeword protocol gives finance teams a shared secret that an impersonator cannot fake, even with a perfect voice clone. ## Frequently asked questions ### How did scammers steal €95 million from Fideuram? Fraudsters sent a fake WhatsApp message impersonating Intesa Sanpaolo CEO Carlo Messina, then followed up with an AI-cloned phone call posing as a law firm partner. Fideuram Chairman Paolo Molesini authorized the transfers. Roughly €36 million remains unrecovered after being converted to cryptocurrency. ### Can AI really clone an executive's voice convincingly enough to fool a finance team? Yes. Voice cloning now requires as little as 20 to 30 seconds of audio. Executives who appear in earnings calls, media interviews, or public events provide more than enough source material. Human detection accuracy for cloned voices hovers around 55 to 60 percent, barely better than a coin flip. ### Is calling back the number that contacted you a safe way to verify an executive request? No. A failed callback does not prove the original caller was legitimate. Fraudsters can maintain spoofed lines or use intermediaries. Always use a number from your organization's own independently sourced records, not the number that appeared in the original call. ### What is a rotating codeword protocol and how does it stop voice fraud? A rotating codeword protocol gives every verified team member access to three shared codewords that change every 60 seconds. A finance team member asks any caller claiming to be an executive: 'What are the words?' A legitimate executive answers correctly. An impersonator cannot, regardless of how convincing their voice sounds. ### How much does it cost to add executive call verification to a finance team? Trust Onion is free. It works offline, requires no server, and can be deployed across an entire organization without technical integration. The codewords rotate automatically and expire, so a compromised word becomes useless within 60 seconds. ## More from Trust Onion Add Trust Onion's rotating codeword check to every executive approval and wire transfer request. Three words, verified in seconds, free for your entire team. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Scammers Are Posing as FBI Agents to Re-Scam Victims" published: 2026-09-27T00:02:33.433Z updated: 2026-10-11T06:12:44.092Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/scammers-posing-as-fbi-agents-ic3-impersonation --- # Scammers Are Posing as FBI Agents to Re-Scam Victims **Cite as:** Scammers Are Posing as FBI Agents to Re-Scam Victims, Trust Onion, 2026-10-11. https://trustonion.io/blog/scammers-posing-as-fbi-agents-ic3-impersonation Between December 2023 and February 2025, the FBI received more than 100 complaints from people who fell for exactly this scheme: someone calls claiming to be an IC3 agent, uses a real agent's name, and offers to help recover stolen money. It is round two of the same trap. The FBI's Internet Crime Complaint Center is a real federal agency. Millions of Americans use it to report online fraud. Scammers have figured out that people who file those complaints are proven targets. They've already been victimized once. They want their money back. They trust the government to help. So the scammers call them, pretending to be IC3 agents. The FBI issued a formal public warning about this scheme, confirming the pattern: the real IC3 will never contact you proactively and will never ask for money or personal information over the phone. ## How the Scam Works Callers spoof real FBI phone numbers, so your caller ID shows a legitimate federal number. When your phone reads "FBI Washington DC" with a number that checks out on a quick search, the natural instinct is to trust it. They use real agents' names, sometimes pulled from public FBI directories or news coverage, and they may reference details from your original complaint. Then comes the ask. Sometimes they want an upfront recovery fee to release your stolen funds. Sometimes they want your Social Security number, bank account details, or identity documents to "verify your claim." Either way, the goal is the same: take more from someone who has already lost. These callers are practiced. They know the right terminology, they sound calm and official, and they know you're frustrated and desperate. A real federal agent and a skilled impostor can sound identical on a phone call. ## The Callback Problem A common instinct is to hang up and call back on a number you find yourself. That's a good step, but it has a limit. If you hang up and call the real IC3, you'll reach the real agency, but that doesn't tell you whether the person who originally called you was legitimate or a scammer. Hanging up and verifying through an official channel confirms the institution exists. It does not verify the individual. Always use a number from the institution's official website, a government-issued card, or a statement. Never call back a number the caller gave you. If you believe someone is in immediate danger or a crime is actively in progress, contact local authorities directly. The real IC3 operates at ic3.gov. Agents do not typically call victims to follow up, offer money recovery, or ask for payment to process a case. If someone calls claiming to be from the FBI or IC3 and asks for money or personal data, that is not the FBI. Authority is one of the easiest things to impersonate: a name, a phone number, a confident tone. None of those require the real thing. AI is making that performance cheaper, too. Voice cloning can generate a convincing replica of someone's voice from as little as 20 to 30 seconds of audio, and public figures, including real FBI agents who have appeared in news segments or official videos, already have that audio available online. The question "does this sound like someone official?" is no longer a reliable filter. Trust Onion gives you a check that spoofing cannot beat. You and a person or institution you want to verify share three private codewords through the app. Those words rotate every 60 seconds, calculated locally on your phone with no server required. When someone calls claiming to be that person or institution, you ask: "What are the words?" A real person who has the app gives you the current three words. An impostor, no matter how convincing they sound or whose number they're spoofing, cannot answer. Stolen words expire. There is no database to hack. Note that a successful callback to the real IC3 does not prove the original caller was legitimate. Use ic3.gov and fbi.gov to find contact information yourself, and report any suspicious call there. You can also report to the FTC at reportfraud.ftc.gov. Being targeted by this scam says nothing about your intelligence or judgment. These operations are run by professional fraudsters who spend their days refining their technique. The real IC3 isn't going to call you out of the blue, but if someone does, that question takes seconds to ask and ends the con immediately. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Scammers impersonate FBI IC3 agents to re-target people who already reported online fraud, spoofing real phone numbers and using real agents' names. - The real IC3 will never call you unsolicited, ask for payment, or request personal information over the phone; if a caller does any of these things, hang up and report at ic3.gov. - Caller ID, a convincing voice, and even a successful callback to the real institution cannot confirm the original caller was legitimate; Trust Onion's three rotating codewords give you a verification check that spoofed numbers and AI-cloned voices cannot beat. ## Frequently asked questions ### How do I know if someone claiming to be from the FBI is real? The real IC3 does not call victims unsolicited or ask for money. If you receive such a call, hang up and contact the FBI directly through fbi.gov or ic3.gov using contact information you find yourself, not a number the caller provided. A successful callback confirms the institution exists but does not verify the original caller. ### Can scammers fake an FBI phone number on caller ID? Yes. Caller ID spoofing is cheap and easy. A number that looks like a legitimate FBI line is not proof the caller is actually from the FBI. Never rely on caller ID alone to verify someone's identity. ### What should I do if I already gave money or information to someone posing as the FBI? Report it immediately at ic3.gov and to the FTC at reportfraud.ftc.gov. Contact your bank if you shared financial information. Reach your local FBI field office through a number listed on fbi.gov. ### How does Trust Onion protect against impersonation scams? Trust Onion lets you verify any caller with three private codewords that rotate every 60 seconds. A real person you've registered with can confirm the current words. A scammer cannot, no matter how convincing they sound. ### Is it safe to call the FBI back if I get a suspicious call? Calling back through an official number from fbi.gov is a good step, but remember: it confirms the institution exists, not that the original caller was real. Use the official website to find contact information, and never call a number the suspicious caller gave you. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Verify For Free **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Cloning Apps Have No Consent Checks. None." published: 2026-09-23T00:07:19.552Z updated: 2026-10-11T06:12:44.578Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-apps-no-consent-checks-family-scams --- # AI Voice Cloning Apps Have No Consent Checks. None. **Cite as:** AI Voice Cloning Apps Have No Consent Checks. None., Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-cloning-apps-no-consent-checks-family-scams A Hong Kong company wired $25 million to fraudsters in 2024 because an employee trusted a voice. The voice belonged to the company's CFO. Except it didn't. The clone was built from audio scraped off the internet, and it was convincing enough to move $25 million in a single transaction. In January 2026, BGR covered a Consumer Reports investigation into the biggest AI voice cloning platforms on the market. ElevenLabs, Speechify, PlayAI, and Lovo, four of the most widely used services, have no technical mechanisms to confirm that the person being cloned has given consent. Anyone can upload a few seconds of audio and get a voice back. These are not fringe tools. They have millions of users, legitimate business customers, and polished interfaces built for podcasters and marketers. Consumer Reports found the same technology is wide open to anyone who wants to sound like your boss, your CFO, or your finance director. ## The Numbers Voice cloning now requires just 20 to 30 seconds of audio, and that audio doesn't have to come from a private conversation. A voicemail, a video posted on social media, a clip from a podcast interview, that's enough. The FTC reported that Americans lost $2.7 billion to imposter scams in 2023, and AI voice tools are accelerating the trend. Researchers at McAfee found that 77% of voice cloning scam victims lost money, with 36% losing more than $1,000. Human detection accuracy for cloned voices sits at 55 to 60 percent, barely better than a coin flip, according to researchers at University College London. The playbook is simple. Scammers find audio of the person they want to impersonate, feed it into a cloning app, and call. No verification required, no consent check, no flagging system. They use the cloned voice to create urgency: "I'm in trouble," "I need money right now," "Don't tell anyone, just send it." The emotional pressure is designed to short-circuit judgment. When the voice sounds right, the brain wants to believe it. ## What "Hang Up and Call Back" Doesn't Solve The standard advice when you get a suspicious call is to hang up and call the person back on a number you already have. That step is worth taking, but a successful callback does not prove the original caller was legitimate. Sophisticated scammers can spoof numbers or manipulate context. For any request involving moving money or changing vendor details, verify through a second channel before acting, and if someone may be in danger, contact local authorities. This is exactly the kind of request that Trust Onion's three rotating codewords stop cold. Before approving a wire transfer, changing vendor payment details, or acting on an urgent executive request, staff ask one question: "What are the words?" The codewords rotate every 60 seconds, calculated locally on each authorized person's device, with no server and no internet required. A clone can sound like your CFO. It cannot know three private codewords that change every minute and were never said out loud anywhere a microphone could hear them. The Consumer Reports investigation made one thing plain: ElevenLabs, Speechify, PlayAI, and Lovo were designed for speed and quality, not consent. ElevenLabs added some restrictions after a 2023 backlash over fake audio of public figures, but restrictions are not verification. A policy buried in a terms-of-service document does not stop someone from uploading 30 seconds of a stranger's voice. Regulation moves slowly. The scammers using these tools are not waiting for a terms-of-service update. The scam fails the moment the caller can't answer the question. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Consumer Reports found that ElevenLabs, Speechify, PlayAI, and Lovo have no technical consent verification before cloning a voice. - Voice cloning requires only 20 to 30 seconds of audio, and human accuracy at detecting cloned voices is just 55 to 60 percent, making your ears an unreliable defense. - Hanging up and calling back is a good first step, but it does not prove the original caller was legitimate; a second verification channel is required before any money moves. ## Frequently asked questions ### How much audio does it take to clone someone's voice? As little as 20 to 30 seconds of clear audio is enough for modern AI voice cloning tools to produce a convincing replica. That audio can come from voicemails, social media videos, or any public recording. ### Are AI voice cloning apps legal? Most voice cloning apps operate legally, but using them to impersonate someone for financial gain is fraud. The problem is that platforms like ElevenLabs and Speechify have no technical systems to verify consent before a voice is cloned. ### How can I tell if a call is using a cloned voice? You often can't. Human detection accuracy for AI-cloned voices sits at around 55 to 60 percent. The safest approach is a pre-arranged verification method, like rotating team codewords, rather than trusting your ears. ### What should I do if I get a suspicious call from a family member? Hang up and call the family member back on their usual number. If you can't reach them and believe they may be in danger, contact local authorities. A successful callback does not prove the original call was legitimate. ### How do Trust Onion's three rotating codewords stop voice cloning scams? The codewords change every 60 seconds and are calculated locally on each authorized person's device. A scammer using a cloned voice has no way to know the current words, so any caller who can't answer "What are the words?" is immediately exposed. ## More from Trust Onion Give your finance and operations teams a simple two-factor check for high-stakes requests. Before any wire moves, staff ask "What are the words?" and a cloned voice will never have the answer, set up Trust Onion free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Scammers Are Cloning Your Voice to Trick You Into Trusting Them" published: 2026-09-21T00:05:54.172Z updated: 2026-10-11T06:12:45.494Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/scammers-cloning-your-voice-phone-scams --- # Scammers Are Cloning Your Voice to Trick You Into Trusting Them **Cite as:** Scammers Are Cloning Your Voice to Trick You Into Trusting Them, Trust Onion, 2026-10-11. https://trustonion.io/blog/scammers-cloning-your-voice-phone-scams University of Cincinnati marketing professor Kimberly Hyun has a warning: scammers can clone your voice from a few seconds of audio pulled from a voicemail or a social media video, then use it against you on a live call. Your brain, wired to trust what sounds like you, drops its guard before you've made a conscious decision. The audio requirement is almost nothing. Three to five seconds from a voicemail greeting, a Facebook video, a recorded work presentation. Feed it into widely available AI tools and you have a synthetic voice that can speak any script in real time. Hyun's research, cited in a September 2026 Wall Street Journal investigation into AI-powered phone scams, identifies the specific mechanism that makes this effective. Hearing a voice similar to your own triggers the similarity-attraction effect, a psychological response that raises perceived trustworthiness before the content of what's being said even registers. The FTC consistently ranks imposter scams among the most common fraud types reported by American consumers, and voice cloning makes those scams more persuasive and far harder to detect. Human ability to distinguish a cloned voice from a real one sits between 55 and 60 percent, roughly a coin flip. ## The Direction Nobody Talks About Most coverage of AI voice scams focuses on criminals impersonating someone the victim loves: a child in trouble, a boss making an urgent request. Hyun's research adds a layer. Scammers aren't just impersonating people you care about. They may be impersonating you to yourself, using your own vocal patterns to generate rapport from the first second of the call. Urgency, secrecy, and emotional pressure do the rest. The voice lowers your guard; the script moves you to act. The tools enabling this are spreading fast. What required specialized software and significant compute power in 2022 now runs on a smartphone. Hyun's concern isn't that a small number of sophisticated criminals have access to voice cloning. It's that the barrier to running an AI-powered impersonation scam keeps dropping, putting these tools within reach of a much larger population of opportunistic fraudsters. ## What You Can Actually Do The standard advice is to hang up and call back on a number you know. That's still worth doing, but a callback does not prove the original caller was legitimate. Use a number from a card, a statement, or an official website, and stay skeptical regardless of how the second call goes. For family calls, the limitation is even sharper. A scammer who just impersonated your daughter can't be disproved because you reached her on her regular number. The question is whether the original caller was actually her. That's where Trust Onion's three rotating codewords come in. Shared privately within your family and changing every 60 seconds, they're calculated locally on each phone. When someone calls saying they're in trouble, you ask one question: "What are the words?" A voice clone has no way to answer. The words weren't in any audio clip, and they expired a minute ago anyway. Phone calls have never had a reliable identity layer. You hear a voice and make a judgment. That judgment was never perfect, and AI makes it less reliable every month. The FTC's imposter scam numbers are already large, and Hyun's research suggests they will keep growing as the technology gets cheaper and the psychological levers stay exactly as they were. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Voice cloning now requires as little as 3 to 5 seconds of audio to generate a convincing replica of someone's voice. - UC researcher Kimberly Hyun found that hearing a voice similar to your own triggers automatic trust before you consciously evaluate what is being said, a response scammers deliberately exploit. - Human ability to detect cloned audio hovers around 55 to 60 percent, making ears alone an unreliable defense, and a callback to a known number does not prove the original caller was legitimate. ## Frequently asked questions ### How do scammers clone your voice for phone scams? Scammers collect short audio clips from voicemails, social media videos, or recordings, sometimes as little as three to five seconds, and feed them into widely available AI tools that generate a synthetic voice capable of speaking any script in real time. ### Why does hearing your own voice make you more likely to trust a scammer? University of Cincinnati researcher Kimberly Hyun found that vocal similarity triggers the similarity-attraction effect, a psychological response that automatically raises perceived trustworthiness before you consciously evaluate what is being said. ### Can you tell if a voice on the phone has been AI cloned? Research places average human accuracy at detecting cloned audio between 55 and 60 percent, roughly the same as guessing. Ears alone are not a reliable defense against modern voice cloning technology. ### What should I do if I get a suspicious call from a family member? Ask for your family's private verification codewords. A cloned voice cannot answer. You can also hang up and call back on a number you already have, but a successful callback does not prove the original call was legitimate. The caller must still know your family's shared words. ### How does Trust Onion stop AI voice cloning scams? Trust Onion generates three rotating codewords shared only within your family, changing every 60 seconds and calculated locally on each phone. No audio recording or voice clone can know those words, so one question ends the scam immediately. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Set up your family's three rotating codewords in minutes, completely free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "NJ Small Businesses Lost $435M to Fraud in 2024" published: 2026-09-19T00:09:17.432Z updated: 2026-10-11T06:12:45.221Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/nj-small-businesses-fraud-losses-2024 --- # NJ Small Businesses Lost $435M to Fraud in 2024 **Cite as:** NJ Small Businesses Lost $435M to Fraud in 2024, Trust Onion, 2026-10-11. https://trustonion.io/blog/nj-small-businesses-fraud-losses-2024 New Jersey businesses lost over $435 million to cybercrime and fraud in 2024, placing the state fifth in the nation for cyber-related financial losses, according to NJBIZ. The attacks are not landing on Fortune 500 companies with dedicated security teams. They are landing on small businesses, and the methods are getting harder to spot. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every other participant was a deepfake, including a convincing reproduction of a senior company officer. The employee authorized the transfer. The money was gone. That attack required sophisticated video fabrication. Most do not. Voice cloning now requires just 20 to 30 seconds of audio, and executives post on LinkedIn, speak at conferences, and appear in company videos. That audio is publicly available. A fraudster clones the CEO's voice, calls the finance department, and requests an urgent wire transfer. The caller sounds exactly right. The urgency feels real. The FBI's Internet Crime Complaint Center reported $16.6 billion in cybercrime losses across the U.S. in 2024, a 33% increase over 2023. New Jersey's $435 million is a state-level slice of that figure, and much of it came from exactly the kind of call Arup received: a convincing voice, an urgent request, and no mechanism to say "prove it." ## Why Standard Defenses Fall Short Spoofed phone numbers look legitimate. Spoofed email headers pass basic visual inspection. A caller who sounds like the CFO, calls from what appears to be the CFO's number, and references real internal project names has done their homework. The certified financial crimes specialist quoted in the NJBIZ piece "NJ small businesses face rising cybercrime, fraud risks," from Kearny Bank emphasized proactive employee training and internal controls. That framing is correct. The question is what those controls actually look like in practice for a ten-person finance team. Knowing that an attack might happen does not give a finance team member anything to do when a convincing caller is on the line asking for an urgent $80,000 transfer to a new vendor account. The common advice is to hang up and call back using a number from your internal directory or the vendor's official website. That is sound, but a callback does not prove the original caller was legitimate: a fraudster who initiated the first call may have additional infrastructure in place. Always source your callback number independently from a company website, official invoice, or verified internal directory, never from a number the caller provided. If something still feels wrong, escalate internally before authorizing anything. Judgment, under social pressure and time urgency, is not a reliable control. --- ## What Verification Actually Requires Effective internal controls for wire transfer authorization need three properties. They must work in real time, because fraud calls do not give you time to open a ticket. They must be out of band, because verifying through the same voice channel an attacker controls proves nothing. And they must be impossible to fake without inside access: a name, a title, and knowledge of internal projects can all be researched. Trust Onion addresses this with three rotating codewords, calculated locally on each authorized device and refreshed every 60 seconds. When a caller claims to be the CFO authorizing a wire transfer, a vendor change, or any urgent payment, the finance team member asks one question: "What are the words?" If the caller cannot produce the current three words, nothing moves. The words are never transmitted over the network. A cloned voice cannot know them. An attacker who has spent months researching the company cannot guess them. For teams that need to verify identity visually, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. Verification checks the passkey signature against the full public key, the original photo's SHA-256 hash, and the signed record. It does not, by itself, guarantee the intended person was physically present. New Jersey's $435 million in losses did not all come from sophisticated attacks on large enterprises. Much of it came from a convincing voice, an urgent request, and a finance team member who had no way to push back. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - New Jersey ranked fifth in the U.S. for cyber-related financial losses in 2024, with over $435 million lost, part of $16.6 billion in nationwide cybercrime losses reported by the FBI's Internet Crime Complaint Center. - AI voice cloning requires as little as 20 to 30 seconds of publicly available audio, making executive impersonation accessible to any fraudster and rendering caller ID and auditory checks unreliable for wire transfer authorization. - A rotating codeword protocol gives finance teams a real-time, out-of-band way to verify any caller before authorizing a payment; a cloned voice cannot produce time-based codewords calculated locally on a verified device. ## Frequently asked questions ### How much did New Jersey businesses lose to cybercrime in 2024? According to NJBIZ reporting on 2024 data, New Jersey victims lost over $435 million to cyber-related fraud, placing the state fifth in the nation. The FBI's Internet Crime Complaint Center reported $16.6 billion in cybercrime losses across the U.S. that same year, a 33% increase over 2023. ### How does AI voice cloning work in wire transfer fraud? Fraudsters use 20 to 30 seconds of publicly available audio to clone an executive's voice, then call the finance team to authorize a transfer. The voice sounds authentic. The caller is not who they claim to be. ### Is calling back a safe way to verify a suspicious wire transfer request? Calling back using a number from your internal directory or official company website is better than using a number the caller provided. However, a successful callback does not prove the original caller was legitimate. Source your number independently and apply additional verification before authorizing any payment. ### What internal controls can small businesses use to prevent wire transfer fraud? Effective controls include dual authorization, out-of-band verification, and real-time codeword protocols. Trust Onion provides rotating codewords a finance team can request from any caller claiming authority to approve a payment. If the caller cannot produce the current words, nothing moves. ### Can a cloned AI voice defeat a rotating codeword verification system? No. A cloned voice can replicate how someone sounds but cannot produce time-based codewords calculated locally on a verified device. If the caller cannot say the current words, they are not verified, regardless of how convincing they sound. ## More from Trust Onion Add Trust Onion's rotating codeword check to executive and wire-transfer approvals: a finance team member asks "What are the words?" before any wire, vendor change, or urgent payment moves, and only the real executive knows the current three. Protect Your Business Free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "FBI: AI-Related Fraud Cost Americans $893 Million in 2025" published: 2026-09-18T00:07:51.340Z updated: 2026-11-04T15:00:11.090Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/fbi-ai-voice-scams-893-million-2025-grandson-scam --- # FBI: AI-Related Fraud Cost Americans $893 Million in 2025 **Cite as:** FBI: AI-Related Fraud Cost Americans $893 Million in 2025, Trust Onion, 2026-11-04. https://trustonion.io/blog/fbi-ai-voice-scams-893-million-2025-grandson-scam The FBI's Internet Crime Complaint Center logged 22,364 AI-related fraud complaints in 2025 and $893 million in losses, the first time in its nearly 25-year history the agency broke out AI-related fraud as its own category. Americans over 60 accounted for $352 million of that total. The numbers finally forced the issue. For most of the Internet Crime Complaint Center's existence, AI-assisted fraud was folded into broader categories. The 2025 annual report gave it its own line: 22,364 complaints with an AI connection and more than $893 million in reported losses. That total covers every kind of fraud with an AI link, not one scheme. Investment scams made up the largest share by far, more than $632 million, according to the [FBI's 2025 IC3 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf). Business email compromise involving AI added about $30 million. Distress scams, where a cloned voice imitates a loved one in trouble, accounted for just over $5 million. Finance professor Pawan Jain, who studies fraud patterns, put it plainly: AI has made familiar scams cheaper, faster, and far harder to detect. ## Where the Money Went Investment fraud leads because AI lets scammers run thousands of tailored conversations at once. The report describes investment clubs that use AI-generated videos and voices of celebrities, executives and other trusted figures to sell fake opportunities, often with professional-looking endorsements on social media. Overall investment fraud losses topped $8 billion, which the FBI says shows many victims never realize AI was involved. Americans over 60 reported $352 million of the AI-related total. The report does not attribute that figure to any single scheme. ## The Voice-Clone Call Distress scams are a small slice of the total, but they are the version most families picture. A scammer pulls a grandchild's voice from public social media. Voice-cloning tools can produce a convincing replica from [about 15 seconds of audio](https://www.npr.org/2024/04/04/1242933678/even-openai-says-its-new-voice-cloning-tool-has-major-potential-for-misuse). Then comes the call: a voice that sounds like the grandchild, panicked, saying he was in an accident or arrested and needs money now. Please don't tell Mom and Dad. The FBI says these scams are spreading to imitate other relatives and close friends in other kinds of emergencies. The scam works because the urgency is designed to prevent the one thing that would stop it: taking a breath and making a second call. Studies show people often can't tell a cloned voice from a real one. Jain's advice borrows from how banks manage risk: end the call and reach the person through a number you already trust, agree on an emergency code word as a family, and require a second person to approve large transfers. Trust Onion builds that code word into the phone. Families and teams share three codewords that rotate every 60 seconds. When a call claims to be a grandchild in trouble, the grandparent asks one question: "What are the words?" A real grandchild opens the app and reads them. A cloned voice does not come with the current words. A failed callback does not prove the original caller was legitimate, so verify through a number you already know, and use common sense if someone may be in danger. A voice can be copied from a short clip. Three words that change every minute cannot. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - The FBI's Internet Crime Complaint Center logged 22,364 AI-related fraud complaints and $893 million in losses in 2025, the first year it broke out AI-related fraud as its own category. - Investment scams with an AI connection made up more than $632 million of the total; distress scams that use cloned voices accounted for just over $5 million. - Americans over 60 reported $352 million of the AI-related losses. Calling back on a number you already trust and agreeing on a family code word slow the scam down. ## Frequently asked questions ### What is the grandson voice clone scam? Scammers use AI to clone a grandchild's voice from social media audio, then call grandparents claiming the grandchild is in danger and needs money immediately. A second scammer poses as a lawyer or officer to add pressure and discourage the grandparent from calling other family members. ### How much did AI-related fraud cost Americans in 2025? According to the FBI's Internet Crime Complaint Center, AI-related fraud of all kinds cost Americans $893 million in 2025, across 22,364 complaints. Investment scams with an AI connection made up more than $632 million. Americans over 60 reported $352 million of the total. Distress scams that use cloned voices accounted for just over $5 million. ### How little audio does it take to clone someone's voice? Voice-cloning tools can produce a convincing replica from about 15 seconds of audio, according to NPR, and that audio is often easy to find in public social media videos. ### How can families protect elderly relatives from grandson scams? The most reliable protection is a shared rotating verification phrase. If the caller can't produce the right words, they're not who they claim to be. Trust Onion automates this with three codewords that change every 60 seconds, calculated locally on each family member's phone. ### Can you tell if a voice on the phone is AI-generated? Not reliably. Studies show people often can't tell a cloned voice from a real one, and stress makes careful judgment harder. Verify the caller instead of trusting the voice. ## More from Trust Onion See how Trust Onion gives people and teams a practical way to verify identity, free rotating codewords for families, and a three-word challenge for security and finance teams handling high-risk requests. Explore Trust Onion Free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Florida Takes Aim at AI Scam Calls. Here's What That Means for Your Family." published: 2026-09-18T00:03:02.387Z updated: 2026-10-11T06:12:45.908Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/florida-anti-scam-communications-act-ai-voice-calls --- # Florida Takes Aim at AI Scam Calls. Here's What That Means for Your Family. **Cite as:** Florida Takes Aim at AI Scam Calls. Here's What That Means for Your Family., Trust Onion, 2026-10-11. https://trustonion.io/blog/florida-anti-scam-communications-act-ai-voice-calls On September 17, 2026, Florida Attorney General James Uthmeier proposed mandatory prison time for scammers who use AI-generated voices to steal from residents. The call that could ruin your mother's retirement might still come in tonight. Florida's proposed Anti-Spam Communications Act is one of the most aggressive state-level strikes at phone fraud in the country. Uthmeier wants independent investigative authority for his office, so he doesn't have to wait on federal agencies. He wants telecom providers to authenticate caller ID and cut off known scam campaigns. He wants high-volume or high-loss fraud treated as a felony with mandatory prison time. He named elderly residents specifically. The reason isn't hard to find. The FTC reported that adults over 60 lost more than $1.9 billion to fraud in 2025, with phone-based impersonation scams accounting for a large share of those losses. Florida, with one of the largest elderly populations in the country, draws scammers the way a warm coast draws snowbirds. The playbook is consistent. A caller claims to be a grandchild in trouble, a Social Security official, a bank fraud department, or a police officer with a warrant. The urgency is manufactured. The solution always involves gift cards, wire transfers, or a courier at the door. What's new is the voice. Voice cloning now requires as little as 20 to 30 seconds of audio, pulled from a social media video, a voicemail, a public recording. Once the clone exists, it can say anything. ## What the Bill Would Actually Do The proposed law targets the infrastructure behind the calls. Spoofed numbers would require telecom authentication, so the number displayed has to match the number actually calling. Phone farms running thousands of simultaneous automated calls would face felony prosecution at the operator level. Using an AI-generated voice to deceive someone out of money, without disclosing that the voice is artificial, would be explicitly illegal. Impersonating a government official gets its own penalties. These are meaningful provisions, but they are also slow. Enforcement takes years. Many scam operations run from outside the United States, beyond Florida's jurisdiction entirely. The FTC received more than 2.6 million fraud reports in 2023 alone. Existing laws haven't stopped the volume. --- What happens in the seconds after your phone rings is still up to you. AI can clone your son's voice from a TikTok video. It can make your mother cry while asking for bail money. It can sound exactly like your brother calling from a number that looks like his. What it cannot do is know three codewords your family chose privately, words that rotate every 60 seconds on a schedule calculated locally on your phone. That's how Trust Onion works. Your family sets a shared verification system at trustonion.io. When a call comes in from someone claiming to be a grandchild or a relative, you pause and ask: "What are the words?" A real family member answers in seconds. A scammer using a perfect voice clone cannot answer at all, because the words are calculated locally on authorized devices and never pass through any server. They expire every 60 seconds, so even an overheard answer is useless almost immediately. ## What to Do Before Any Bill Passes Talk to your parents or grandparents about AI voice cloning, not to frighten them, but to explain that a familiar voice alone is no longer proof of identity. Build the verification habit together. The more automatic the question becomes, the better it works under pressure, especially when a caller is manufacturing urgency. Remind them that real government agencies, banks, and law enforcement do not demand immediate payment by gift card or wire transfer. Ever. If something feels wrong, hang up and call back on a number from an official card or statement. A successful callback does not prove the original caller was legitimate; a scammer can be waiting on a spoofed line. Use common sense and alert authorities if you believe someone may be in danger. For family calls, the question is simpler. Ask "What are the words?" A real family member knows. A cloned voice does not. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Florida AG James Uthmeier proposed the Florida Anti-Spam Communications Act on September 17, 2026, targeting AI voice scams, spoofed numbers, and phone fraud with felony-level penalties including mandatory prison time. - Voice cloning now requires as little as 20 to 30 seconds of audio, making a familiar-sounding voice alone unreliable as proof of identity; the FTC reported adults over 60 lost more than $1.9 billion to fraud in 2025. - Trust Onion's three rotating codewords change every 60 seconds and work offline, giving families a way to verify identity that AI cannot fake: ask 'What are the words?' and a scammer with a perfect voice clone still cannot answer. ## Frequently asked questions ### What is the Florida Anti-Spam Communications Act? A bill proposed by Florida AG James Uthmeier on September 17, 2026. It would give his office independent authority to pursue scam calls, require telecoms to authenticate caller ID, ban undisclosed AI voices used to steal money, and make high-volume or high-loss fraud a felony with mandatory prison time. ### Can AI really clone someone's voice from a phone call? Yes. Voice cloning now requires as little as 20 to 30 seconds of audio, drawn from social media videos, voicemails, or public recordings. The resulting clone can say anything in a convincing imitation of the original speaker. ### How do I verify a caller is actually my family member and not a scammer? Ask "What are the words?" Trust Onion gives your family three rotating codewords that change every 60 seconds, calculated locally on authorized devices. A scammer with a perfect voice clone cannot answer correctly because the words never pass through any server. ### Why do scammers target elderly people specifically? Older adults often have more savings and may be less familiar with AI voice cloning. The FTC reported adults over 60 lost more than $1.9 billion to fraud in 2025. Florida's large elderly population makes it a frequent target for phone-based impersonation scams. ### Will new laws stop AI voice scams? Laws create consequences and slow domestic operations, but many scam campaigns run from outside U.S. jurisdiction and enforcement takes years. A family verification system like Trust Onion works immediately, in the moment the call happens, before any damage is done. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Set up your family's shared system free at trustonion.io in about two minutes. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Turned Crypto Fraud Into a $30 Billion Assembly Line" published: 2026-09-17T00:05:51.292Z updated: 2026-10-11T06:12:46.377Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-crypto-fraud-30-billion-2025-trm-labs --- # AI Turned Crypto Fraud Into a $30 Billion Assembly Line **Cite as:** AI Turned Crypto Fraud Into a $30 Billion Assembly Line, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-crypto-fraud-30-billion-2025-trm-labs In February 2024, every person on a video call with an Arup employee was a deepfake. The engineering firm lost $25 million before anyone realized the meeting had never been real. Crypto scam losses hit an estimated $30 billion in 2025, according to TRM Labs. That figure did not come from more criminals working harder. It came from AI running at machine scale, automating fraud that once required a person at a keyboard for every conversation. TRM Labs tracks illicit cryptocurrency flows globally. Their 2025 report puts total illicit crypto volume at a record $158 billion, a 145% year-over-year increase. AI-enabled scam activity alone grew roughly 500% in a single year. The share of crypto scam reports involving AI elements such as deepfakes and automated chatbots grew about 13 times since 2022. ## How the Machine Works The fraud patterns TRM Labs describes follow a few recurring forms. Generative AI produces realistic profile photos, backstories, and documents. A synthetic "financial advisor" complete with a LinkedIn profile, a headshot, and three years of fake posts feels credible by design. Voice cloning now requires as little as 20 to 30 seconds of audio. The Arup case showed what comes next: faces that look right, voices that sound right, a video call where nothing is real and $25 million is gone by the time the employee realizes it. Automated chatbots extend the damage further. Where a human scammer could manage a handful of targets at once, an AI chatbot runs thousands of conversations at the same time, adjusting its pitch in real time. Once money moves, AI-powered laundering tools route it through complex transaction chains with minimal oversight, making recovery nearly impossible. --- Every one of these scams works the same way: convincing you that you know and trust the person or institution reaching out. Human detection accuracy for AI-generated voice and video hovers around 55 to 60%, barely better than a coin flip. ## The One Thing AI Cannot Fake AI voice cloning can copy how someone sounds. It cannot know a secret. Trust Onion gives people a simple way to verify anyone claiming to be someone they know, a bank, or another trusted institution. Three rotating codewords change every 60 seconds, calculated locally on each authorized device with no server required. When someone calls claiming to be a person or organization you trust, one question settles it: "What are the words?" A cloned voice does not know the words. An automated call does not know the words. They rotate on a schedule, so even if someone overheard them once, they expire within a minute. Note that a failed callback on its own does not prove the original caller was legitimate; the codeword challenge is the check that goes beyond a familiar voice, a spoofed caller ID, or a convincing message. TRM Labs data shows the tools scammers use are getting better and cheaper, and the gap between what AI can fake and what humans can detect keeps growing. The defense does not have to be technical. It just has to be shared before the call comes. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - TRM Labs recorded $158 billion in total illicit crypto volume in 2025, a 145% year-over-year increase, with scam-related activity accounting for an estimated $30 billion. - AI-enabled scam activity grew roughly 500% in a single year, and the share of crypto scam reports involving AI elements like deepfakes grew approximately 13 times since 2022. - Voice cloning requires as little as 20 to 30 seconds of audio, and human ability to detect cloned voices hovers around 55 to 60%, barely better than a coin flip. ## Frequently asked questions ### How much money was lost to crypto scams in 2025? According to TRM Labs, scam-related activity in the crypto ecosystem accounted for an estimated $30 billion in 2025, out of a record $158 billion in total illicit crypto volume. ### How is AI being used in crypto fraud? Scammers use generative AI for voice cloning, deepfake video, synthetic identity creation, automated chatbots, and laundering automation, letting fraud operations run at machine scale with minimal human involvement. ### Can AI really clone someone's voice that accurately? Yes. Voice cloning now requires as little as 20 to 30 seconds of source audio. Human ability to detect cloned voices hovers around 55 to 60%, barely better than random guessing. ### How do I protect my family from AI voice scams? Set up a shared verification system before you need one. Trust Onion uses three rotating codewords that change every 60 seconds. Ask any caller claiming to be someone you trust for the words. An AI clone cannot answer. ### Why are crypto scams so hard to recover from? AI-powered laundering tools route stolen funds through complex transaction chains quickly, making tracing and recovery extremely difficult once the money moves. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. The private three-word challenge adds a check beyond a familiar voice, caller ID, or message. --- title: "AI Cloned His Grandson's Voice. Grandpa Lost $1,000." published: 2026-09-16T00:02:05.660Z updated: 2026-10-18T05:19:20.364Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-cloned-grandson-voice-grandparent-scam-texas --- # AI Cloned His Grandson's Voice. Grandpa Lost $1,000. **Cite as:** AI Cloned His Grandson's Voice. Grandpa Lost $1,000., Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-cloned-grandson-voice-grandparent-scam-texas A Texas man's father wired $1,000 to save his grandson from trouble in Mexico. The grandson was at home the whole time, unaware the call had ever happened. The voice on the phone was the grandson's. The urgency felt real. Scammers had harvested enough audio from social media to clone a teenager's voice, then called his grandfather with a story about being stranded in Mexico and needing money immediately. By the time the Texas man appeared on Good Morning America in May 2023 to warn other families, the $1,000 was long gone. This is not an isolated incident. The FTC reported that impersonator scams were the highest-reported scam type in 2022, with $2.6 billion in total losses. Family emergency calls, where a voice that sounds exactly like a grandchild or adult child describes a crisis, account for a significant share of that figure. The technology behind them has made an old con genuinely hard to detect. ## How the Script Runs These calls follow a reliable sequence. A familiar voice describes a serious emergency: an arrest, an accident, a medical crisis, being stranded abroad. Once the target feels panic, a second caller often joins, playing a lawyer, a bail bondsman, or a police officer. Payment is requested immediately, by wire transfer or gift cards. Scammers keep the target on the line, saying things like "don't hang up, we need your information right now" or "if you hang up we can't help him." By the time the real family member is reached, the money is already gone. Experts responding to the Texas family's story offered two pieces of advice. First, keep social media accounts private. Voice cloning software can produce a convincing replica from as little as 20 to 30 seconds of audio, pulled from public videos posted months or years earlier. Locking accounts removes the raw material. Second, hang up and call them directly, using the number you already have. --- Both steps are sound. Both are hard to execute when someone you love sounds like they are in danger. Scammers understand this. The pressure is the product. Even a successful callback leaves a gap. You hang up, you call your grandson, he doesn't answer. The panic rushes back. Maybe the first call was real. That window of doubt is exactly where scammers want you. ## What Settles It on the First Call Trust Onion gives every family three rotating codewords that change every 60 seconds, calculated on each person's phone with no server or internet connection required. When a caller claims to be the grandson in trouble, grandpa asks: "What are the words?" The real grandson knows. A scammer with a cloned voice does not. AI can copy how someone sounds; it cannot know three codewords that exist only on your family's phones and rotate every minute. A callback is still a good idea, and a failed callback does not prove the original caller was legitimate. The codewords settle the question before any money moves, while still on the first call. If someone may genuinely be in danger, call authorities. Use the codewords and common sense together. The Texas family didn't have that layer when they needed it. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Scammers cloned a Texas teenager's voice using AI and used it to steal $1,000 from his grandfather by staging a fake emergency call. - The FTC reported $2.6 billion in losses from impersonator scams in 2022 alone, making them the highest-reported scam type that year. - A shared family codeword settles the question instantly, while still on the first call, before any money moves, because AI can clone a voice but cannot know a secret that rotates every 60 seconds. ## Frequently asked questions ### How did scammers clone a teenager's voice for the grandparent scam? AI voice cloning software can generate a convincing replica from as little as 20 to 30 seconds of audio. Scammers pull that audio from public social media videos the target has already posted, sometimes recorded months or years earlier. ### What should I do if I get a call from a family member saying they are in trouble? Hang up and call them directly on the number you already have. If they answer, the first call was a scam. Do not send money, gift cards, or wire transfers before verifying. Note: a failed callback does not prove the original caller was legitimate. If someone may be in danger, alert authorities. ### How common are AI voice cloning scams targeting families? Impersonator scams were the highest-reported scam type in 2022 according to the FTC, with $2.6 billion in total losses. AI voice cloning has made the family emergency version more convincing and harder to detect in the moment. ### Can keeping social media private prevent voice cloning scams? It reduces the risk. Scammers harvest voice samples from public posts and videos, so private accounts make those samples harder to collect. A family codeword system adds an active verification layer that works even if audio is obtained another way. ### What is a family codeword and how does it stop voice cloning scams? Trust Onion gives families three rotating codewords that change every 60 seconds on each person's phone, with no server required. When a caller claims to be a family member, you ask: "What are the words?" A scammer with a cloned voice cannot answer correctly. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set up a shared family group free at trustonion.io and give everyone a way to prove it's really them. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Florida Woman Nearly Loses $25K in Jury Duty AI Voice Scam" published: 2026-09-11T00:05:30.171Z updated: 2026-10-18T05:19:39.108Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/florida-woman-nearly-loses-25k-jury-duty-ai-voice-scam --- # Florida Woman Nearly Loses $25K in Jury Duty AI Voice Scam **Cite as:** Florida Woman Nearly Loses $25K in Jury Duty AI Voice Scam, Trust Onion, 2026-10-18. https://trustonion.io/blog/florida-woman-nearly-loses-25k-jury-duty-ai-voice-scam A Crestview, Florida woman nearly handed over $25,000 to a caller who said she had missed federal jury duty and was about to be arrested. The voice sounded exactly like a law enforcement officer. It was AI. The Okaloosa County Sheriff's Office issued a public warning after the woman's case in September 2026, which means she almost certainly was not the only target that week. A Crestview, Florida resident, she had received a call from someone claiming to be a sheriff's deputy. The caller said a warrant was active, arrest was imminent, and that paying immediately over the phone was the only way out. She nearly did it. The call was that convincing. But real law enforcement never demands payment over the phone to avoid arrest. If a genuine warrant exists, officers come to the door. No sheriff's department, federal court, or U.S. Marshals office collects fines via phone call. That single fact, known in advance, is the entire defense. The jury duty scam works because most people are uncertain about the rules. They have heard stories about fines and bench warrants. When a calm, authoritative voice tells them a warrant has been issued, the brain moves to crisis mode before judgment can catch up. Voice cloning now requires as little as 20 to 30 seconds of audio to produce a convincing imitation of tone, accent, and the practiced calm of an official reading from a warrant. The FTC recorded more than 147,000 government impersonation scam reports in 2023, with losses exceeding $1.1 billion. Those numbers have grown as the tools have become more accessible. --- The calls follow a script. The caller names a specific agency or badge number to build credibility fast. Then urgency: a warrant is active, officers are on their way, every second makes it worse. Then an exit: pay now and the warrant disappears, always by gift card, wire transfer, or cryptocurrency, none of which can be reversed. And then control: stay on the line, do not hang up to verify, tell no one until the fine is paid. Any caller who says "you have five minutes to pay or you'll be arrested" is running a pressure script. Real situations allow time to verify. The obvious move is to hang up and call the agency directly using a number you find yourself, not one the caller gives you. That is correct, but it requires being calm enough in the moment to act on it, and a failed callback does not prove the original caller was legitimate. Know the rule before you need it. Telling someone "real cops don't demand phone payments" after they have been shaken by a call is far less useful than knowing it going in. Share it now with people you trust. Some people use a signal phrase, something like "something feels wrong, call me back on a verified number," as permission to pause without feeling they are overreacting. For calls claiming to be from someone you know personally, Trust Onion adds a layer that AI cannot cross. You share three rotating codewords with the people in your circle, calculated locally on each device every 60 seconds with no server required. When a call comes in claiming to be someone you trust, the question is simple: "What are the words?" A real person with authorized access can answer. A scammer using a cloned voice cannot. The words expire, cannot be stolen and reused, and work offline. The woman did not lose the $25,000. Something made her stop. The scammers moved on, as they always do, to the next call on the list. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - A Crestview, Florida resident nearly lost $25,000 to scammers using AI-synthesized voices to impersonate law enforcement officers in a jury duty scam. - Real law enforcement never demands payment over the phone to prevent an arrest; knowing that rule in advance is the entire defense. - The FTC recorded more than 147,000 government impersonation scam reports in 2023, with losses exceeding $1.1 billion, as voice cloning tools now require as little as 20 to 30 seconds of audio. ## Frequently asked questions ### What is the jury duty phone scam? Scammers call claiming to be law enforcement, say a warrant has been issued because you missed jury duty, and pressure you to pay immediately by phone to avoid arrest. Real law enforcement agencies never collect payments this way. ### How can I tell if a law enforcement call is fake? If the caller demands payment over the phone to avoid arrest, it is a scam. Hang up and call the agency using a number you find independently. A failed callback does not prove the original caller was legitimate. Real officers do not offer phone payment options to resolve warrants. ### Can AI really clone a voice well enough to fool people? Yes. Voice cloning tools now require as little as 20 to 30 seconds of audio to produce a convincing imitation, replicating tone, accent, and speaking patterns closely enough to deceive even people who know the original speaker. ### What should I do if I get a jury duty scam call? Hang up immediately. Do not provide payment or personal information. Contact the actual county court or sheriff's office using a verified number you find yourself. Report the call to the FTC at reportfraud.ftc.gov. ### How do family codewords help against phone scams? Rotating codewords shared within your circle give you a fast way to verify a caller's identity. If someone claims to be a trusted contact but cannot provide the current words, you know the call is not legitimate. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords add a check beyond a familiar voice, caller ID, or message. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Fraud Attacks Surged 1,210% Last Year. Here's What That Means for Your Finance Team" published: 2026-09-07T00:07:38.921Z updated: 2026-10-09T00:17:13.161Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-fraud-attacks-surged-1210-percent-pindrop-2025 --- # AI Fraud Attacks Surged 1,210% Last Year. Here's What That Means for Your Finance Team **Cite as:** AI Fraud Attacks Surged 1,210% Last Year. Here's What That Means for Your Finance Team, Trust Onion, 2026-10-09. https://trustonion.io/blog/ai-fraud-attacks-surged-1210-percent-pindrop-2025 AI-driven fraud attacks against major U.S. organizations surged 1,210% last year, according to fraud detection firm Pindrop. Combined losses reached an estimated $1 billion. This is not a gradual trend. Fraud now operates on a different structural model. ## From Manual Scams to Automated Fraud at Scale For years, CFO impersonation fraud required a skilled fraudster willing to do the work: research the target, rehearse a convincing voice, time the call carefully, and hope the right person picked up. That model had natural limits. Human effort caps volume. Generative AI removed those limits. According to Pindrop's 2025 study, fraudsters now run what amounts to an automated supply chain. Deepfake voice tools can clone an executive's voice from publicly available audio in under 30 seconds. Automated dialers place hundreds of calls simultaneously. Scripts adjust in real time based on how the call is going. The result is fraud that scales like software. Contact centers and finance teams absorb most of the damage. These are the people who receive urgent payment requests, wire transfer authorizations, and vendor change notifications. They are trained to be helpful. They are not trained to detect a cloned voice. ## The $1 Billion Verification Problem The Pindrop findings point to something specific: $1 billion in combined losses across their major U.S. customer base in a single year. That figure covers organizations with sophisticated fraud detection already in place, not unsophisticated targets. The attacks hitting contact centers follow a consistent pattern. A caller identifies as a senior executive or authorized approver, creates urgency, then requests a wire transfer, a vendor payment update, or access to a high-value account. The person receiving the call has no reliable way to verify the caller's identity in real time. Voice recognition fails here. Humans are poor at detecting cloned audio. Research consistently puts human detection accuracy for AI-generated voice at 55 to 60 percent, barely better than a coin flip. Caller ID is spoofable. Callback numbers can be forwarded. Security questions based on personal details are often answerable with public information. The verification layer most organizations rely on, voice and caller identification, is now the layer that AI attacks most effectively. ## Why Urgency Is the Attack's Real Weapon Pindrop flagged urgent payment requests as a primary attack vector. That detail matters operationally. Fraud calls are designed to compress decision time. "We need this wire to close before 3 PM." "The CEO is in a meeting and asked me to relay this directly." "This is time-sensitive, do not loop in anyone else." These are not random tactics. They are deliberate pressure designed to prevent the one thing that stops the fraud: a second opinion or a verification step. An employee who feels free to pause and verify can stop a $500,000 transfer. An employee who fears being blamed for delaying a legitimate executive request will often proceed without verification. Organizations solve this by making verification a standard step, not an optional one, and not a sign of distrust. A process. ## The Automation Advantage Has One Blind Spot AI-powered fraud scales because it automates the human elements of deception: voice, timing, scripting, pressure. All of these can be generated and deployed without a person on the other end of the call. But automation cannot fake information it does not have. A codeword protocol closes this gap. When a finance team member asks a caller to confirm three rotating codewords before authorizing a payment, the AI on the other end has no path forward. The codewords are not in the executive's public audio. They are not discoverable through research. They rotate every 60 seconds and are calculated locally on each device. A cloned voice cannot produce them. That is the operational gap that makes this approach work. The fraud call is built to impersonate. It cannot impersonate knowledge it was never trained on. Trust Onion gives finance teams exactly this layer. Three rotating codewords, shared across your organization's verification chain. Before any wire transfer is authorized or any vendor change approved, the question is simple: "What are the words?" If the caller cannot answer, the call is not authenticated. The words expire automatically, so a compromised set is useless within 60 seconds. A Proofie™ is a selfie signed by your passkey the moment you take it. Share the link, and anyone can check in their own browser that your key signed this exact photo, after a known moment, and that nothing has changed since. A standard P-256 WebAuthn passkey signs after Face ID, fingerprint or device-passcode unlock. The signature must carry both user-presence and user-verification flags. This is not a crypto-wallet signature. Identity is the full signing public key, not its shortened label. Save a previously trusted key to recognize later Proofies from the same key. This does not automatically verify a real-world identity or detect AI-generated images. Signed time and place cannot be changed undetected; they are not independent proof of physical whereabouts or exact capture time. Family codewords work alongside Proofies, not as an overlay or signed field. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved. ## What a 1,210% Increase Actually Demands A 1,210% increase in AI-driven fraud attacks does not respond to incremental improvements in awareness training. It responds to structural controls. The organizations in Pindrop's study were not unprepared. They had fraud detection infrastructure in place and still absorbed $1 billion in combined losses. That signals detection-after-the-fact is insufficient when attacks are automated and volume is this high. Prevention at the point of authorization is the right frame. A wire transfer that never leaves the account costs nothing. One that does costs an average of $1.17 million per BEC incident, according to the FBI's 2023 Internet Crime Report. Finance teams cannot verify a caller's voice. They can verify a codeword. Three rotating words, known only to verified personnel, stop a cloned CFO voice before it costs your organization anything. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI-driven fraud attacks surged 1,210% in 2025, with combined losses reaching $1 billion, according to Pindrop. - Fraudsters now run an automated supply chain that scales voice fraud without human effort. - Human detection accuracy for AI-cloned voices sits at 55 to 60 percent, making voice recognition an unreliable verification method. - Urgent payment requests are a primary attack vector because they eliminate the pause needed for verification. - A rotating codeword protocol stops cloned voice attacks because the AI cannot produce information it was never trained on. ## Frequently asked questions ### How much did AI fraud cost businesses in 2025? According to fraud detection firm Pindrop, AI-driven fraud attacks against major U.S. organizations resulted in an estimated $1 billion in combined losses in 2025, with attack volume surging 1,210% year over year. ### How does AI voice cloning fraud work against finance teams? Fraudsters clone an executive's voice using publicly available audio, then call finance employees with urgent wire transfer or payment requests. The cloned voice sounds authentic, and caller ID can be spoofed, leaving the recipient with no reliable way to verify the caller's identity. ### Can employees detect AI-cloned voices on a phone call? Research puts human detection accuracy for AI-generated voice at 55 to 60 percent, barely above chance. Trained employees are not reliably better. Organizations should not rely on voice detection as a primary control. ### What is a codeword protocol and how does it stop voice fraud? A codeword protocol requires callers to confirm a set of rotating words before any high-stakes action is authorized. The words change every 60 seconds and are never public, so a cloned voice cannot produce them. No codeword means no authorization. ### Why do AI fraud attacks target urgent payment requests specifically? Urgency compresses decision time and discourages verification. Fraudsters use time pressure to prevent employees from pausing, asking a second opinion, or requesting identity confirmation before approving a transfer. ## More from Trust Onion Protect your finance team from AI-powered impersonation with Trust Onion's free rotating codeword verification. Three words stand between your next wire transfer and a $1 million loss. --- title: "Amazon Built a Scam Checker. Here's What That Tells Us." published: 2026-09-04T00:06:12.383Z updated: 2026-10-11T06:12:47.444Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/amazon-alexa-verify-messages-scam-checker --- # Amazon Built a Scam Checker. Here's What That Tells Us. **Cite as:** Amazon Built a Scam Checker. Here's What That Tells Us., Trust Onion, 2026-10-11. https://trustonion.io/blog/amazon-alexa-verify-messages-scam-checker 360,000 people contact Amazon's customer service every year just to ask one question: did this message actually come from you? That's nearly 1,000 people a day who can't tell the real thing from a trap, and in September 2026, Amazon decided to do something about it. Amazon's answer is a new Alexa for Shopping feature that lets U.S. customers describe any message, email, phone call, or text and check it against Amazon's catalog of billions of sent communications. Suspicious submissions get reported automatically. It's fast, it's useful, and it's also a quiet admission that impersonation fraud has grown large enough to require a dedicated internal tool at one of the world's largest companies. The FTC consistently ranks Amazon among the most impersonated brands in the United States. In 2023, Americans reported losing $10 billion to fraud, with impersonation scams making up the largest category. Amazon's 360,000 annual contacts are only the people who thought to call. The ones who didn't, and clicked anyway, never show up in that count. ## Why the Brand Works for Scammers Almost everyone has an Amazon account. Almost everyone gets real Amazon emails. The fake ones arrive with familiar logos, order numbers, and urgent language about a charge or a package. The calls go further: a professional-sounding voice says your account has been compromised, an unauthorized purchase went through, your Prime membership is about to be suspended. Voice cloning has sharpened the edge. Generating a convincing synthetic voice now requires as little as 20-30 seconds of audio. The Alexa feature answers one specific question: "Did this come from us?" It works because Amazon controls both sides. They sent the messages, so they can check whether the one you received matches their records. That logic does not extend to the scam that causes the most financial damage: a caller who sounds exactly like someone you love. --- In 2023, a Canadian family lost $21,000 after receiving a call from someone who sounded exactly like their son, claiming he had been in a car accident and needed bail money. The voice was a clone. The son was at home, unaware any of this was happening. The script is old; the grandparent scam has existed for decades. What changed is that the voice no longer sounds like a stranger trying to sound like your grandson. It sounds like your grandson. When a caller says "It's me, I'm in trouble, I need money," there is no corporate database to check against. There is just a voice that sounds right and a story that demands an immediate answer. ## A Check That Moves Faster Than a Clone Trust Onion was built for exactly this gap. The app gives families three rotating codewords calculated locally on each person's phone. The words change every 60 seconds. When a call comes in and something feels wrong, one question settles it: "What are the words?" A real family member opens the app and reads them back. A scammer with a cloned voice and a convincing story cannot answer, because the words live only on your family's phones and the ones from a minute ago have already expired. A failed callback does not prove the original caller was legitimate, so the codewords matter: the caller must still know your family's private Trust Onion Three Words. If something feels dangerous, alert the authorities. Amazon's tool asks, "Is this really you?" for messages. The codewords ask the same question on a phone call, where you have seconds and no logo to examine. When a company with Amazon's resources decides impersonation is serious enough to build a dedicated feature, that tells you something about the scale of what is happening. The Alexa tool helps millions of customers. It cannot help when the voice on the line belongs, or seems to belong, to someone you would do anything for. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - 360,000 people contact Amazon each year just to confirm whether a message is real, a volume large enough that Amazon built a dedicated Alexa for Shopping feature to check messages against billions of sent communications. - In 2023, Americans reported losing $10 billion to fraud, with impersonation scams the largest category; voice cloning now requires as little as 20-30 seconds of audio, making phone impersonation of loved ones a realistic and growing threat. - Three rotating codewords that change every 60 seconds give families a verification method no cloned voice can beat: if the caller cannot answer 'What are the words?', they are not who they claim to be. ## Frequently asked questions ### How do I verify if a message is really from Amazon? Amazon's Alexa for Shopping feature lets U.S. customers verify messages, emails, calls, and texts by checking them against Amazon's catalog of billions of sent communications. Describe the message to Alexa and it checks instantly, automatically reporting anything suspicious. ### How do I know if a phone call claiming to be from a family member is real? Ask for your family's private codewords. Trust Onion gives families three rotating codewords that change every 60 seconds. A real family member opens the app and reads them back. A scammer cannot. A failed callback alone does not prove the caller is legitimate. ### How common are Amazon impersonation scams? Very common. Amazon receives about 360,000 contacts per year from customers trying to confirm whether a message is legitimate. The FTC consistently ranks Amazon among the most impersonated brands in the United States. ### Can AI really clone someone's voice to run a scam? Yes. Voice cloning now requires as little as 20-30 seconds of audio. Scammers use cloned voices to impersonate relatives and authority figures, making calls that sound genuinely convincing. In 2023, a Canadian family lost $21,000 to a call made with a cloned voice. ### What is Trust Onion and how does it protect families from scam calls? Trust Onion is a free app that gives families three rotating codewords calculated locally on each phone, changing every 60 seconds. When a suspicious call comes in, ask for the words. Real family members can answer. Scammers cannot. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Verify For Free at trustonion.io. --- title: "2 in 5 Americans Have Already Met an AI Financial Scam" published: 2026-09-03T00:04:13.405Z updated: 2026-10-11T06:12:47.514Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-financial-scams-reach-2-in-5-americans-survey-2026 --- # 2 in 5 Americans Have Already Met an AI Financial Scam **Cite as:** 2 in 5 Americans Have Already Met an AI Financial Scam, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-financial-scams-reach-2-in-5-americans-survey-2026 A September 2026 Credit One Bank survey of 1,000 U.S. consumers found that over 2 in 5 Americans have already encountered an AI financial scam, or know someone who has. Nearly 84% have changed at least one financial behavior because of it. The fear driving those changes has a specific shape. Nearly 24% of respondents named the same threat as their top concern: a fake phone call or voice message cloned to sound like their bank. Not phishing emails, not fake websites. A voice. That fear is grounded in something real: voice cloning now requires as little as 20 to 30 seconds of audio to produce a convincing replica, drawn from a public voicemail, a YouTube clip, or a social media video. For decades, caller ID was a reasonable shortcut for deciding whether to pick up. That shortcut is gone. Scammers can spoof any number, clone any voice, and script a conversation that sounds completely legitimate. When 84% of Americans have already changed their financial behavior in response, that is not panic. It is a rational adjustment to a real shift in how these scams work. ## The Call That Sounds Like Family The scam that hits hardest does not always impersonate a bank. Sometimes it impersonates a son, a granddaughter, a sibling. The voice sounds exactly right because it is their voice, cloned from a clip posted online. The caller says they are in trouble, they need money moved fast, and they do not want you to call anyone else. The pressure is deliberate. According to the FTC, imposter scams cost Americans $2.7 billion in 2023, and AI voice cloning is pushing that figure higher. Banks are being asked to respond with stronger fraud protections, and that demand is understandable. But bank-side controls face a hard ceiling: an AI that can clone a voice can also clone the script a bank uses to verify your identity. When a call arrives from someone claiming to be your bank or your daughter, most people have no reliable way to confirm it. --- That is the problem Trust Onion is built to solve. The app gives families three rotating codewords, recalculated every 60 seconds directly on each person's phone, with no server and no internet connection required. When a call comes in from someone claiming to be a family member, one question settles it: "What are the words?" If they answer correctly, it is really them. If they cannot, the call ends. An AI can clone a voice. It cannot know three codewords that change every 60 seconds and are calculated locally on your phone. Stolen words expire before a scammer can use them. A callback to a known number is a reasonable first step when a call feels wrong, but a successful callback does not prove the original caller was legitimate. The caller must still know the family's private Trust Onion Three Words. For calls claiming to be from a bank, use a number from your card, statement, or the official app, not one the caller provides. ## Before the Call Comes The Credit One Bank survey makes one thing clear: people are already taking AI scams seriously. The missing piece is a practical tool that matches the threat. Talk to your family about verification now. Agree on a shared check only real members would know. Be skeptical of urgency, since real emergencies allow a moment to confirm. Do not trust caller ID alone, because any number can be spoofed. The technology behind AI voice cloning is not slowing down, and the cost of running it keeps falling. But a shared secret rotating every 60 seconds does not care how good the AI gets. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - A September 2026 Credit One Bank survey of 1,000 U.S. consumers found that over 2 in 5 Americans have encountered an AI financial scam or know someone who has, with nearly 84% changing at least one financial behavior as a result. - Nearly 24% of consumers named fake phone calls or voice messages cloned to sound like their bank as their top AI scam fear, and voice cloning requires as little as 20 to 30 seconds of audio to produce a convincing replica. - According to the FTC, imposter scams cost Americans $2.7 billion in 2023; three rotating codewords recalculated every 60 seconds give families a verification method no cloned voice can beat. ## Frequently asked questions ### How common are AI financial scams in the US? A September 2026 Credit One Bank survey of 1,000 U.S. consumers found that over 2 in 5 Americans have encountered an AI financial scam or know someone who has. Nearly 84% said they changed at least one financial behavior as a result. ### What is the most feared AI scam among consumers? According to the Credit One Bank survey, nearly 24% of consumers named fake phone calls or voice messages cloned to sound like their bank as their top AI scam fear, ranking above scam texts and phishing emails. ### Can AI really clone someone's voice from a short recording? Yes. Voice cloning tools now require as little as 20 to 30 seconds of audio to produce a convincing replica. Public voicemails, social media videos, and recorded calls are all potential sources. ### How do you verify a caller is actually a family member and not an AI? A shared family codeword or rotating verification phrase is one of the most reliable methods. If the caller knows the current words, it's them. If they can't answer, the call ends. Trust Onion rotates these codewords every 60 seconds so stolen words expire quickly. ### What should I do if I get a suspicious call from someone claiming to be my bank or a family member? Don't act on urgency. Hang up and call back using a number found independently, but a successful callback does not prove the original caller was legitimate. For family, the caller must still know your private Trust Onion Three Words. Never move money based on a single call without confirming identity through a second channel. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. The private three-word challenge adds a check beyond a familiar voice, caller ID, or message. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Your Voice Is on Social Media. Scammers Are Using It." published: 2026-09-02T00:08:39.331Z updated: 2026-10-11T06:12:48.022Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/deepfake-voice-cloning-social-media-scams-2026 --- # Your Voice Is on Social Media. Scammers Are Using It. **Cite as:** Your Voice Is on Social Media. Scammers Are Using It., Trust Onion, 2026-10-11. https://trustonion.io/blog/deepfake-voice-cloning-social-media-scams-2026 A birthday video on Facebook. A travel clip on TikTok. A few seconds of you talking on Instagram. According to a 2026 McAfee survey of thousands of Americans, 1 in 10 have already experienced a voice clone scam, and the tools to run one are free. Voice cloning software requires as little as 20 to 30 seconds of audio to generate a convincing copy of someone's voice. Public posts on Facebook, YouTube, TikTok, and Instagram supply that audio by the hour, every day, for free. The April 2026 McAfee survey found that 1 in 10 Americans reported experiencing a voice clone scam. That is your extended family, your office floor, your neighborhood. The attacks hit businesses too: cybersecurity experts cited in the InvestigateTV report flagged cloned-voice calls directing employees to buy gift cards on behalf of a boss. The fake voice sounds real. The urgency sounds real. Then the gift card codes get read off over the phone to someone who is not who they claimed to be. ## Why Social Media Made This Easier For most of history, voice impersonation required talent, practice, and proximity to the target. Social media removed all three. People post holidays, graduations, tutorials, and commentary constantly, and most of it is publicly accessible audio that can be fed into a cloning tool that costs nothing. The InvestigateTV report identifies Facebook, YouTube, TikTok, and Instagram as the primary harvesting grounds. Ordinary people's voices are now raw material for fraud, not just celebrities with large public profiles. The scam works because the brain trusts familiar voices. When someone hears a cloned voice that sounds exactly like a family member, the instinct to help kicks in before skepticism does. Research suggests people correctly identify a cloned voice only about 55 to 60 percent of the time in controlled conditions. In a stressful real-world call, that number drops further. Listening harder is not the answer. --- ## Adding Something AI Cannot Clone If the scam depends entirely on sounding like someone you trust, the defense is to add something the scammer cannot fake. Trust Onion gives families three rotating codewords that change every 60 seconds, calculated locally on the phone with no server involved. When a call comes in from someone claiming to be a family member, one question cuts through it: "What are the words?" A real family member answers instantly. A scammer with a cloned voice cannot. The codewords are never posted online, never in a video, never in a voicemail, so there is nothing to harvest. Even if a word were somehow intercepted, it expires in 60 seconds. For security and finance teams worried about fake-boss calls and unauthorized transfers, the same principle applies: a shared verification phrase takes three seconds to ask and immediately separates a real executive request from a cloned one. The scam collapses the moment someone asks "What are the words?" and gets silence back. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - A 2026 McAfee survey found 1 in 10 Americans has experienced a voice clone scam, and the tools to run one are free and require as little as 20 to 30 seconds of audio. - Scammers harvest voice audio from Facebook, TikTok, YouTube, and Instagram to impersonate real people, including fake-boss calls that have directed employees to purchase gift cards. - Humans correctly identify cloned voices only about 55 to 60 percent of the time, making a shared rotating codeword, not careful listening, the reliable defense. ## Frequently asked questions ### How do scammers clone someone's voice from social media? Scammers download video clips from public posts on platforms like TikTok, Facebook, and YouTube, then feed the audio into free voice cloning tools. As little as 20 to 30 seconds of audio is enough to generate a convincing fake voice. ### How common are voice cloning scams in 2026? According to a 2026 McAfee survey of thousands of Americans, 1 in 10 reported experiencing a voice clone scam. Cybersecurity experts describe the technology as freely accessible to anyone. ### Can you tell if a voice on the phone is AI-generated? Research suggests people correctly identify cloned voices only about 55 to 60 percent of the time in controlled settings. In stressful real-world calls, accuracy is likely lower. Listening carefully is not a reliable defense. ### What is the best way to protect your family from voice clone scams? Set up a shared family verification phrase or rotating codeword. When someone calls claiming to be a family member, ask for the words. A scammer with a cloned voice cannot answer. Trust Onion provides this for free. ### Are businesses also targeted by voice cloning scams? Yes. Cybersecurity experts warn that employees receive cloned-voice calls impersonating managers and directing them to purchase gift cards or transfer funds. The fake voice sounds authentic, making verbal requests alone an unreliable verification method. ## More from Trust Onion See how Trust Onion gives people and teams a practical way to verify identity, with rotating codewords that change every 60 seconds and never touch a server. Explore Trust Onion Free at trustonion.io. --- title: "Nevada's $36,000 AI Scam Problem (And How to Stop It)" published: 2026-09-02T00:03:22.575Z updated: 2026-10-11T06:12:48.114Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/nevada-ai-voice-scam-36000-average-loss --- # Nevada's $36,000 AI Scam Problem (And How to Stop It) **Cite as:** Nevada's $36,000 AI Scam Problem (And How to Stop It), Trust Onion, 2026-10-11. https://trustonion.io/blog/nevada-ai-voice-scam-36000-average-loss Nevada victims of AI-powered phone scams lose an average of more than $36,000 per case, according to a BrokerChooser analysis cited by KTNV in September 2026. The voice on the call sounds exactly like someone you love, and it knows details only they would know. The call arrives and the voice sounds like your son. It mentions the trip he posted about last month, maybe the name of his dog. Then it says he's in trouble and needs money now. Nevada ranks among the top states for AI scam losses, and researchers say the pattern is predictable: a large retiree population, heavy social media use across all age groups, and a culture where a panicked phone call can feel urgent before your brain catches up. The average loss is $36,000 per case. That's a car, a year of rent, a retirement account withdrawal that cannot be undone. ## How the Scam Is Built It starts long before anyone picks up the phone. Scammers pull names, relationships, and personal details from public social media profiles, data broker sites, and leaked databases. A photo from Thanksgiving, a post about a cross-country drive, a comment thread where someone tags your mother's full name. Automated tools do most of this work in minutes. Voice cloning requires as little as 20 to 30 seconds of audio, collected from a voicemail, a social media video, or a YouTube clip. The resulting synthetic voice can match tone, accent, and emotional quality closely enough to fool people who have known that person for decades. A Truecaller spokesperson quoted in the KTNV report was direct: synthetic voices can mimic real people convincingly, and consumers should not react to inbound requests for financial or personal information, no matter how familiar the voice sounds. When the call comes, the story is urgent. Arrested, stranded, in danger. Act now, don't tell anyone, send money through a method that can't be reversed. The personalized detail from social media is what makes it land. When a fake voice mentions something specific and recent, your brain stops questioning and starts reacting. This works on smart people. It works on cautious people. The scam doesn't exploit stupidity. It exploits love, and scammers engineer exactly that moment. --- ## What No Longer Works A few years ago the standard advice was: trust your ears. That advice is now wrong. Voice alone is no longer a reliable identifier. Neither is a familiar phone number, which can be spoofed, nor personal details, which are widely available, nor speaking style, which AI can replicate from a short sample. People need something the AI cannot have. Before reacting to any urgent request from someone claiming to be a person you know, a bank, or another trusted institution, ask one question: "What are the words?" Trust Onion gives families three rotating codewords that change every 60 seconds, calculated locally on each person's phone with no server or internet connection required. An AI can clone a voice. It cannot know codewords that rotate every minute and live only on authorized devices. If the caller cannot answer, the call is over, regardless of how real the voice sounds or how official the caller ID looks. A private three-word challenge gives you a concrete action to take instead of relying on willpower in a moment of panic. When you call back on a known number to verify, remember that a successful callback alone does not prove the original caller was legitimate; the person must still know the family's private Trust Onion Three Words. Beyond codewords, a few steps help. Lock down your social media, especially video content that carries your voice or the voices of people close to you. Make a rule that no money moves in response to a phone call without a separate verification step. If someone may genuinely be in danger, alert the authorities. Nevada's $36,000 average loss is not inevitable. It's what happens when the technology improves and the defenses don't. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Nevada victims of AI phone scams lose an average of $36,000 per case, according to a BrokerChooser analysis reported by KTNV in September 2026. - Voice cloning requires as little as 20 to 30 seconds of audio, which scammers collect from social media and voicemails, producing synthetic voices that can fool people who have known the real person for decades. - Three rotating codewords that change every 60 seconds give people a concrete, scam-proof way to verify who they're really talking to, because an AI impersonator cannot know them. ## Frequently asked questions ### How are scammers using AI to impersonate family members on the phone? Scammers collect short audio clips from social media or voicemails, then use AI voice cloning tools to generate a synthetic voice that mimics a real person. The cloned voice is used in live or pre-recorded calls, backed by personal details harvested from public profiles, to pressure victims into sending money. ### How much money are Nevada residents losing to AI phone scams? According to a BrokerChooser analysis cited by KTNV in September 2026, Nevada victims of AI-powered scams lose an average of more than $36,000 per case, placing Nevada among the top states for this type of fraud. ### How can I tell if a phone call is using a cloned AI voice? You often cannot tell by listening alone. AI voice cloning is advanced enough to fool people who know the person well. The safest approach is to use a pre-arranged codeword or verification phrase rather than relying on how the voice sounds. ### What should I do if I get a suspicious call from someone claiming to be a family member? Ask for your family's agreed-upon verification phrase before taking any action. If they can't answer, hang up and call back on a number you already have saved. Note that a successful callback alone doesn't prove the original caller was legitimate; the person must still know your private codewords. Never send money based solely on an inbound call. ### What is Trust Onion and how does it protect against AI voice scams? Trust Onion is a free app that gives people three rotating codewords that change every 60 seconds. When someone calls claiming to be a family member or trusted institution, you ask for the words. An AI impersonator won't know them, so the scam ends immediately. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. The private three-word challenge adds a check beyond a familiar voice, caller ID, or personal detail that AI could have pulled from the internet. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "BBB: AI Is Making Scam Calls Smarter and More Personal" published: 2026-08-31T00:03:39.095Z updated: 2026-10-11T06:12:48.621Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/bbb-warns-ai-voice-cloning-scam-calls-2026 --- # BBB: AI Is Making Scam Calls Smarter and More Personal **Cite as:** BBB: AI Is Making Scam Calls Smarter and More Personal, Trust Onion, 2026-10-11. https://trustonion.io/blog/bbb-warns-ai-voice-cloning-scam-calls-2026 More than 37,700 scam calls were reported to the Better Business Bureau in just the first seven months of 2026, a pace that would shatter previous records. The tool driving that surge is AI. A scammer finds a birthday video on Facebook. Twenty to thirty seconds of audio is enough for modern voice cloning tools to produce a convincing fake voice. From there, the call goes out sounding exactly like your CFO, your finance director, or a trusted vendor, saying a wire needs to go out right now. In August 2026, the Better Business Bureau issued a formal warning that scammers are using AI voice cloning, internet-based phone services, and automated personalization tools to make phone and text fraud faster and cheaper to run. The warning drew on a BBB study of over 433,000 Scam Tracker reports filed since 2022. Consumers reported over 37,700 scam calls through July 2026 alone, nearly 5,400 per month. For scale, the Federal Trade Commission reported that phone-based fraud cost Americans over $1.1 billion in 2023, and AI tools have only lowered the barrier since. The BBB flagged social media audio as a primary source for voice cloning material. Scammers also spoof caller ID so a call appears to come from an executive's direct line, and automated tools let them personalize messages at scale. The result is a call that looks right, sounds right, and arrives with manufactured urgency. ## Why Callbacks Fall Short The BBB advises slowing down and verifying through a separate channel. That guidance is sound, but it assumes the separate channel is reliable. If a scammer is already spoofing an executive's actual number, calling back on that same number is not a clean solution. A callback that goes unanswered or connects to a second spoofed line does not prove the original caller was legitimate. Verification needs to be something the scammer cannot access, no matter how convincing the call sounds. That is the gap AI exploits. The voice is real enough. The number checks out. The story is urgent. Every normal verification reflex the team has is designed to fail. ## One Question the Scam Cannot Answer Trust Onion gives finance and operations teams three rotating codewords. The words change every 60 seconds, calculated locally on each authorized person's phone, with no server required and no internet connection needed. Before approving a wire, changing vendor payment details, or acting on an urgent executive request, staff ask one question: "What are the words?" An AI voice clone cannot answer that. A scammer does not have your team's words. And because the words expire every 60 seconds, even someone who overheard them would find them useless almost immediately. The BBB is right that scammers are getting better at sounding real. But sounding real is not the same as knowing something that only authorized team members know, rotating on a 60-second schedule. --- The BBB's broader advice holds: be skeptical of urgent money requests, avoid sending wire transfers or gift cards under pressure, and think carefully about audio posted to social media. Awareness matters. But awareness alone does not give a finance team something to reach for in the moment, under pressure, with a convincing voice on the line. In 2026, the question that ends the scam in three seconds is also the simplest one a team can ask. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - The BBB analyzed over 433,000 scam reports since 2022 and found AI tools are making phone fraud faster, cheaper, and more convincing, with over 37,700 scam calls reported in just the first seven months of 2026. - Voice cloning requires just 20-30 seconds of audio, and scammers find that material in social media posts; spoofed caller ID and automated personalization make the resulting calls even harder to dismiss. - AI can clone a voice but cannot know three codewords that rotate every 60 seconds and exist only on authorized team members' phones, making "What are the words?" a check the scam cannot pass. ## Frequently asked questions ### What is the BBB warning about AI scam calls in 2026? In August 2026, the Better Business Bureau warned that scammers are using AI voice cloning, spoofed phone numbers, and automated tools to make scam calls more convincing and personalized. Their study covered over 433,000 Scam Tracker reports since 2022. ### How do scammers clone a family member's voice? Modern voice cloning tools require just 20-30 seconds of audio, which scammers find in social media posts and videos. Once cloned, the fake voice can be used in real-time phone calls to impersonate someone the target trusts. ### How can I verify a caller is really my family member and not a scammer? A shared rotating codeword system like Trust Onion lets you ask one question: "What are the words?" Only someone with app access and authorization knows the answer, which changes every 60 seconds. A failed callback alone does not confirm the original caller was legitimate. ### What should I do if I get a suspicious call from a family member's number? Do not send money or act under pressure. Ask a verification question only your real family member could answer. With Trust Onion, ask for the current three codewords. If the caller cannot answer, hang up. Use common sense and alert authorities if someone may be in danger. ### Is Trust Onion free to use? Yes. Trust Onion is free. It works offline, requires no server, and the rotating codewords are calculated locally on each authorized user's phone. ## More from Trust Onion Give your finance and operations teams a simple two-factor check for high-stakes requests. Trust Onion is free and takes minutes to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "80+ Stars Say AI Voice Cloning Is Out of Control" published: 2026-08-29T00:02:05.078Z updated: 2026-10-11T06:12:48.966Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/stars-back-save-our-voices-now-ai-voice-cloning-campaign --- # 80+ Stars Say AI Voice Cloning Is Out of Control **Cite as:** 80+ Stars Say AI Voice Cloning Is Out of Control, Trust Onion, 2026-10-11. https://trustonion.io/blog/stars-back-save-our-voices-now-ai-voice-cloning-campaign In August 2026, over 80 performers sent an open letter to the UK Prime Minister with a single demand: make it illegal to clone someone's voice without consent. The fact that Nicola Coughlan, Matt Lucas, and Hugh Bonneville had to ask for that law tells you how little protection anyone has right now. Alice Sockett, an audiobook narrator, co-founded the campaign after watching AI hollow out her industry. Save Our Voices Now calls voice cloning "an existential threat to our entire industry" and delivered its letter to Prime Minister Andy Burnham demanding clear, enforceable legal protections. If performers with agents, lawyers, and public platforms feel that exposed, ordinary families have far less standing. ## The scam most likely to reach your phone AI voice cloning can produce a convincing copy of someone's voice from as little as 20 to 30 seconds of audio pulled from a YouTube video, a TikTok, a voicemail, or a phone call. The cloned voice can then say anything: read a script, beg for help, claim to be in danger. According to the Federal Trade Commission, Americans lost over $1.1 billion to imposter scams in 2023, and AI voice cloning has become one of the most efficient tools scammers use to run those schemes. The FTC received more than 48,000 reports of family impersonation scams that year alone, and the real number is higher because most people never report it. The call follows a pattern. A voice that sounds exactly like your son says he's in trouble, needs money right now, and needs you not to tell anyone yet. Every instinct fires at once. The cloned voice is what makes the scheme work: once scammers can sound like someone you trust, your attention and your emotions follow. ## Why your ears can't save you Most people assume they'll catch a glitch, some robotic edge that gives it away. Research puts human detection accuracy for AI-generated audio at around 55 to 60 percent under controlled conditions. On a frantic call at midnight from someone who sounds like they're in danger, that number falls further. Familiarity with a voice, the thing you thought made you safe, is exactly what the cloning exploits. This is where Trust Onion comes in. When a call arrives from someone claiming to be your son, your doctor, or your bank's fraud department, you ask one question: "What are the words?" Trust Onion's three rotating codewords change every 60 seconds, calculated locally on your phone with no server required. A real person who is authorized can answer. A scammer using a cloned voice cannot. The words aren't stored anywhere that can be breached, and they rotate on a schedule so even an overheard word expires before it can be reused. Note: a failed callback to a number you believe is legitimate does not prove the original caller was genuine. Always use a number from an official card, statement, or app, and contact authorities if you believe someone may be in danger. --- The Save Our Voices Now campaign is fighting for the right law, and legislation matters. But law moves slowly, and it cannot answer your phone. A scammer operating outside the UK who calls your mother at 11pm using a clone of your voice will not wait for royal assent. Nicola Coughlan and her fellow campaigners are trying to protect their livelihoods. The same 60 seconds it takes for the codewords to rotate is all it takes to protect yours. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Over 80 performers signed an open letter in August 2026 demanding UK law against AI voice cloning without consent, calling it "an existential threat to our entire industry." - Americans lost over $1.1 billion to imposter scams in 2023, with AI voice cloning requiring as little as 20 to 30 seconds of audio to produce a convincing fake. - Human detection accuracy for AI-generated audio is only around 55 to 60 percent, so Trust Onion's rotating codewords, not your ears, are what a cloned voice cannot defeat. ## Frequently asked questions ### What is the Save Our Voices Now campaign? Save Our Voices Now is a UK campaign co-founded by audiobook narrator Alice Sockett and backed by over 80 performers including Nicola Coughlan and Matt Lucas. It sent an open letter to Prime Minister Andy Burnham in August 2026 demanding legal protections against AI voice cloning without consent. ### How easy is it to clone someone's voice with AI? Current AI voice cloning tools can produce a convincing copy of someone's voice from as little as 20 to 30 seconds of audio. That audio can come from a social media video, voicemail, podcast, or phone call. ### Can you tell if a voice on the phone is AI-generated? Research puts human detection accuracy for AI-generated audio at around 55 to 60 percent under controlled conditions. In a real call with emotional pressure, most people cannot reliably tell the difference. ### How does Trust Onion protect against voice cloning scams? Trust Onion gives you three rotating codewords that change every 60 seconds, calculated locally on your phone. When someone calls claiming to be a family member or trusted institution, ask for the words. A real person who is authorized knows them. A scammer using a cloned voice does not. ### Is Trust Onion free to use? Yes. Trust Onion is completely free. It works offline with no server required, and the rotating codewords expire automatically so stolen words cannot be reused. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. The private three-word challenge adds a check beyond a familiar voice, caller ID, or message: trustonion.io --- title: "BBB: AI Scam Complaints Hit 100,000 as Voice Cloning Explodes" published: 2026-08-28T00:07:51.378Z updated: 2026-10-11T06:12:49.280Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/bbb-ai-scam-complaints-100000-voice-cloning-warning-2026 --- # BBB: AI Scam Complaints Hit 100,000 as Voice Cloning Explodes **Cite as:** BBB: AI Scam Complaints Hit 100,000 as Voice Cloning Explodes, Trust Onion, 2026-10-11. https://trustonion.io/blog/bbb-ai-scam-complaints-100000-voice-cloning-warning-2026 The Better Business Bureau has logged over 100,000 scam complaints mentioning AI in the last three years, and the fastest-growing method isn't a phishing email or a fake website. It's a phone call that sounds exactly like someone you love. Complaints are climbing year over year and are on pace to surpass 3,000 in 2026 alone. The BBB issued its warning in August 2026: AI has turned phone fraud into an automated assembly line, and voice cloning is the sharpest tool on the belt. Scammers need just 20 to 30 seconds of audio to build a convincing clone of almost anyone's voice. A voicemail greeting is enough, and so is a social media video or a clip from a public recording. The clone can mimic tone, pacing, and speech patterns convincingly enough that human detection accuracy sits at only around 55 to 60 percent, barely better than a coin flip. --- ## The "Are You Sure It's Really Them?" Problem The call arrives. It sounds like your son. He's panicked, says he's been in an accident, needs money fast, please don't tell anyone. You wire the money. An hour later, your actual son calls. This is the scenario those 100,000 BBB complaints describe. The script works because it keeps you emotionally activated and moving fast. Scammers know families don't interrogate the people they love. The BBB's advice is to pause, call back on a known number, and verify. That's sound, but a failed callback does not prove the original caller was legitimate, and in a moment of panic, most people don't remember to do it at all. ## How the Automation Works AI doesn't sleep or need a call center. According to the BBB's August 2026 warning, scammers now chain multiple tools together: a cloned voice handles the call, a polished phishing message handles the follow-up, a deepfake video handles the proof. For higher-stakes fraud, the video call variant is especially dangerous. In February 2024, engineering firm Arup lost $25 million when an employee authorized a wire transfer after joining a video call where every participant, including someone who appeared to be a senior executive, was a deepfake. Each piece of the pipeline reinforces the others, and none of it requires a human scammer on the other end in real time. AI can clone a voice. It cannot know something it was never told. That's the gap a family's three rotating Trust Onion codewords fill. The free app gives every family three words that change every 60 seconds, calculated locally on each phone. When a call comes in sounding like your daughter, you ask one question: "What are the words?" A cloned voice cannot answer that. The words changed 40 seconds ago and will change again in 20 more. If the caller knows them, it's really her. If they hesitate or deflect, hang up. A failed callback on its own does not confirm the original caller was genuine; the codewords give you an independent check. A Proofie™ is a selfie signed using your passkey in the Trust Onion app. Share the link and anyone can verify in the app that your key signed that exact photo after a known moment, and that nothing has changed since. Codewords work alongside Proofies, not as an overlay or signed field. The BBB also recommends reporting scams at bbb.org/scamtracker, which helps others recognize patterns. Families who set up a verification plan before a call arrives are the ones who hang up before the money leaves their account. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - The BBB received over 100,000 AI-related scam complaints in three years, with 2026 on pace to surpass 3,000 reports. - Voice cloning requires just 20 to 30 seconds of audio, and human detection accuracy is only around 55 to 60 percent, barely better than a coin flip. - AI automates fraud at scale by combining cloned voices, phishing messages, and deepfake video, as shown when Arup lost $25 million to a deepfake video call in February 2024. ## Frequently asked questions ### How do scammers clone someone's voice? Scammers use AI voice synthesis tools that need just 20 to 30 seconds of audio. Sources include voicemail greetings, social media videos, and public recordings. The resulting clone can mimic tone, pacing, and speech patterns convincingly enough to fool family members. ### How many AI scam complaints has the BBB received? The Better Business Bureau has received over 100,000 complaints mentioning AI in the last three years. Reports are climbing year over year and are on pace to surpass 3,000 in 2026 alone. ### What should I do if I get a call from a cloned voice? Slow down, ask a question only the real person would know, and call them back on a number you already have saved. A failed callback does not prove the original caller was legitimate. A rotating codeword system gives you a fast, independent way to confirm identity before taking any action. ### Can AI fake a rotating codeword? No. A rotating codeword changes every 60 seconds and is calculated locally on each family member's phone. It is never shared publicly, so there is no audio or data for an AI to learn it from. A voice clone cannot know a word it was never told. ### Is there a free app to protect my family from voice cloning scams? Yes. Trust Onion is free and gives your family three rotating codewords that change every 60 seconds. When a call comes in, you ask what the words are. If the caller can't answer correctly, they aren't who they claim to be. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. It's free and takes about two minutes to set up. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Her Daughter's Voice Begged for Help. It Wasn't Her." published: 2026-08-28T00:04:03.210Z updated: 2026-10-18T05:23:19.481Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-kidnapping-scam --- # Her Daughter's Voice Begged for Help. It Wasn't Her. **Cite as:** Her Daughter's Voice Begged for Help. It Wasn't Her., Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-voice-cloning-kidnapping-scam A California mother wired more than $5,000 to strangers before she learned her daughter had never been to Mexico at all. "I was totally taken by it," she told CNN's Kate Bolduan on May 28, 2026. The call came with a voice she recognized immediately: her daughter, crying, scared, pleading. Scammers had built that voice from a few seconds of publicly available audio, and they used it to convince a California mother that her child had been kidnapped in Mexico. This is the kidnapping ransom hoax, now powered by AI voice cloning. The technology can generate a convincing replica of someone's voice from a TikTok clip, a YouTube video, or a voicemail greeting. Once the clone exists, it can say anything the scammer types. It can sob. It can say your name. The FTC reported that Americans lost $1.1 billion to imposter scams in 2023, and the tools behind those scams have only grown cheaper since. ## How the Script Works The call follows a pattern designed to collapse rational thinking. An unfamiliar number. A voice you love, screaming that she is in danger. Then a second voice, calm and controlled, telling you not to hang up, not to call the police, not to contact anyone else. Wire transfers, gift cards, cryptocurrency, demanded while the scammer keeps you on the line so you cannot verify anything. The panic is the product. The California mother is not naive. She is a mother who heard what sounded like her daughter in distress, and the scam was built precisely for that moment. --- The natural instinct is to hang up and call your child directly. That is the right move, but scammers have answers for it. Some hold victims on the line the entire time, insisting that hanging up will harm the hostage. Others spoof caller ID so calls appear to come from a familiar number, or time the call to when the real person is traveling or unreachable. By the time the victim reaches their loved one, the money is already gone. A failed callback does not prove the original caller was legitimate. Use a number from your own contacts, not one the caller provides. If you believe someone may genuinely be in danger, alert authorities. ## The Question a Cloned Voice Cannot Answer AI can replicate how someone sounds. It cannot know what only that person knows at this exact second. Trust Onion gives families three private codewords that rotate every 60 seconds, calculated locally on each person's phone and never stored on a server. When a suspicious call comes in, you ask: "What are the words?" A real family member with the app knows. A scammer with a cloned voice does not. If the California mother's family had been using those codewords, the call would have ended there. Silence on the other end. Scam over. Tell your family this scam exists. Share the California mother's story. When people know that voice cloning is real, they are more likely to pause before acting. If you get a distressing call, hang up, call your loved one on a number already saved in your contacts, and remember that a successful callback is not proof the original caller was genuine. Report the call to the FTC at reportfraud.ftc.gov. The California mother spoke out because she did not want this to happen to another family. The scam worked on her because it was engineered to. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Scammers cloned a California woman's daughter's voice using publicly available audio and extorted more than $5,000 with a fake kidnapping call. - The FTC reported $1.1 billion in imposter scam losses in 2023, and losses continue to rise as AI voice cloning tools grow cheaper and easier to access. - AI can clone a voice but cannot know three rotating codewords that change every 60 seconds and are calculated locally on your phone, never stored on a server. ## Frequently asked questions ### How do scammers clone someone's voice for a kidnapping scam? Scammers use AI voice cloning software to build a replica from as little as a few seconds of publicly available audio: a social media video, a YouTube clip, or a voicemail greeting. The cloned voice can then say anything the scammer types, including crying and using your name. ### What should I do if I get a fake kidnapping ransom call? Hang up and call your loved one directly using a number already saved in your contacts. Do not wire money, buy gift cards, or stay on the line under pressure. A failed callback does not prove the original caller was legitimate. Report the call to the FTC at reportfraud.ftc.gov. ### Can AI voice cloning scams be stopped? A shared family verification code is the most effective defense. Trust Onion provides three rotating codewords that change every 60 seconds. A cloned voice cannot answer "What are the words?" because the answer changes constantly and is never stored on a server. ### How much have Americans lost to imposter scams? According to the Federal Trade Commission, Americans reported losing $1.1 billion to imposter scams in 2023. Losses continue to grow as AI voice cloning tools become cheaper and easier to access. ### How little audio does it take to clone someone's voice? Modern voice cloning tools can generate a convincing replica from just a few seconds of audio. A short social media video, a public voicemail greeting, or a brief clip posted online is often enough for scammers to work with. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords that change every 60 seconds and can't be cloned from a social media clip. Trust Onion is free and takes minutes to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "WPP CEO Mark Read Was the Face of a Deepfake Scam" published: 2026-08-25T00:03:02.038Z updated: 2026-10-11T06:12:49.765Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/wpp-ceo-mark-read-deepfake-scam-2024 --- # WPP CEO Mark Read Was the Face of a Deepfake Scam **Cite as:** WPP CEO Mark Read Was the Face of a Deepfake Scam, Trust Onion, 2026-10-11. https://trustonion.io/blog/wpp-ceo-mark-read-deepfake-scam-2024 In May 2024, fraudsters put an AI voice clone of WPP CEO Mark Read into a live Microsoft Teams meeting and used YouTube footage of him as cover. The real Mark Read was not on that call. The setup was methodical. Scammers built a fake WhatsApp account using Mark Read's photo, used it to arrange a Microsoft Teams call with a WPP agency leader, then ran the deception on two tracks at once: an AI-generated voice clone of Read spoke during the meeting while a separate chat window impersonated him in text. The goal was to extract money and personal details under the cover of launching a new business venture. The attack failed. But what was deployed here was not a phishing email or a spoofed sender address. It was a real-time, multi-channel impersonation of a sitting CEO, complete with his voice, his face, and a plausible business pretext, conducted inside a tool that most organizations treat as inherently trustworthy. Voice cloning requires as little as 20 to 30 seconds of audio. Mark Read, as CEO of the world's largest advertising firm, has given countless interviews and recorded presentations over the years. That audio is public. Anyone with a laptop and the right tools can use it. The fake WhatsApp account, the Teams invitation, the YouTube footage used as visual cover: none of it required insider access or technical expertise beyond what is now widely available. --- WPP is not the only name on this list. In February 2024, engineering firm Arup lost $25 million when an employee authorized a wire transfer after joining a video call where every visible participant was a deepfake. In 2023, a finance worker at a multinational firm in Hong Kong transferred $200 million Hong Kong dollars after a video call featuring what appeared to be the company's CFO. The CFO was not on that call. According to the FBI's Internet Crime Complaint Center, business email compromise and related executive impersonation fraud cost U.S. organizations $2.9 billion in 2023 alone. Voice and video-based variants are pushing that number higher. The pattern in each case is the same. The executive is the weapon, not the target. The actual damage happens downstream, when a finance team member or senior operations lead receives the request and acts on it. In the WPP incident, the agency leader on that Teams call had no way to verify that the voice and face on screen were real. The deception held long enough to make a pitch. It failed because the agency leader was skeptical and did not act. Skepticism is not a system. It is not repeatable or scalable across an organization. ## What Stops a Deepfake in Real Time What organizations need is a verification layer that does not depend on whether a voice sounds right or a face looks real. Trust Onion gives finance teams and senior leaders exactly that. Before any wire approval, vendor change, or urgent payment request moves forward, the receiving team member asks one question: "What are the words?" Three rotating codewords are distributed across the organization's verification chain, calculated locally on each authorized device every 60 seconds with no server required. The real executive knows the current words. A cloned voice does not. The barrier to constructing a fake video meeting participant is lower today than it was twelve months ago. Organizations that build a simple, consistent verification step into their authorization workflows stop waiting for the next attack to find out whether their people will catch it in time. If the WPP agency leader had been using a codeword protocol, the scam would have ended in the first thirty seconds. The AI voice, however convincing, could not have answered. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - In May 2024, fraudsters used an AI voice clone and YouTube footage of WPP CEO Mark Read to impersonate him in a live Microsoft Teams meeting, targeting a WPP agency leader for money and personal details. - The real vulnerability is not the executive being impersonated but the finance or operations leader who receives the request and has the authority to act, a pattern behind $2.9 billion in U.S. losses in 2023 alone, according to the FBI's Internet Crime Complaint Center. - Skepticism is not a repeatable control: a rotating codeword protocol stops voice and video impersonation fraud because a cloned voice cannot supply words that change every 60 seconds. ## Frequently asked questions ### What happened in the WPP deepfake scam involving Mark Read? In May 2024, fraudsters created a fake WhatsApp account using WPP CEO Mark Read's image, arranged a Microsoft Teams meeting, and deployed an AI voice clone alongside YouTube footage to impersonate him. The goal was to solicit money and personal details from a WPP agency leader. The attack failed. ### How do deepfake voice scams target businesses? Attackers clone an executive's voice using publicly available audio, then join a meeting posing as that executive to request wire transfers, vendor approvals, or sensitive data. The impersonation happens in real time, making it difficult for employees to detect without a structured verification system in place. ### How can companies verify a caller is really their CEO or CFO? A rotating codeword protocol requires the caller to supply current codewords known only to verified personnel. The words change every 60 seconds, so a cloned voice cannot pass verification. Trust Onion implements this at no cost. Note: a failed callback alone does not confirm the original caller was legitimate; use an independently sourced contact method. ### How much has executive impersonation fraud cost businesses? The FBI's Internet Crime Complaint Center reported $2.9 billion in losses from business email compromise and executive impersonation fraud in 2023. Voice and video-based variants are increasingly common, including a $25 million loss at Arup and a $200 million Hong Kong dollar transfer at a multinational firm, both in 2024. ### Can you tell a deepfake voice from a real one on a call? Human detection accuracy for AI-generated voices hovers around 55 to 60 percent, barely better than chance. Relying on whether a voice sounds right is not a reliable control. A structured verification step, asking "What are the words?" before any high-stakes action, is required. ## More from Trust Onion Add Trust Onion's rotating codeword check to executive and wire-transfer approvals. Before any high-stakes request moves forward, your team asks "What are the words?", the real executive knows, and an impersonator does not. Trust Onion is free and requires no server or technical setup. --- title: "AI Scam Bots Are Calling Your Family Right Now" published: 2026-08-23T00:03:03.700Z updated: 2026-10-11T06:12:50.406Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-scam-bots-calling-family-phone-fraud-2026 --- # AI Scam Bots Are Calling Your Family Right Now **Cite as:** AI Scam Bots Are Calling Your Family Right Now, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-scam-bots-calling-family-phone-fraud-2026 A Kotaku writer's family member picked up the phone and heard a polite, helpful Royal Mail worker. The caller was an AI bot, one of thousands making scam calls every hour. The bot didn't ask for much at first. It just sounded helpful. For years, phone scams meant a real person reading from a script in a call center. You could sometimes hear background noise, catch an off-note in the phrasing. That era is ending. According to Kotaku's reporting from August 2026, AI-powered scam bots now handle entire phone conversations without a human in the loop, responding naturally, pivoting when challenged, and staying in character under pressure. One server can run hundreds of simultaneous calls. The bot doesn't get tired, doesn't get flustered, and doesn't break character the way a nervous human might. Deepfake video is following the same trajectory. In February 2024, engineering firm Arup lost $25 million after an employee joined a video call where every participant, including the CFO, was a deepfake. ## Who's Most at Risk Kotaku calls out older adults as the population most at risk, and the numbers bear that out. The FBI's Internet Crime Complaint Center reported that Americans over 60 lost more than $3.4 billion to fraud in 2023, the highest loss of any age group. AI bots make this worse for a specific reason: older adults often rely on voice cues to judge whether a caller is legitimate. Voice cloning now requires as little as 20-30 seconds of audio to generate a convincing replica. That audio can come from a voicemail, a social media video, or any recording. A bot can call your mom sounding like you, or call your grandfather sounding like your dad. The same Kotaku piece highlights a community of YouTube creators who turn these bots against themselves. Kitboga and Jim Browning spend hours on calls with scammers, exposing tactics and occasionally triggering what can only be described as a bot breakdown. Prompt injection is one technique: if a scammer's AI bot processes text from the call, a clever responder can insert hidden instructions that confuse or derail it, sending the AI into clips of glorious self-contradiction. The breakdowns are funny. The underlying problem is not. For every bot that gets baited into a meltdown on YouTube, thousands more complete calls against real targets. ## What the Bots Can't Fake Human detection accuracy for AI-generated voices sits around 55-60 percent, barely better than a coin flip. Awareness matters, but awareness alone doesn't stop a convincing AI caller from talking your parent into a gift card purchase before they realize what happened. An AI scam bot cannot know what it was never told. If your family shares three rotating codewords known only to yourselves, no bot can answer "What are the words?" Those words aren't in any training data, aren't on any social media profile, and rotate every few hours, calculated locally on your phone. Trust Onion generates exactly that kind of private knowledge. You pick up a call from someone claiming to be your daughter in trouble. You ask: "What are the words?" If she's your real daughter, she knows. If it's a bot, the call ends there, not after a long suspicious conversation, not after transferring any money. The Royal Mail bot that called the Kotaku writer's family member is one example among millions, and the technology keeps getting better at passing for human. The answer to that doesn't have to be complicated. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI scam bots now conduct entire phone conversations without a human operator, scaling fraud to hundreds of simultaneous calls from a single server. - Voice cloning requires as little as 20-30 seconds of audio, and Americans over 60 lost more than $3.4 billion to fraud in 2023 as AI bots specifically exploit voice-based trust. - Three rotating family codewords stop impersonation calls instantly because no AI bot can answer "What are the words?" with knowledge it was never given. ## Frequently asked questions ### How do AI scam bots make phone calls? AI scam bots use large language models to hold real-time voice conversations. Given a persona and a goal, they dial automatically. One server can run hundreds of simultaneous calls with no human involvement. ### Can AI really clone a family member's voice? Yes. Voice cloning now requires as little as 20-30 seconds of audio to generate a convincing replica. That audio can come from voicemails, social media videos, or any recording. ### What is prompt injection in a scam call? Prompt injection is a technique where someone inserts hidden instructions into a conversation to confuse or redirect an AI bot. Scambaiters like Kitboga and Jim Browning use it to expose scammer tactics on YouTube. ### How do family codewords stop AI scam calls? Three rotating codewords known only to your family can't be guessed or looked up. When someone calls claiming to be a family member, you ask "What are the words?" A real family member knows. A scam bot doesn't. ### Are AI phone scams getting more common? Yes. Kotaku reported in August 2026 that AI-powered scam bots are already reaching ordinary families at scale. Deepfake video scams are following the same trend, with cases like the $25 million Arup fraud in February 2024. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Protect Your Family Free at trustonion.io. --- title: "AI Is Making Elder Fraud Smarter. Families Are Paying the Price." published: 2026-08-19T00:04:58.841Z updated: 2026-10-11T06:12:50.430Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-elder-fraud-family-fallout-2026 --- # AI Is Making Elder Fraud Smarter. Families Are Paying the Price. **Cite as:** AI Is Making Elder Fraud Smarter. Families Are Paying the Price., Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-elder-fraud-family-fallout-2026 A grieving widow lost $7,000 to fraudsters who knew details about her late husband's tax records, details she never volunteered. According to USA Today's August 2026 investigation, scammers now use AI tools to mine obituaries, public records, and social media to build detailed profiles of vulnerable older adults before placing the first call. The fraudsters who targeted the widow in USA Today's report didn't fish for information. They arrived with it. The spouse's name. The neighborhood. The tax records. By the time she realized something was wrong, $7,000 was gone. That specificity comes from AI-powered research. Scammers can scan thousands of obituaries, cross-reference them with property records and social media, and build a working profile of a grieving person in minutes. The widow's situation was not an accident: already overwhelmed, sorting through a dead husband's paperwork, she fielded a call about taxes that felt entirely plausible. Scammers pick those moments deliberately. ## Why Older Adults Are Targeted Fraud researchers have documented this pattern for years. Many older adults are home more often, more likely to take official-sounding calls at face value, and more likely to be isolated after losing a spouse. They often have savings, home equity, or retirement accounts that make them worth the effort. The Federal Trade Commission reported that adults over 60 lost more than $1.9 billion to fraud in 2023, a figure researchers believe understates the real toll, since many cases go unreported out of embarrassment or because the victim never realizes what happened. Voice cloning adds another layer of difficulty. AI voice synthesis can replicate someone's voice from as little as 20 to 30 seconds of audio, including videos posted publicly on social media. A scammer who finds a video of a deceased person on Facebook can clone that voice and use it in a follow-up call, or clone a son's or daughter's voice to manufacture a family emergency. Human detection accuracy for AI-generated voices sits at around 55 to 60 percent, barely better than a coin flip. ## The Isolation Instruction Nearly every scam of this kind contains one specific instruction: don't tell anyone. Don't call your kids. Don't contact your bank. Handle this now, quietly, with us. That instruction is the tell. Real government agencies don't demand immediate payment over the phone. Real tax issues arrive with written notices. But when someone is grieving, exhausted, and talking to a caller who seems to already know things they shouldn't, that logic is harder to hold onto. The adult children in USA Today's reporting describe the guilt of not having been there, and the complicated grief of watching a parent become frightened or withdrawn. Some describe parents who refused to believe they were scammed at all. That fallout is hard to quantify, and it lasts. --- Three rotating codewords can stop a scam before it gains traction. Trust Onion calculates the words locally on each device, no server required, and rotates them every 60 seconds on a schedule only your group's devices know. When a call comes in from someone claiming to be family, an elderly parent pauses and asks one question: "What are the words?" AI can clone a voice and research an obituary, but it cannot know words that exist only on authorized devices and were never written down anywhere online. If the caller can't answer, hang up and call back on a number you already have stored independently, a number from a card, a statement, or another source you control. A failed callback does not prove the original caller was legitimate; it only confirms you've broken contact. If you believe someone may be in real danger, alert the authorities. The widow in USA Today's story wasn't careless. She was grieving and alone when someone called with information that seemed real. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI tools now let scammers mine obituaries and public records to build convincing profiles of grieving seniors before placing a single call. - Adults over 60 reported more than $1.9 billion in fraud losses in 2023, and most cases go unreported. - Three rotating codewords give elderly parents a simple, concrete way to verify who they're really talking to. A cloned voice cannot know words that exist only on authorized devices. ## Frequently asked questions ### How do scammers get personal information about elderly victims? Scammers use AI tools to scan obituaries, social media profiles, property records, and public tax filings to build detailed profiles. Grieving seniors are especially vulnerable because their personal circumstances are often publicly documented after a spouse's death. ### How much money do elder fraud scams cost families each year? The FTC reported that adults over 60 lost more than $1.9 billion to fraud in 2023. Researchers believe real losses are higher because many cases go unreported, often out of embarrassment or because the victim never realizes they were scammed. ### Can AI clone the voice of a deceased person to scam their family? Yes. AI voice synthesis can replicate someone's voice from as little as 20 to 30 seconds of audio, including publicly posted videos. Scammers can use a deceased person's voice to seem credible, or clone a living family member's voice to manufacture false urgency. ### What is a family codeword and how does it stop elder fraud? A family codeword is a shared phrase only real family members know. Trust Onion rotates three codewords every 60 seconds on each device. When a suspicious call comes in, an elderly parent asks "What are the words?" Anyone who can't answer is not who they claim to be. ### What should I do if my elderly parent was scammed? Contact their bank immediately to flag any transfers. File a report with the FTC at reportfraud.ftc.gov and your state's attorney general. Avoid placing blame; these scams target careful people. Focus on preventing future contact and consider setting up a family verification system going forward. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. When someone calls claiming to be family, they just ask: "What are the words?" A cloned voice cannot answer. Trust Onion is completely free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Her Mom's Voice Begged for Help. It Was a Fake." published: 2026-08-18T00:05:22.451Z updated: 2026-10-11T06:12:50.876Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-kidnapping-scam-lawrence-kansas --- # Her Mom's Voice Begged for Help. It Was a Fake. **Cite as:** Her Mom's Voice Begged for Help. It Was a Fake., Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-cloning-kidnapping-scam-lawrence-kansas A Lawrence, Kansas woman picked up the phone and heard her mother screaming in the background. A man's voice told her: your mother is being held at gunpoint. Send money now. The voice sounded exactly like her mom. It wasn't. Police traced the mother to her workplace, then to a moving vehicle, triggering a felony traffic stop before confirming she was safe. The call was a scam, built from an AI clone of her mother's voice, and it nearly worked. The City of Lawrence, Kansas published this case in February 2026 as a public warning. Scammers harvested audio from the mother's social media posts and voicemails, fed those clips into a voice cloning tool, and produced a synthetic voice convincing enough that a daughter believed her mother was in danger. Voice cloning now requires just 20 to 30 seconds of audio, and most people's voices are already out there: birthday videos, Facebook posts, TikToks, voicemail greetings. ## How the Playbook Runs The fake kidnapping scam has existed for years. The AI layer is new. Scammers identify a target family, find audio of a family member online, clone the voice with widely available tools, then spoof the family member's real phone number so caller ID looks legitimate. They play the cloned voice screaming in the background, deliver a ransom demand, and pressure the victim to stay on the line and send money immediately. Panic short-circuits judgment, and that pressure is the whole point. In the Lawrence case, the caller ID showed the mother's own number. The voice sounded like the mother. Both signals had been faked. Caller ID spoofing is trivially easy: services exist that let anyone display any number they want. Pair a spoofed number with a cloned voice and the deception feels airtight. The Lawrence woman did the right thing. She called police rather than sending money. Officers tracked the mother's phone to her workplace, then to a vehicle, which triggered a high-risk felony traffic stop. Everyone was safe, but the situation escalated to a serious law enforcement response before anyone could confirm the mother was fine. Even when a victim doesn't pay, the fear alone creates real consequences. According to the FBI's Internet Crime Complaint Center, Americans reported over $4.57 billion in losses to phone fraud in 2023, with AI voice tools lowering the barrier for anyone willing to run these schemes. ## The One Thing a Scammer Cannot Clone Trust Onion gives families three rotating codewords, shared only within the group, calculated locally on each person's phone. The words change every few hours. No server stores them. They work offline. If that Lawrence woman had Trust Onion, she could have said, the moment she heard the screaming: "What are the words?" The scammer has a perfect clone of her mother's voice, a spoofed number, and a scripted ransom demand, but he does not have three private codewords that rotated since the last time anyone outside the family could have learned them. The call ends. The scam fails. --- If a call like this reaches you, hang up and call the family member directly using a number you already have saved, not one the caller provides. A successful callback does not prove the original caller was legitimate; the scammer may still be on another line. Contact police. Do not send money by wire transfer, gift card, or cryptocurrency. Once funds are transferred, recovery is nearly impossible. The City of Lawrence noted that scammers specifically use social media audio to build these clones. Reviewing your privacy settings so voice content isn't publicly accessible adds a small layer of protection. The deeper fix is giving your family a way to verify identity that depends on neither voice nor caller ID. The Lawrence woman heard her mother's voice, saw her mother's number, and still something made her call police instead of sending cash. Not every family will be that fortunate twice. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Scammers cloned a real woman's voice using audio harvested from social media, then paired it with caller ID spoofing to fake a kidnapping in Lawrence, Kansas. - Voice cloning tools require as little as 20 to 30 seconds of audio, and most people's voices are already publicly available online. - A set of private, rotating family codewords is the one thing a scammer cannot clone, spoof, or look up: asking 'What are the words?' ends the call. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers collect audio of a family member from social media or voicemails, use AI tools to clone their voice, then spoof the family member's phone number and call relatives with fake emergencies, playing the cloned voice to demand money. ### What is a virtual kidnapping scam? A phone fraud where callers claim a family member is being held and demand ransom. With AI voice cloning, scammers now add a convincing synthetic voice of the supposed victim in the background to make the threat feel real. ### Can you tell if a voice on the phone is AI-generated? Often no. Modern voice cloning is convincing enough to fool family members, especially when callers are already panicked. Human detection accuracy for cloned voices hovers around 55 to 60 percent, barely better than a coin flip. ### What should I do if I get a fake kidnapping call? Hang up, call the family member directly using a saved number, and contact police. A successful callback does not prove the original caller was legitimate. Do not send money by wire, gift card, or cryptocurrency. Once funds are transferred, recovery is nearly impossible. ### How can families protect themselves from AI voice scams? Set up a private, shared verification phrase only your family knows. Trust Onion provides three rotating codewords that change every few hours, calculated on your phone with no server needed. A scammer with a cloned voice still cannot answer 'What are the words?' ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords, free to set up in minutes, so the next call like this ends before the panic starts. Protect Your Family Free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Cloning Scams Cost Americans $893M Last Year" published: 2026-08-11T00:06:13.560Z updated: 2026-10-11T06:12:51.203Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-scams-cost-americans-893-million --- # AI Voice Cloning Scams Cost Americans $893M Last Year **Cite as:** AI Voice Cloning Scams Cost Americans $893M Last Year, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-cloning-scams-cost-americans-893-million A California mother heard her daughter's voice on the phone, crying and scared, and sent money to help her. The voice was AI-generated. The money was gone. The FBI put a number on what that kind of call costs Americans: $893 million lost to AI-related scams last year. The California mother CNN reported on in May 2026 is one of thousands who received a call from someone who sounded exactly like a family member in crisis. Voice cloning is one of the biggest reasons that figure keeps climbing. The mechanics are cheap to run. A scammer needs as little as 20 to 30 seconds of audio, a birthday video on Instagram, a graduation speech on Facebook, a TikTok posted last week. That audio feeds into a cloning tool and the fake voice is ready. CNN's reporting also highlights something beyond pre-recorded fakes: real-time "voice skinning," where a live scammer speaks through a filter that transforms their voice into your daughter's or your son's during the actual conversation. Caller ID spoofing layers on top, making the call appear to come from your family member's real number. The voice sounds right. The number looks right. Nothing signals danger. These scams work because they target the fastest impulse a parent has. Scammers build in urgency on purpose: "I've been in an accident." "I'm in trouble and need bail money." "Please don't tell Dad." That secrecy request keeps the victim from calling anyone who might slow things down. The payment methods they push, wire transfers, gift cards, cryptocurrency, are chosen because they're nearly impossible to reverse. Human detection of AI-generated voices isn't a reliable defense either: studies put accuracy at around 55 to 60 percent, barely better than a coin flip. --- After these scams, victims often describe feeling like they should have known. They weren't foolish. The technology is built to defeat human pattern recognition under emotional pressure. The answer isn't sharper ears. It's a verification system that works in seconds. That's the idea behind Trust Onion. Families share three private codewords that rotate every 60 seconds on a shared schedule, calculated locally on each person's phone. When a call comes in from someone claiming to be family, you ask: "What are the words?" A cloned voice can't answer. A scammer can't answer. If the California mother had that system in place, the conversation would have gone: "I need help, Mom." "What are the words?" Silence. Scam over. A Proofie™ is a selfie signed by your passkey the moment you take it, binding your key to the exact photo, date, time, and location. Verification checks the passkey signature against the full public key in your shared Trust Onion group. Proofies and codewords work alongside each other, not as a single combined system. One practical note on callbacks: hanging up and calling back on a number you know is a reasonable first step, but a callback that connects does not prove the original caller was legitimate. The family's private Trust Onion codewords remain the confirmation that matters. Use common sense and alert authorities if you believe someone may actually be in danger. The FBI logged $893 million in losses last year. That number will be higher next year. Three words, rotating every 60 seconds, and the con has nowhere to go. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - The FBI reported Americans lost over $893 million to AI-related scams last year, with voice cloning a major driver. - Real-time voice skinning lets a live scammer speak through a filter that transforms their voice into a family member's during the call, while caller ID spoofing makes the number appear legitimate. - Human detection of AI-generated voices is only about 55 to 60 percent accurate, so a shared family codeword system is more reliable than trying to spot a fake by ear. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers collect as little as 20 to 30 seconds of audio from social media, clone the voice with AI tools, then call relatives pretending to be that person in distress. They build in urgency and often request secrecy to prevent victims from pausing to verify before sending money. ### How much money have Americans lost to AI voice scams? According to the FBI, Americans lost over $893 million to AI-related scams last year. Voice cloning scams targeting families are among the fastest-growing categories. ### Can you tell if a voice on the phone is AI-generated? Not reliably. Research shows human detection accuracy for AI-generated voices hovers around 55 to 60 percent. Under emotional stress it's even harder. A verification system is more dependable than trying to spot a fake by ear alone. ### What is a family codeword and how does it stop voice cloning scams? A family codeword is a shared secret only real family members know. When a suspicious call comes in, you ask "What are the words?" An AI clone or scammer cannot know the answer, so the scam ends immediately. Trust Onion's codewords rotate every 60 seconds for added security. ### What is real-time voice skinning? Real-time voice skinning transforms a live caller's voice into someone else's during the call. Unlike a pre-recorded fake, the scammer holds an actual conversation while sounding like your family member, making the deception harder to detect in the moment. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set up your shared family group for free at trustonion.io and make sure the next fake call ends in seconds. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "The Secret Codewords That Scammers Hate" published: 2026-08-08T00:06:08.324Z updated: 2026-10-11T06:12:51.576Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/secret-codewords-scammers-hate-ai-voice-cloning --- # The Secret Codewords That Scammers Hate **Cite as:** The Secret Codewords That Scammers Hate, Trust Onion, 2026-10-11. https://trustonion.io/blog/secret-codewords-scammers-hate-ai-voice-cloning A mother in Buffalo, New York picked up the phone and heard her 16-year-old son's voice. He was in danger, someone was going to kill him unless she handed over $7,500 in cash, and the voice sounded exactly like him. It wasn't him at all. BBC Future reported the story in August 2026, in its widely shared feature ["The secret codewords that scammers hate"](https://www.bbc.com/future/article/20260804-why-your-family-needs-a-secret-codeword). The call follows a pattern that has become painfully familiar: a parent hears their child's voice, terrified, while a stranger on the line demands immediate payment and orders them not to hang up. Every parental instinct fires at once. That is not an accident. That is the design. The voice was generated by AI. Scammers needed only a short audio clip, likely pulled from a social media video, to build a convincing clone. Voice cloning now requires as little as 20 to 30 seconds of audio to produce a replica that most people cannot distinguish from the real thing. Human detection accuracy for AI-generated audio hovers around 55 to 60 percent, according to research cited by multiple security experts, and under emotional stress those odds get worse. --- The calls follow a tight script. First, urgency: no time to think, no time to verify. Second, untraceable payment: cash, gift cards, wire transfers, nothing reversible. Third, isolation: don't call anyone, don't tell your spouse, don't contact the police. The scam only works if you stay alone with the fear. $7,500 in cash is large enough to feel like a real crisis, small enough that some families can access it quickly. When you believe your child is in danger, your brain fills in the gaps, hearing what it expects to hear. Scammers count on it. ## The One Question That Stops It The BBC Future article lands on the same answer that security researchers and family safety advocates have been circling for years: a secret codeword. An AI can clone a voice. It cannot know a private word that only your family agreed on in advance. If the caller claiming to be your son cannot tell you the family's codeword, that is your answer. Knowing the strategy is not enough. You have to decide in advance that you will ask for the word, even when you are scared, even when the voice sounds exactly right, even when someone is screaming at you not to hang up. That preparation has to happen before the call. A single shared password is better than nothing, but it has a real weakness: words can be guessed, overheard, or found. Trust Onion uses three rotating codewords that change every 60 seconds, calculated locally on your phone with no server required. You ask: "What are the words?" If the caller cannot answer with the current three, the call is over. ## Before the Next Call The conversation your family needs is simple. Tell every member about these scams and explain that a voice alone is not proof of identity. Then agree on a verification method and pre-commit to using it. The script is short: "If anyone ever calls claiming to be me and says I'm in trouble, ask them for the words. If they don't know them, hang up and call me directly." One callback note: hanging up and calling back on a number you already have is sound advice, but a successful callback does not prove the original caller was legitimate. Use a number saved in your contacts or printed on a card, and if you genuinely believe someone may be in danger, alert the authorities. The Buffalo mother was not unprepared because she was careless. Most families simply have not had this conversation yet. Five minutes is all it takes. AI can clone a voice. It cannot fake knowing three codewords that change every 60 seconds. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning can replicate a loved one's voice from as little as 20 to 30 seconds of audio, and human detection accuracy for AI-generated audio is only around 55 to 60 percent, even less under emotional stress. - Scammers rely on urgency, untraceable payment demands, and isolation to prevent victims from verifying the call, and any combination of these three red flags is a signal to stop and verify. - A shared family codeword stops voice cloning scams because AI can copy a voice but cannot know a private word, and rotating codewords that change every 60 seconds are more secure than a single static password. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers collect a short audio clip from social media or public videos, then use AI to clone the voice. They call a family member, play the fake voice in distress, and demand immediate untraceable payment while preventing the victim from hanging up or contacting anyone. ### What is a family codeword and how does it stop scams? A family codeword is a private word or phrase only your family knows. When a caller claims to be a family member, you ask for the codeword. AI can clone a voice but cannot know a word your family agreed on privately, so a wrong answer immediately reveals the scam. ### Can you really not tell if a voice on the phone is AI? Research suggests human detection accuracy for AI-generated audio is only around 55 to 60 percent under normal conditions. Under emotional stress, like hearing a child in danger, that accuracy drops further. Relying on your ears alone is not a reliable defense. ### What are the warning signs of an AI voice cloning scam call? The three main red flags are extreme urgency, demands for untraceable payment such as cash or gift cards, and isolation from anyone who could help. Any combination of these is a strong signal to stop and verify before doing anything else. ### How is a rotating codeword better than a single family password? A static password can be guessed, overheard, or discovered. Rotating codewords change every 60 seconds, so even a compromised word becomes useless almost immediately. Trust Onion calculates the current words locally on your phone, with no server required, so they work anywhere. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords, free and calculated locally on your phone so they work anywhere. Protect Your Family Free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Edmonton Seniors Targeted: 21 Grandparent Scams in 60 Days" published: 2026-08-07T00:05:24.385Z updated: 2026-10-11T06:12:51.843Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/edmonton-grandparent-scam-uptick-eps-warning-2026 --- # Edmonton Seniors Targeted: 21 Grandparent Scams in 60 Days **Cite as:** Edmonton Seniors Targeted: 21 Grandparent Scams in 60 Days, Trust Onion, 2026-10-11. https://trustonion.io/blog/edmonton-grandparent-scam-uptick-eps-warning-2026 In Edmonton, the Edmonton Police Service logged 21 grandparent scam reports in sixty days, each one starting the same way: a voice on the phone, a grandchild in trouble, and a demand for bail money tonight. The calls follow a script. Someone who sounds like a grandson says he has been arrested and needs help. Seconds later, a man claiming to be a police officer takes over, cites a badge number, and explains that bail must be paid immediately in cash, gift cards, cryptocurrency, or jewellery. He adds one instruction that makes everything worse: don't tell anyone. The Edmonton Police Service issued a public warning in August 2026 after receiving 21 reports of seniors targeted this way in roughly two months. That is a pattern, not a random spike, and EPS is naming it plainly. ## How the Script Runs The opening call usually sounds distressed, maybe muffled or tearful. The fake grandchild asks the grandparent not to call mom or dad because they don't want them to worry. Then the fake official steps in with legal-sounding language, a case file reference, and a deadline. Payment must arrive before a court date or a transfer to another facility. A courier will come to the door. Gift card codes can be read over the phone. The secrecy instruction, repeated throughout, cuts off the one thing that would end the call: a second opinion from another family member. AI is sharpening the setup. Voice cloning technology can replicate a person's voice from as little as 20 to 30 seconds of audio posted publicly online, such as a grandchild's voicemail greeting, a birthday video, or a TikTok. That is enough for the opening line, "Grandma, it's me, I'm in trouble," to sound like the real person. Seniors are not naive; they are targeted precisely because they love their families and act on that love quickly. EPS has not released total dollar figures from the 21 Edmonton cases, but the Canadian Anti-Fraud Centre has reported that grandparent scams cost Canadians millions of dollars annually, with individual losses sometimes reaching tens of thousands of dollars per victim. ## Breaking the Con EPS recommends hanging up and calling the grandchild directly on a number already stored in your contacts, then checking with another family member before sending anything. Those are sound steps, but they depend on remembering them while panic is already running. A real police officer will never demand bail payment over the phone. A successful callback does not by itself prove the original caller was fake; always verify through a number from your own contacts, not one the caller provides. Trust Onion gives families a faster circuit-breaker. The free app generates three rotating codewords that change every 60 seconds, calculated locally on each device with no server connection required. When a call arrives claiming to be a grandchild in trouble, the grandparent asks one question: "What are the words?" A real grandchild with the app answers immediately. A scammer cannot, no matter how convincing the cloned voice sounds, because the words are private and never stored online. --- Preparation matters more than reaction with scams like this. Once someone is on the phone, afraid their grandchild is in jail, the pressure is already working. Setting up codewords before any suspicious call arrives means the answer is already in place. Grandparents do not need to recall a list of rules under stress. They need one calm question. If the caller cannot answer, the call is over. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - The Edmonton Police Service reported 21 grandparent scam cases in approximately two months as of August 2026, prompting a public warning about the surge in targeting of seniors. - Scammers impersonate police officers and pressure seniors to pay fake bail using cash, gift cards, cryptocurrency, or jewellery, always under a secrecy instruction that isolates the victim. - Asking 'What are the words?' gives seniors an instant way to verify any call: Trust Onion's three rotating codewords change every 60 seconds and cannot be guessed by a cloned voice. ## Frequently asked questions ### What is the grandparent scam and how does it work? Scammers call seniors pretending to be a grandchild in trouble, then hand the call to a fake police officer or lawyer who demands immediate bail money in cash or gift cards. They instruct the victim to keep it secret from other family members, cutting off the verification that would end the call. ### How many grandparent scams has Edmonton seen recently? The Edmonton Police Service reported 21 grandparent scam cases in approximately two months as of August 2026, prompting a public warning about the surge in targeting of seniors. ### Can AI clone a grandchild's voice to make the scam more convincing? Yes. Voice cloning technology can replicate a person's voice from 20 to 30 seconds of publicly available audio. Scammers can use social media videos or voicemail recordings to make the opening call sound exactly like a real family member. ### How can families protect elderly relatives from grandparent scams? Set up a shared family codeword before any suspicious call arrives. When a call comes in, the grandparent asks for the words. A scammer cannot answer. Trust Onion automates this with three rotating codewords that change every 60 seconds and work offline. ### What should you do if you get a grandparent scam call? Hang up and call your grandchild directly on a number already stored in your contacts. Never send cash, gift cards, jewellery, or cryptocurrency to anyone you cannot independently verify. Real police officers do not demand bail payments over the phone. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free, works offline, and takes minutes to set up with the whole family. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "She Heard Her Brother's Voice. It Wasn't Him." published: 2026-08-07T00:02:14.942Z updated: 2026-10-18T05:19:30.300Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-scam-ontario-woman-brother-12000 --- # She Heard Her Brother's Voice. It Wasn't Him. **Cite as:** She Heard Her Brother's Voice. It Wasn't Him., Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-voice-cloning-scam-ontario-woman-brother-12000 An Ontario woman from Smiths Falls picked up the phone and heard her brother's voice. He'd been in an accident, he needed money fast, and she sent $12,000 before she learned her brother was fine and the voice was not his. The call came in August 2026, and CP24 reported it on the sixth of that month. Someone had taken as little as 10 seconds of her brother's voice, a voicemail, a birthday clip, a social media post, fed it into an AI tool, and placed a call that sounded, in every tone and rhythm, exactly like him. The Ontario woman did not hesitate. She responded the way any caring sibling would. This is not a story about carelessness. AI voice cloning has grown precise enough that human listeners detect AI-generated audio at roughly 55 to 60 percent accuracy, coin-flip odds, without a system in place. ## The Script Behind the Voice The voice is only half the weapon. Scammers pair it with a script built around urgency: an accident, an arrest, a hospital. The demand for money arrives before the target has time to think, and the caller keeps them on the line, off-balance, guilty about the idea of hanging up to verify. In her case, the formula worked completely. The callback is the first line of defense. Hang up and dial the family member's number yourself, from a contact you already have saved. If they answer normally, you have your answer. But the callback has a gap: in a staged emergency, the scammer may have already told you the phone is broken or lost, and the panic of the moment can make a thirty-second pause feel like abandonment. A failed callback does not prove the original caller was legitimate. If you cannot reach the person and believe someone may genuinely be in danger, contact authorities. --- ## Three Words Close the Gap A family code word works in the seconds before emotional pressure has time to build. Trust Onion gives families three rotating codewords, calculated locally on each phone, that change throughout the day. When a call arrives from someone claiming to be a relative in trouble, one question settles it: "What are the words?" If the caller knows the words, it's really them. If they stumble, deflect, or give the wrong answer, the call is over. AI can replicate a voice from 10 seconds of audio. It cannot know three private words that exist only on your family's devices and expire within hours. The Ontario woman's call lasted long enough to cost her $12,000. A single question would have ended it in seconds. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning requires as little as 10 seconds of audio to convincingly replicate someone's voice, making a familiar caller almost impossible to detect without a system in place. - An Ontario woman from Smiths Falls lost $12,000 in August 2026 after a scammer cloned her brother's voice and staged a fake emergency. - A family code word, or Trust Onion's rotating codewords, creates a checkpoint that works in seconds and that an AI-cloned voice cannot pass. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers collect as little as 10 seconds of someone's voice from social media or voicemails, clone it with AI, then call a family member posing as that person. They invent an urgent emergency, an accident, an arrest, to pressure the target into sending money before they think to verify. ### What is a family code word and how does it stop voice cloning scams? A family code word is a phrase only your family knows. When someone calls claiming to be a relative in trouble, you ask for it. If they can't answer, the call is fraudulent. AI can clone a voice but cannot know a private word shared only within your family. ### How much money do people typically lose to AI voice cloning scams? Losses vary widely. In the Smiths Falls, Ontario case reported by CP24 in August 2026, an Ontario woman lost $12,000 in a single call. Other cases have reached tens of thousands of dollars, particularly when scammers have more time to build the deception. ### What should I do if I get a suspicious call from someone claiming to be a family member? Hang up and call the family member back on a number you already have saved. Ask for a pre-agreed family code word before taking any action. A failed callback does not prove the original caller was legitimate. If you believe someone may be in danger, contact authorities. Never send money until you've independently confirmed who you're speaking with. ### Is Trust Onion really free? Yes. Trust Onion is free to download and use. It generates three rotating codewords shared among your family, works offline without a server connection, and requires no subscription. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set up your shared family group free in minutes. AI can clone a voice, but it can't know words only your family has. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Toronto Man Charged After $7,500 Grandparent Scam Call" published: 2026-08-05T00:05:59.442Z updated: 2026-10-18T05:19:42.430Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/toronto-man-charged-grandparent-scam-7500 --- # Toronto Man Charged After $7,500 Grandparent Scam Call **Cite as:** Toronto Man Charged After $7,500 Grandparent Scam Call, Trust Onion, 2026-10-18. https://trustonion.io/blog/toronto-man-charged-grandparent-scam-7500 An elderly Toronto woman handed over $7,500 in bail money to a voice on the phone she believed was her grandson. The voice belonged to 27-year-old the defendant, who was arrested and charged in August 2026. The call followed a script that has worked thousands of times. A panicked voice claimed to be her grandson. He was in trouble. He needed $7,500 for bail, right now. Then came the line that makes the whole scheme work: "Don't tell Mom and Dad. They'll be so upset. Just please help me." According to CTV News, the defendant didn't stop after that first call. Police say he attempted a second grandparent scam targeting another senior, this time for $15,000. Two victims, two crises invented from nothing, two families blindsided. The scam works because it attacks something real. Grandparents who love their grandchildren don't stop to interrogate a sobbing voice. They act. The FBI reports that Americans over 60 lose more than $3.4 billion to fraud annually, with impersonation scams among the most common category. The instruction to keep the call secret is deliberate: isolation is the whole strategy. One call to a son or daughter and the fiction collapses. --- The Toronto case involved a human caller doing the impersonation directly. But voice cloning technology now requires as little as 20 to 30 seconds of audio to produce a convincing replica of someone's voice, and that audio is easy to find in birthday videos, TikTok clips, or family group chats. A cloned voice doesn't need to be perfect. It only needs to be close enough to create doubt in someone already shaken by a distressing story. ## One Question That Ends the Call The answer to both the human impersonator and the AI-generated voice is the same: ask for the words before doing anything else. Trust Onion gives every family three rotating codewords, updated every 60 seconds, calculated on your phone with no server needed. When an older adult gets a distressing call from someone claiming to be a grandchild, one question settles it: "What are the words?" A real grandchild answers in two seconds. A fraudster cannot reach into a phone he has never touched to pull out words that didn't exist a minute ago. There is no social media post to scrape, no database to breach. For grandparents, the habit is simple: ask for the words before any money moves. If the caller can't provide them, hang up and call your family member directly on their known number. Keep in mind that a successful callback to a number you already have does not, by itself, prove the original caller was legitimate; the caller must still know your family's private Trust Onion Three Words. Use common sense, and alert authorities if you believe someone may genuinely be in danger. ## Proofies: A Step Further For families who want an additional layer, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. The app captures a photo, adds a visible fingerprint and QR watermark, then computes a SHA-256 hash of the final image bytes. A standard P-256 WebAuthn passkey signs after Face ID, fingerprint, or device-passcode unlock. Use the app to send and verify Proofies, and compare the verified full signing key against the person's public key in your shared Trust Onion group; the shortened key label alone is not an identity check. Signed time and place cannot be changed undetected, but they are not independent proof of physical whereabouts or exact capture time. Family codewords work alongside Proofies, not as an overlay or signed field. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved. The defendant faces charges, and the legal process will run its course. But the grandparent scam didn't begin with him and it won't end with his arrest. The families who don't get defrauded aren't necessarily more skeptical. They're the ones who had a plan before the phone rang. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - A Toronto man was arrested and charged in August 2026 after allegedly defrauding an elderly Toronto woman out of $7,500 by impersonating her grandson and demanding bail money, then attempting a second scam targeting another senior for $15,000. - Grandparent scams succeed by combining emotional urgency with an instruction to keep the call secret, cutting the victim off from the family members who could instantly expose the fraud. - Three rotating codewords that update every 60 seconds cannot be guessed, cloned from social media audio, or faked by any AI voice tool, making 'What are the words?' the one question that stops an impersonation call cold. ## Frequently asked questions ### What is the grandparent scam? A phone fraud where someone pretends to be a grandchild in crisis, usually claiming to need bail money or emergency funds. The caller typically instructs the victim not to tell other family members, preventing any verification of the story. ### How do I protect elderly parents from grandparent scams? Set up a family codeword system before any crisis happens. Tell elderly relatives to ask for the codeword before sending money to anyone claiming to be family. Trust Onion automates this with three rotating words that update every 60 seconds, calculated on your phone. ### Can AI voice cloning make grandparent scams worse? Yes. Voice cloning tools can replicate someone's voice from a short audio clip, making it harder to distinguish a fake caller from a real family member. A shared family codeword defeats voice cloning because sounding like someone is not the same as knowing a secret phrase. ### What happened in the Toronto grandparent scam case? In August 2026, a Toronto man was arrested and charged after allegedly defrauding an elderly Toronto woman out of $7,500 by posing as her grandson and claiming to need bail money. Police say he also attempted a second scam targeting another senior for $15,000. ### What should I do if I get a suspicious call from someone claiming to be a family member? Ask for your family's codeword before doing anything else. If the caller can't provide it, hang up and call your family member on their known number. Note that a successful callback alone doesn't prove the original caller was legitimate; the caller must still know your family's private Trust Onion Three Words. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free, works offline, and turns one simple question into a scam-stopper: set up your family's codewords at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "How AI Voice Scams Work (And What Actually Stops Them)" published: 2026-08-04T00:05:24.345Z updated: 2026-10-11T06:12:52.993Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/how-ai-voice-scams-work-and-what-stops-them --- # How AI Voice Scams Work (And What Actually Stops Them) **Cite as:** How AI Voice Scams Work (And What Actually Stops Them), Trust Onion, 2026-10-11. https://trustonion.io/blog/how-ai-voice-scams-work-and-what-stops-them Thirty seconds of audio lifted from a voicemail or social media clip is enough for an AI to clone your CFO's voice, your bank manager's voice, or your son's. According to Group-IB's August 2025 threat research, those cloned voices are now hitting finance teams, executive assistants, and families at scale. The call arrives with urgency already built in. Wire this money. Give me your login. Don't tell anyone yet. The voice sounds exactly right because it was engineered to: Group-IB's research documents how attackers harvest a short audio sample, run it through AI voice synthesis tools, spoof the caller ID to show a familiar number, and then call someone who trusts that voice. The whole sequence can unfold in under five minutes, and the people on the receiving end are not careless. Human detection accuracy for synthetic voices sits around 55 to 60 percent, barely better than a coin flip. ## Who Gets Hit First Group-IB's incident data points to three sectors absorbing the most damage: financial services, executive support, and remote-work help desks. These environments run on calls from authority figures employees have never met face to face. A finance team member hears the CEO asking for a wire transfer. An IT help desk gets an executive requesting a password reset. Nobody questions the voice because the voice sounds right. Families face the same attack in a different register. A grandparent hears a grandchild in trouble. A parent hears their teenager's voice in distress. The FBI reported that grandparent scams cost Americans over $74 million in 2023 alone, and that was before AI voice cloning became this accessible. ## Why Detection Tools Fall Short Organizations are investing in call authentication systems, AI detection software, and staff training. Group-IB's research is clear that these cannot carry the full load. Voice synthesis quality improves faster than detection tools can keep pace, and a clone that fools a trained security professional today was not possible two years ago. The deeper problem is structural. On a phone call, you cannot see a badge, check an email signature, or confirm a face. You rely entirely on the voice, and the voice is now fakeable. The only reliable countermeasure is something the attacker cannot know: something absent from every audio clip, earnings call, and social media post the target has ever produced. --- For families, that countermeasure is a shared set of rotating codewords. If a caller claiming to be family cannot answer "What are the words?", the call is over. AI can clone a voice. It cannot produce three words that exist only on your family's phones and rotate on a schedule. Trust Onion is a free app built on this idea. The three words rotate automatically, so overheard words expire before they can be used. The app also supports Proofie™, a selfie signed by your passkey the moment you take it, binding a verified key to the exact photo, time, and location. Share the link and anyone can verify in the Trust Onion app that the key signed that exact image and that nothing has changed since. A valid signature confirms key use at the time of signing, not unconditional proof of physical presence. For security and finance teams, the same principle applies at the organizational level: verbal challenge protocols, out-of-band confirmation, and rotating challenge questions for any request involving money or credentials. Treat voice-only verification as insufficient for sensitive actions. If you hang up to call back on a known number, remember that a successful callback does not prove the original caller was legitimate; use an independently sourced number from a card, statement, or official app. Group-IB's findings show these attacks succeed because they exploit trust, not just technology. The attacker borrows the voice of someone you trust and uses it against you, so the countermeasure has to work at that same layer. The voice on the phone sounds real because it is designed to. The only question worth asking is the one the attacker cannot answer. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning requires as little as 30 seconds of audio to produce a convincing fake, and human detection accuracy for synthetic voices sits around 55 to 60 percent. - Group-IB identifies finance teams, executive assistants, and help desks as the highest-risk targets in 2025, with families facing the same attack in a different form. - Shared rotating codewords give callers something to prove that no voice clone can provide, because the words exist only on trusted devices and expire on a schedule. ## Frequently asked questions ### How do deepfake voice scams work? Attackers collect a short audio sample of a target's voice, use AI to clone it, then call someone who trusts that person and make an urgent request for money or sensitive information. The whole attack can unfold in under five minutes. ### Can you tell if a voice on the phone is AI-generated? Not reliably. Human detection accuracy for synthetic voices sits around 55 to 60 percent. AI voice cloning quality has improved faster than detection tools can keep up, making even trained security professionals vulnerable. ### What is the best way to protect your family from voice cloning scams? Use a shared verbal codeword your family all knows. If someone calls claiming to be a family member and cannot provide the correct words, hang up. Apps like Trust Onion rotate the words automatically so expired words are useless. ### How much audio does it take to clone someone's voice? Current AI voice synthesis tools can produce a convincing clone from as little as 20 to 30 seconds of audio. That is short enough to be lifted from a social media video or voicemail. ### What is vishing? Vishing is voice-based phishing. An attacker calls a victim while impersonating a trusted person, such as a bank, executive, or relative, and uses urgency and false identity to extract money or information. ## More from Trust Onion See how Trust Onion gives people and teams a practical way to verify identity. Explore Trust Onion Free **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Bay Area Mom Lost $5,400 to a Fake Kidnapping Call" published: 2026-08-02T00:07:29.120Z updated: 2026-10-18T05:19:36.219Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/bay-area-mom-fake-kidnapping-ai-voice-scam --- # Bay Area Mom Lost $5,400 to a Fake Kidnapping Call **Cite as:** Bay Area Mom Lost $5,400 to a Fake Kidnapping Call, Trust Onion, 2026-10-18. https://trustonion.io/blog/bay-area-mom-fake-kidnapping-ai-voice-scam A Bay Area mom heard her daughter screaming and wired $5,400 to Mexico before she learned the voice was AI-generated. Scammers had cloned it from social media audio and kept her on the phone for five hours to make sure she never thought to check. The call came with proof. Not just a claim that her daughter had been kidnapped, but her daughter's own voice, panicked and crying, played back down the line. For a Bay Area mom, that was enough. Everything the scammers said after that, every instruction, felt like the only path to saving her daughter. The daughter was never in danger. The voice was fabricated. The $5,400 was gone. This is virtual kidnapping, updated for AI voice cloning. Cybersecurity firm Bitdefender reports that scammers can clone a voice from just seconds of publicly available audio. A short video clip, a reel, anything where someone is speaking gives them enough raw material. The output doesn't need to pass a studio test. It needs to pass the test of a terrified parent. ## How the Con Runs The sequence is deliberate. Scammers identify a target on social media, pull audio of a family member, then call the parent and play the clone as proof. From that moment, the goal is to keep the victim on the line. While the Bay Area mom was talking to the scammers, she couldn't call her daughter. The five hours weren't incidental. They were the product. Every command served the same purpose. "Don't hang up," "don't call anyone," "wire the money now" are all designed to prevent the one thing that would end the scam: verification. Wire transfers sent to overseas accounts are almost never reversed once sent. The FTC reported that Americans lost $2.7 billion to imposter scams in 2023, with virtual kidnapping calls now documented across California, Texas, Arizona, and beyond, run from overseas call centers using scripts engineered to maximize panic and minimize the time a victim has to think. ## Why the Brain Doesn't Catch It The Bay Area mom is not someone who falls for obvious tricks. This wasn't a suspicious email. It was her daughter's voice, screaming. When a parent hears a child in distress, the part of the brain that evaluates logic takes a back seat. Scammers know this and engineer the call to keep that response triggered. If she had reached her daughter for even thirty seconds, it would have been over. --- That thirty-second call is exactly what three rotating family codewords make possible. Trust Onion gives families a set of words that rotate on a schedule, calculated locally with no server required. If someone calls claiming to have your daughter, you ask: "What are the words?" A real family member knows. A voice clone, no matter how convincing, doesn't, because it was never told. A cloned voice is a recording pretending to be a person. It cannot pass a live challenge. If you receive a call like this, hang up and call your family member directly using a number you saved yourself, not one the caller provides. Reaching voicemail does not prove the original caller was legitimate, so call another family member to help confirm. If someone may be in danger, alert authorities and report the incident to the FBI's Internet Crime Complaint Center at ic3.gov. The Bay Area mom reported her case. The money has not been recovered. That five-hour call could have ended in five seconds. "What are the words?" Silence. Hang up. Call her daughter. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Scammers cloned a daughter's voice from social media audio and used it to convince her mother a kidnapping was real, costing the Bay Area mom $5,400. - Keeping victims on the phone for hours is deliberate: commands like "don't hang up" and "don't call anyone" exist solely to prevent verification. - Three rotating family codewords give you a live challenge that a voice clone cannot answer, because it was never told the words. ## Frequently asked questions ### How do virtual kidnapping scams work? Scammers call a parent claiming to have kidnapped their child, then play an AI-cloned version of the child's voice as proof. They keep the victim on the line to prevent verification, then demand a wire transfer before the victim can confirm their family member is safe. ### Can scammers really clone my family member's voice from social media? Yes. According to Bitdefender, scammers can clone a voice from just seconds of publicly available audio. Short video clips, reels, or any content where someone is speaking provides enough raw material for today's AI voice tools. ### What should I do if I get a fake kidnapping call? Hang up and call your family member directly using a number you already have saved, not one the caller provides. Reaching voicemail does not prove the original caller was legitimate; call another family member to help verify. Report the incident to the FBI's IC3 at ic3.gov. ### How can a family codeword stop a voice cloning scam? A family codeword requires the caller to answer a live question they were never given the answer to. A voice clone is a recording and cannot respond to a real-time challenge. If the caller can't produce the words, you know immediately it isn't your family member. ### How much money do virtual kidnapping scams typically steal? Losses vary widely. The Bay Area mom lost $5,400 in a single call. The FTC reported Americans lost $2.7 billion total to imposter scams in 2023, with virtual kidnapping representing a growing share of those cases. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set them up free at trustonion.io and give everyone a live verification test that no voice clone can pass. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "2026: The Year AI Impersonation Scams Hit Everyone" published: 2026-08-02T00:04:53.189Z updated: 2026-10-11T06:12:53.523Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/2026-year-ai-impersonation-scams-hit-everyone --- # 2026: The Year AI Impersonation Scams Hit Everyone **Cite as:** 2026: The Year AI Impersonation Scams Hit Everyone, Trust Onion, 2026-10-11. https://trustonion.io/blog/2026-year-ai-impersonation-scams-hit-everyone The FBI has tracked over $50.5 billion in fraud losses since 2020, and a growing share of that money was taken using AI. According to Nametag's 2026 Workforce Impersonation Report, this year is expected to be 'the year of impersonation attacks.' A scammer today needs roughly 20 seconds of audio and a free tool. That is the entire barrier between your family and a voice that sounds exactly like someone you love. CFO Dive reported in January 2026 that enterprise fraud experts are bracing for a surge. Nametag's 2026 Workforce Impersonation Report names the threat plainly: impersonation attacks, powered by widely available deepfake and voice-cloning technology, are the defining fraud story of the year. The FBI's numbers confirm the scale. Over $50.5 billion in fraud losses since 2020, with a growing portion tied to AI impersonation. What hits corporate finance departments hits kitchen tables with the same tools and the same logic. Only the target changes. ## What the Attack Actually Looks Like A phone rings. The caller sounds exactly like your son. He says he's in trouble: an accident, an arrest, a stolen wallet. He needs money fast, and he needs you not to tell anyone. This is the grandparent scam, and AI made it far more convincing. The FBI received more than 101,000 complaints related to elder fraud in 2023, with losses exceeding $3.4 billion, and that figure covers only reported cases. Voice cloning builds the clone from the real person's recordings: the pitch, the cadence, the small verbal habits. Human detection accuracy for cloned audio hovers around 55 to 60 percent, according to research cited by the World Economic Forum, barely better than a coin flip. The corporate version draws larger headlines. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every participant was a deepfake. Nametag's 2026 report also flags a rise in fake AI-generated job candidates who successfully pass video interviews. If a trained hiring manager can be fooled on a video call, a parent answering a call from someone who looks and sounds like their child is in serious trouble. AI compounds the problem through scale. A scam operation that once required ten people working phones can now run on a handful of people with automated tools, producing more calls, more texts, and more targets without pause. ## Why Caution Alone Is Not a System People hear about these scams and think they would recognize their own child's voice. The clone is built from actual recordings of that child. Add a stressful scenario designed to trigger emotion over logic, and even sharp, skeptical people get caught. Caution helps. It is not a system. A system means that before anyone acts on a call claiming to be family, there is a step that always happens, a question that always gets asked: "What are the words?" Trust Onion is a free app that gives families and teams exactly that. It generates three rotating codewords, calculated locally on your device with no server required, that everyone in a shared group can see. The words change every few hours. A Proofie™ adds a second layer: a selfie signed by your passkey at the moment you take it, binding the exact photo to a key, a time, and a location. Anyone with the link can verify it in the Trust Onion app by checking the passkey signature against the full public key in your shared group and confirming the original photo has not changed. Family codewords work alongside Proofies, not as part of a Proofie's signed payload. A scammer cannot produce the specific three words your family uses right now. The real person can. If a callback feels necessary, use a number from a card, statement, or official app rather than one the caller provides. A completed callback does not by itself prove the original caller was legitimate; the caller must still know your family's private codewords. The tools are built. The operations are running. The next time a scammer calls with a cloned voice, the question is whether your family has an answer ready. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - The FBI tracked over $50.5 billion in fraud losses since 2020, with AI-powered impersonation making up a growing share. - Human ability to identify cloned audio is only around 55 to 60 percent, barely better than guessing, because voice clones are built from real recordings of the actual person. - A shared verification phrase, such as three rotating codewords, stops impersonation calls before any damage is done: the real person knows the words; the AI clone does not. ## Frequently asked questions ### What is an AI impersonation scam? A fraudster uses voice cloning or deepfake technology to sound or look like someone you trust, such as a family member, then requests money or personal information under a false emergency. The clone is built from real recordings of the actual person, making it hard to detect by ear alone. ### How much money have Americans lost to AI fraud? The FBI has tracked over $50.5 billion in total fraud losses since 2020, with a growing portion tied to deepfake and AI impersonation scams. ### Can AI really clone a family member's voice? Yes. Modern voice cloning tools require as little as 20 seconds of audio and are widely available. The clone replicates pitch, tone, and speaking habits closely enough that human detection accuracy hovers around 55 to 60 percent, barely better than a coin flip. ### How do I protect my family from voice cloning scams? Set up a shared family verification phrase or use Trust Onion, which generates three rotating codewords. When a call claims to be a family member, ask for the words before taking any action. A completed callback does not prove the caller was legitimate; the caller must still know your family's private codewords. ### What is Trust Onion and how does it stop scam calls? Trust Onion is a free app that gives your family or team three rotating codewords that change every few hours, calculated locally with no server required. If a caller cannot say the current words, they are not who they claim to be. A Proofie™ adds a passkey-signed photo for additional verification. ## More from Trust Onion See how Trust Onion gives people and teams a practical way to verify identity. Explore Trust Onion Free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Senate Hearing: AI Is Targeting Seniors and Winning" published: 2026-08-01T03:10:56.251Z updated: 2026-10-11T06:12:53.638Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/senate-hearing-ai-senior-fraud-voice-cloning-deepfakes --- # Senate Hearing: AI Is Targeting Seniors and Winning **Cite as:** Senate Hearing: AI Is Targeting Seniors and Winning, Trust Onion, 2026-10-11. https://trustonion.io/blog/senate-hearing-ai-senior-fraud-voice-cloning-deepfakes A mother picked up the phone and heard her daughter screaming for help. The voice was perfect, the fear was real, and the call was fake, testimony the Senate Special Committee on Aging heard on July 29, 2026, as lawmakers confronted what they named 'The AI Deception Machine.' Seniors in the United States lost $7.7 billion to scams in 2025. That figure, cited at the committee's hearing titled 'The AI Deception Machine: Deepfakes, Chatbots, and the New Frontier of Senior Fraud,' is almost certainly low: experts testified that many victims never report what happened. What made July 29 different from past elder-fraud hearings was the technology at the center of it. This is no longer about phishing emails. Two witnesses gave the numbers a face. The first was that mother. A caller screamed in her daughter's voice, claimed the daughter had been kidnapped, and demanded money. The voice was indistinguishable from her child's. She nearly sent the funds before the call collapsed. Her daughter was fine and had no idea any of it was happening. The second witness was a surgeon whose face and voice had been used in a deepfake video to promote a fraudulent health product, a video he never agreed to, never recorded, spread online under his real name and credentials. These are not edge cases. The technical skill required to run these scams has collapsed. Voice cloning now requires just 20 to 30 seconds of audio, pulled from a voicemail, a social media video, or a video call recording. Once a scammer has a usable sample, a convincing fake call takes minutes, with no acting and no accent training. Experts before the committee were direct: generative AI is lowering the barrier for criminals faster than law enforcement can respond, and a national anti-scam strategy is no longer optional. ## The Grandparent Scam, Upgraded The kidnapping call is a variation on the grandparent scam. In the classic version, a caller pretends to be a grandchild in trouble, arrested or in an accident, and asks for money fast and quietly. "Don't tell Mom and Dad." That script has worked for years because it exploits love and urgency. Add a cloned voice and the scheme becomes nearly impossible to detect in the moment. You are not hearing a stranger pretend to be your grandchild. You are hearing your grandchild's voice, the pauses, the emotion, the specific way they say your name, all of it generated from audio scraped from a birthday video or a graduation post. Policy responses matter, and the committee's call for a national anti-scam strategy suggests more coordinated federal action may be coming. But policy moves slowly. Scam calls do not. ## A Check That Takes Three Seconds The most reliable protection available right now is a shared verification system that no AI can fake. Trust Onion gives families three rotating codewords that change every 60 seconds, calculated locally on each person's phone. When a call arrives from someone claiming to be a grandchild or a daughter in danger, one question settles it: "What are the words?" A scammer working from a cloned audio sample has no way to know codewords that exist only on the authorized devices in your circle and expire before anyone can steal them. Calling the number back or reaching someone at a known number does not prove the original caller was legitimate. The codewords are the check. The caller must still know your family's private three words. The mother who heard her daughter screaming had no quick way to confirm what she was hearing. The surgeon whose face appeared in a deepfake had no way to prevent it. The gap between what scammers can do today and what most older adults know to watch for is wide, and it grows every time the tools get cheaper. The Senate heard that story. The question is whether the people in your life will hear it before the next call comes in. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Seniors lost $7.7 billion to scams in 2025, with AI voice cloning and deepfakes driving losses that experts believe are undercounted because many victims never report what happened. - Voice cloning now requires just 20 to 30 seconds of audio, making grandparent and fake-kidnapping scams nearly impossible to detect by ear alone, even for people who know the person well. - Three rotating codewords that change every 60 seconds give families a simple, instant check that no cloned voice can pass: if the caller can't answer 'What are the words?', the call is over. ## Frequently asked questions ### How much money did seniors lose to scams in 2025? According to testimony at the July 29, 2026 Senate Special Committee on Aging hearing, seniors in the United States lost $7.7 billion to scams in 2025. Experts believe the actual figure is higher, since many cases go unreported. ### What is the AI grandparent scam and how does it work? The AI grandparent scam uses cloned voice audio to impersonate a family member, usually a grandchild, in a fake emergency, then asks for money quickly and secretly. Voice cloning requires only 20 to 30 seconds of audio, which scammers can pull from social media posts or voicemails. ### Can AI really clone someone's voice from a short recording? Yes. Current voice cloning tools can produce a convincing copy of someone's voice from as little as 20 to 30 seconds of audio. The result is often indistinguishable from the real person, even to family members who know them well. ### What did the Senate hearing on AI senior fraud conclude? The July 29, 2026 Senate Special Committee on Aging hearing called for a national anti-scam strategy. Experts testified that generative AI is lowering the technical barriers for criminals and that existing frameworks were not designed to handle AI-powered impersonation at scale. ### How can families protect elderly relatives from AI voice cloning scams? A shared rotating codeword system is one of the most effective protections available now. If a caller can't provide the family's current codewords, you know immediately the call is not from who it claims to be. Trust Onion offers this system free at trustonion.io. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free, works offline, and takes minutes to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "A Reporter Cloned Their Voice and Called Their Mum" published: 2026-08-01T03:08:33.397Z updated: 2026-10-11T06:12:54.236Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-clone-scam-family-member-test --- # A Reporter Cloned Their Voice and Called Their Mum **Cite as:** A Reporter Cloned Their Voice and Called Their Mum, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-clone-scam-family-member-test A Cybernews reporter cloned their own voice using free AI tools, called their mother, and tried to scam her. She couldn't tell the difference. The reporter didn't use anything exotic. No studio, no months of training data. Just widely available AI voice cloning tools and a short audio sample, and the result was convincing enough to fool someone who had known that voice since birth. That detail matters. A mother who has heard her child's voice for decades, in every mood and every situation, still couldn't tell. If a reporter can do this on a Tuesday afternoon with free software, so can anyone else. The technology is here, it is cheap, and ordinary families are the target. ## How the Call Works Voice cloning now requires as little as 20 to 30 seconds of audio, which can come from a voicemail, a social media video, a podcast, or a clip your child posted last week. Once the clone exists, the scam follows a familiar script: the voice on the line sounds exactly like your son or daughter, they're in trouble, they need money fast, and they tell you not to call anyone else yet. The urgency is deliberate. Scammers know that if you have time to think, the con falls apart. The scale is already large. The Federal Trade Commission recorded $2.7 billion in losses from imposter scams in 2023, before the current wave of AI voice tools became widely accessible. The World Economic Forum reported that deepfake fraud attempts increased 500% in 2024. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every participant was a deepfake. That was a corporate target with IT resources. Ordinary families have none. ## Why Your Ears Cannot Save You Human detection accuracy for cloned voices sits at around 55 to 60 percent, barely better than a coin flip. Telling someone to "listen more carefully" or "be more skeptical" is not a realistic defense. The voice sounds real because it is real, just replayed and repurposed without permission. We recognize voices the way we recognize faces: automatically and emotionally. Scammers exploit that. You need a different kind of signal, one that AI cannot copy. --- This is where Trust Onion's three rotating codewords come in. Your family shares three simple words that rotate every few hours, calculated locally on each person's phone with no server involved. When a call arrives from someone claiming to be your child, you ask one question: "What are the words?" A scammer using a cloned voice cannot know them. There is no audio sample, no social media post, no database that hands a fraudster words that changed two hours ago and exist only on your family's phones. If you hang up and call back on a number you know independently, a failed callback still doesn't prove the original caller was legitimate. The codewords remain the cleaner test: whoever is on the line must know your family's private Trust Onion Three Words. The Cybernews reporter's mother heard a perfect copy of her child's voice and was fooled. If her family had been using Trust Onion, her next sentence would have been "What are the words?" and the scam would have ended right there. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - A Cybernews reporter cloned their own voice with free AI tools in July 2026 and successfully fooled their mother, proving the threat is real and immediate. - Human accuracy at detecting cloned voices is only around 55 to 60 percent, barely better than chance, making your ears an unreliable defense. - Three rotating family codewords give you a verification signal that AI voice cloning cannot access: ask 'What are the words?' and a scammer using a cloned voice cannot answer. ## Frequently asked questions ### Can AI really clone someone's voice from a short audio clip? Yes. Current AI voice cloning tools require as little as 20 to 30 seconds of audio from a voicemail, social media video, or any public recording. The Cybernews experiment in July 2026 confirmed this is achievable with widely available, often free tools. ### How can I tell if a phone call is an AI voice clone? You often cannot. Human detection accuracy for cloned voices sits at roughly 55 to 60 percent. The safest approach is not to rely on your ears. Use a rotating family codeword system so the caller must prove they know something AI cannot access. ### What is a family codeword and how does it stop voice cloning scams? A family codeword is a shared secret only your family knows. Trust Onion rotates these words every few hours on each device, with no server involved. When a suspicious call arrives, ask for the current words. A scammer using a cloned voice cannot know them, so the scam ends immediately. ### Are AI voice scams common or is this still rare? Common and growing. The FTC recorded $2.7 billion in losses from imposter scams in 2023, and the World Economic Forum reported a 500% increase in deepfake fraud attempts in 2024. Voice cloning tools have become widely accessible since then. ### Is Trust Onion free to use? Yes. Trust Onion is free. It generates rotating three-word codewords for your family, works offline without a server, and takes only a few minutes to set up. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set them up free in minutes, and when the call comes, your family will already know what to ask. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voices Are Robbing Companies Blind. Your Family Is Next." published: 2026-07-31T19:26:59.544Z updated: 2026-10-11T06:12:54.513Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/deepfake-voice-attacks-outpacing-defenses-family-protection --- # AI Voices Are Robbing Companies Blind. Your Family Is Next. **Cite as:** AI Voices Are Robbing Companies Blind. Your Family Is Next., Trust Onion, 2026-10-11. https://trustonion.io/blog/deepfake-voice-attacks-outpacing-defenses-family-protection A finance director in Singapore wired $499,000 to criminals she never met. She thought she was on a video call with her CEO and colleagues. Every person on that call was fake, generated by AI in real time. The call looked right. It sounded right. It wasn't. Deepfake voice incidents rose 680% year-over-year, according to research published on BleepingComputer in April 2026 by Adaptive Security researcher Marshall Bennett. At engineering firm Arup, an employee joined a similar AI-generated call in February 2024 and wired $25.6 million to Hong Kong accounts. Same method. Bigger number. The technology is moving faster than the defenses built to stop it. ## Why Technical Defenses Keep Failing Security software scans files, flags emails, and blocks known malware. It wasn't built to watch a video call and ask whether that's actually your CFO. Bennett's research makes the gap explicit: deepfake voice and video attacks exploit human trust through phone and video channels that most security stacks don't monitor. The attack is a conversation, and conversations happen outside the firewall. Voice cloning now requires as little as 20 to 30 seconds of audio , a LinkedIn video, a conference recording, a voicemail greeting. That's enough. The cloned voice can then call anyone, say anything, and apply the kind of urgency that short-circuits careful thinking: "I need you to wire funds before end of day." "Don't tell anyone yet, it's sensitive." "I'm at the airport, just handle it for me." Bennett's primary recommendation is to train employees to "pause and verify" before acting on any urgent financial request. That's genuinely good advice. The problem is that "pause and verify" is vague. Verify how? Call back on what number? A callback to a number the attacker supplies proves nothing, and a failed callback doesn't prove the original caller was legitimate. Always use a number from your company directory, a card, or a statement sourced independently of the call itself. The FBI reported that Americans lost more than $10 billion to phone and online fraud in 2023. Elder fraud alone accounted for $3.4 billion of that, according to the FBI's Internet Crime Complaint Center. The same AI that fooled a trained finance professional can fool anyone. Grandparent scams now routinely use cloned voices, a panicked voice on the line saying bail money is needed immediately, real enough to cause real fear and real transfers. --- For finance and security teams, a practical fix already exists inside most approval workflows. Before authorizing a wire transfer, a vendor payment change, or an executive instruction that arrived by phone or video, the receiving employee asks for a shared verification challenge. Trust Onion supplies three rotating codewords, calculated locally on the device, that change every 60 seconds and never touch a server. There is nothing to steal, nothing to intercept. If the words match, the request proceeds. If they don't, it stops. For families, the conversation is simpler. Agree on the system before a scam call happens: "If anyone calls claiming to be me and needs something urgent, ask them for the words." When someone calls, ask "What are the words?" If they're really who they claim to be, they open the app and read them. If they can't, the call ends. A Proofie™ adds another layer: a selfie signed by your passkey the moment you take it, binding the exact photo to a time and signing key that can be verified in the Trust Onion app and compared against the person's full public key in your shared group. AI can clone a voice. It cannot fake knowing three codewords that rotate on a schedule and are calculated locally on authorized devices. A fake voice can sound like your CFO. It cannot know what your CFO's phone showed at 3pm today. Deepfake voice attacks rose 680% in a year. The technology will keep improving. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Deepfake voice incidents rose 680% year-over-year, according to Adaptive Security researcher Marshall Bennett, with a Singapore finance director losing $499,000 and Arup losing $25.6 million in separate AI-generated calls. - Voice cloning requires as little as 20 to 30 seconds of audio, letting attackers impersonate executives or family members through channels that most security tools never monitor. - Three rotating codewords calculated locally on authorized devices give individuals, families, and finance teams a simple challenge that AI-cloned voices cannot answer. ## Frequently asked questions ### How do deepfake voice scams work? Scammers clone a real person's voice using as little as 20 to 30 seconds of audio from social media or voicemail. They call a target, impersonate that person, and create urgency around a financial request. The voice sounds genuine because it is a real clone, not an actor. ### How much money have businesses lost to deepfake video calls? A Singapore finance director lost $499,000 in a single AI-generated video call. Engineering firm Arup lost $25.6 million in February 2024 using the same method. Deepfake voice incidents rose 680% year-over-year as of April 2026. ### How can families protect themselves from AI voice cloning scams? Agree on a shared verification system before a scam call happens. Trust Onion uses three rotating codewords calculated locally on the device. If a caller can't supply the words when asked, they're not who they claim to be. ### Can AI fake a family member's voice well enough to fool someone? Yes. Voice cloning has advanced to the point that trained professionals have been deceived, including a finance director who lost $499,000. Family members with no security training are at least as vulnerable. ### What is Trust Onion and how does it stop voice scams? Trust Onion is a free app that generates three rotating codewords calculated locally on your device. When someone calls claiming to be a person you trust, ask for the words. AI can clone a voice but cannot know a codeword that rotates every 60 seconds and never touches a server. ## More from Trust Onion See how Trust Onion gives people and teams a practical way to verify identity. Explore Trust Onion Free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Cloning Is Making Grandparent Scams Scarier" published: 2026-07-31T00:02:49.030Z updated: 2026-10-11T06:12:54.601Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-grandparent-scams-seniors --- # AI Voice Cloning Is Making Grandparent Scams Scarier **Cite as:** AI Voice Cloning Is Making Grandparent Scams Scarier, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-cloning-grandparent-scams-seniors A grandmother picks up the phone and hears her grandson's voice, panicked and begging for help. According to the FTC, fraud like this cost Americans $15.9 billion last year, and AI voice cloning is making every call harder to question. The script has been the same for decades: a caller pretends to be a grandchild in distress, arrested or stranded or hurt, and asks for money before anyone else finds out. For years, a careful listener could sometimes catch the impersonation. The voice was close, but not quite right. That window is closing. AI voice cloning now requires just 20 to 30 seconds of audio to produce a convincing replica. That audio is often sitting on social media right now: a birthday video, a graduation reel, a TikTok. Cybersecurity and consumer protection expert Steven J. J. Weisman raised this alarm directly at a Fairway Home Mortgage-hosted session in July 2026, pointing to voice cloning as a specific accelerant for grandparent scams. The FTC's numbers back him up. Fraud losses reached $15.9 billion in 2025, with impersonation scams among the fastest-growing categories. Weisman also noted something consumer advocates have long observed: age-related cognitive changes can reduce the mental speed needed to catch inconsistencies during a high-pressure call. When someone claims to be your grandchild, sounds exactly like your grandchild, and is crying and scared, the instinct is to help. Scammers exploit that instinct deliberately, layering in urgency and a single line designed to keep the rest of the family out of the loop. > "Grandma, please don't tell anyone, I'm so embarrassed." From there, a second caller, often posing as a lawyer or bail bondsman, takes over and requests payment by wire transfer or gift cards. By the time the real grandchild is reached, the money is gone. Wire transfers don't reverse. Gift cards are untraceable. --- The victim did everything right by normal logic. They heard their grandchild's voice and responded to a family emergency. The only thing missing was a way to verify the call was real. Three rotating codewords stop a call like this cold. Trust Onion is a free app that gives families a set of three words, calculated locally on each authorized phone, that rotate every 60 seconds. When a call comes in from someone claiming to be a relative, one question does the work: "What are the words?" AI can clone a voice. It cannot fake codewords that change every 60 seconds and never touch a server. For older adults who might feel uncomfortable challenging a caller who sounds exactly like a grandchild, a shared family ritual removes the awkwardness. It is not suspicious to ask. "You know I always ask. What are the words?" The scam has no answer to that. If the caller cannot produce the words, hang up and call your grandchild back on a number you already have saved. A failed callback does not prove the original caller was legitimate, so use a number from your own contacts, not one the caller provides. If you believe someone may genuinely be in danger, contact authorities directly. Reviewing social media privacy settings together is worth doing: public posts are the easiest source of voice audio, and restricting who can see videos adds friction for scammers. But the bigger gap is what happens when the phone rings. Agreeing in advance that any call involving money or an emergency gets verified before anyone acts is a full family policy in four words: "We always verify." Seniors are not the problem here. The technology targeting them is, and it is getting cheaper and faster every month. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning requires just 20 to 30 seconds of audio, often pulled from public social media posts, to produce a convincing replica of someone's voice. - The FTC reported $15.9 billion in fraud losses in 2025, with impersonation scams, including fake family emergencies, among the fastest-growing categories. - Three rotating family codewords give anyone a simple way to verify a caller: if they cannot answer 'What are the words?' they are not who they claim to be. ## Frequently asked questions ### How do scammers clone a grandchild's voice? Scammers pull short video clips from public social media profiles and run the audio through AI voice cloning tools. As little as 20 to 30 seconds of clear audio is enough to generate a convincing voice replica. ### How can a senior tell if a call is really from their grandchild? Ask for the family codewords before doing anything else. If the caller cannot answer, they are not who they claim to be. Trust Onion automates rotating codewords that change every 60 seconds, so families do not have to manage them manually. ### Why are seniors more vulnerable to AI voice scams? According to cybersecurity expert Steven J. J. Weisman, age-related cognitive changes can reduce the mental speed needed to catch inconsistencies during a high-pressure call. Scammers deliberately use urgency and emotional appeals to exploit this. ### What should you do if you get a call from a family member claiming to be in trouble? Ask for the family codewords first. Then hang up and call the person back on a number already saved in your contacts. A failed callback does not prove the original caller was legitimate. Never send money based on an incoming call alone, even if the voice sounds familiar. ### How much money do grandparent scams and impersonation fraud cost Americans? The FTC reported $15.9 billion in total fraud losses in 2025. Impersonation scams, including fake family member emergencies, were among the fastest-growing and most costly categories. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free and takes minutes to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Bell Canada's AI Flags Spoofed Calls. But Can It Stop Voice Clones?" published: 2026-07-30T00:06:03.098Z updated: 2026-10-11T06:12:55.039Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/bell-canada-ai-spoofed-calls-voice-cloning --- # Bell Canada's AI Flags Spoofed Calls. But Can It Stop Voice Clones? **Cite as:** Bell Canada's AI Flags Spoofed Calls. But Can It Stop Voice Clones?, Trust Onion, 2026-10-11. https://trustonion.io/blog/bell-canada-ai-spoofed-calls-voice-cloning Bell Canada has analyzed over 4.4 billion phone calls and blocked or labelled more than 540 million suspicious or fraudulent ones. The numbers are large enough to be reassuring, and not large enough to be the whole answer. On July 29, 2026, Bell Canada announced it is the first Canadian carrier to use AI to identify and flag spoofed calls, rolling out automatically across multiple carriers with no opt-in required. Spoofed calls are ones where scammers use VoIP technology to disguise their caller ID, making a call appear to come from your bank, your doctor's office, or a family member's number. Bell's system flags those calls before they reach you. Catching 540 million suspicious calls at the network level, before anyone picks up, is not a small thing. Automatic coverage means people who don't know they need protecting get it anyway. But the system has a boundary, and it falls exactly where the danger is sharpest. ## What the AI Cannot Hear Voice cloning now requires as little as 20 to 30 seconds of audio. Scammers pull clips from voicemails, social media videos, or recorded calls, feed that audio into publicly available tools, and generate a convincing replica of a person's voice. The resulting call can pass a spoofing detector. The number might look legitimate. The voice sounds real. The story is urgent: "Mom, I've been in an accident. I need you to wire money right now." No algorithm flags that call as suspicious. It sounds like your kid. The grandparent scam has run on that script for years, long before voice cloning existed. The Canadian Anti-Fraud Centre reported that phone fraud cost Canadians over $580 million in 2023, and voice cloning tools have only become more accessible since then. Human accuracy for detecting AI-generated voices in real time hovers around 55 to 60 percent, barely better than a coin flip. Carrier-level tools operate before the call connects. Once the call is live and the voice on the other end sounds exactly like someone you love, the network has done everything it can do. --- The pattern behind both problems is the same. We built a phone system where the number on screen was supposed to tell you who was calling. That number can be faked, so we built AI to catch the fakes. We assumed the voice on the phone was proof of identity. That voice can be cloned. Anything that can be spoofed, will be spoofed. ## A Check the Network Can't Provide Trust Onion gives you three rotating codewords, calculated locally on each authorized device, that change every 60 seconds with no server required. When a call comes in and something feels off, you ask one question: "What are the words?" Someone who is genuinely who they claim to be knows the answer. A scammer using a cloned voice, a spoofed number, or a convincing story does not. The words aren't stored anywhere a scammer can steal them, and they expire before anyone can figure them out. If you want to go further, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. Anyone can verify in the app that your key signed that exact photo after a known moment, and that nothing has changed since. If a call feels wrong and you hang up to call back on a number from your card or a statement, keep one thing in mind: a completed callback does not prove the original caller was legitimate. The codewords remain the check the network cannot provide. Bell's AI stops the spoofed numbers. Three rotating codewords stop the cloned voices. One stops a fake number. The other confirms a real person. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Bell Canada's AI has analyzed 4.4 billion calls and blocked or labelled over 540 million suspicious ones, with automatic protection requiring no opt-in. - Carrier-level spoofing detection stops fake numbers but cannot detect AI-cloned voices once a call connects, and human accuracy for detecting AI-generated voices in real time hovers around 55 to 60 percent. - Voice cloning tools require as little as 20 to 30 seconds of audio, and the Canadian Anti-Fraud Centre reported phone fraud cost Canadians over $580 million in 2023. ## Frequently asked questions ### How does Bell Canada's new AI system protect against spoofed calls? Bell's AI analyzes call patterns across billions of calls to detect when a caller ID is likely being faked using VoIP technology. Flagged calls are labelled or blocked automatically before they reach the recipient, with no opt-in required. ### Can Bell's AI detect AI voice cloning scams? No. Bell's system flags spoofed numbers at the network level before a call connects. Once a call is live, carrier tools can't detect whether the voice is real or AI-generated. Human accuracy for spotting AI voices in real time hovers around 55 to 60 percent. That gap requires a separate verification step. ### What is a family codeword system and how does it stop voice cloning scams? A family codeword system gives everyone in a group a shared set of rotating words. When a call feels suspicious, you ask the caller to name the current words. A cloned voice can't provide words it was never given, stopping the scam immediately. ### How much audio does a scammer need to clone someone's voice? Modern voice cloning tools can generate a convincing replica from as little as 20 to 30 seconds of audio, sourced from voicemails, social media videos, or recorded phone calls. ### How much money do phone scams cost Canadians each year? The Canadian Anti-Fraud Centre reported that phone fraud cost Canadians over $580 million in 2023. Voice cloning tools have become more accessible since then, increasing the risk further. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords add a check beyond a familiar voice, caller ID, or message that AI cannot fake. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Your Brain Is Why AI Voice Scams Work So Well" published: 2026-07-28T23:17:03.455Z updated: 2026-10-11T06:12:55.556Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-scams-why-they-work-university-cincinnati-research --- # Your Brain Is Why AI Voice Scams Work So Well **Cite as:** Your Brain Is Why AI Voice Scams Work So Well, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-scams-why-they-work-university-cincinnati-research Your brain hears your daughter's voice and immediately relaxes. A University of Cincinnati study published in the Journal of Marketing Research found that people instinctively lower their guard when a voice sounds familiar, and AI voice cloning can fake that familiarity with just seconds of audio. Marketing professor Kimberly Hyun set out to understand the mechanics of that reflex. Her research, published in the Journal of Marketing Research and cited by Spectrum News in July 2026, focused on something most people never examine: the automatic trust we extend to familiar voices. When you hear someone you love, you don't analyze. You just believe. Scammers have learned to weaponize that response at scale, and the technology now costs almost nothing to use. ## How Little Audio They Actually Need Voice cloning no longer requires hours of recordings or studio equipment. Modern AI tools can generate a convincing clone from as little as 20 to 30 seconds of audio , a short voicemail, a birthday video on social media, a clip from a graduation ceremony posted publicly online. Once a scammer has that material, the cloned voice can say anything. The call usually opens on some version of an emergency. Your son is in jail and needs bail money wired immediately. Your granddaughter was in a car accident and the hospital needs a payment upfront. The voice sounds right. The emotion sounds right. The urgency cuts off your ability to think clearly. Hyun's research explains why this works. Familiarity triggers a cognitive shortcut: instead of evaluating the situation, your brain says, I know this person, I trust this person, I should help. Scammers aren't just impersonating someone. They're hijacking the emotional relationship you've built over a lifetime. ## The Numbers Behind the Problem The Federal Trade Commission reported that phone impersonation scams cost Americans over $1 billion in 2023, and that number has kept climbing as voice cloning tools get cheaper. The World Economic Forum found that deepfake fraud attempts increased 500% in 2024. Hyun's research adds important context: the rise in success rates isn't only about better technology. It's about psychology. Our brains are wired to trust familiar voices, and that wiring is very hard to override in the moment. The standard advice is to slow down, verify, don't wire money. The problem with "Just Be Skeptical" is that it's nearly impossible to follow when you believe your child is in danger. When a voice triggers the familiarity response, rational evaluation takes a back seat. You're not thinking about scam statistics. You're thinking about your kid. You need a system that works even when you're scared. --- This is where a private codeword challenge comes in, not as a perfect technological fix, but as a practical human one. Trust Onion gives you and anyone you share it with three rotating codewords that change every 60 seconds, calculated locally on each device with no server involved. When a call comes in from someone claiming to be your daughter, your bank, or anyone else you trust, you ask one question: "What are the words?" A scammer with a perfect voice clone cannot answer that. They don't know the words. Nobody outside your verified circle does. Caller ID can be spoofed. A familiar voice can be faked. A failed callback doesn't prove the original caller was legitimate, so don't rely on calling back alone. Three codewords calculated locally on authorized devices add a check that cloning cannot reach. The verification takes about three seconds and doesn't require you to stay calm or think clearly. It just requires asking one question and listening for the answer. Talk to the people you trust before a call comes in. Once you're on a call believing your son is in jail, it's very hard to remember to verify anything. Set up shared codewords with anyone you'd send money to in an emergency, and make asking "What are the words?" a habit before you act. Hyun's research shows these scams succeed because of how our brains work, not because victims did something wrong. The voice might sound exactly right. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - UC marketing professor Kimberly Hyun found that hearing a familiar voice triggers an automatic trust response that bypasses careful evaluation, which is the core vulnerability AI voice scams exploit. - Voice cloning now requires as little as 20 to 30 seconds of audio, easily found in a voicemail or a social media video, and the FTC reported phone impersonation scams cost Americans over $1 billion in 2023. - "Just Be Skeptical" fails under pressure because fear overrides rational thinking, so a private rotating codeword challenge gives families a simple verification system that works even when they're scared. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers collect a short audio clip from social media or a voicemail, then use AI tools to clone that voice. They call a family member pretending to be in an emergency, using the cloned voice to trigger an automatic trust response and pressure the target into sending money. ### How much audio does a scammer need to clone a voice? Modern AI voice cloning tools can produce convincing results from as little as 20 to 30 seconds of audio. A short voicemail or a video posted on social media is often enough. ### Can you tell if a voice on the phone is AI-generated? Research suggests human detection accuracy for cloned voices hovers around 55 to 60 percent, barely better than a coin flip. Relying on your ear alone is not a reliable defense. ### What is the best way to protect your family from AI voice scams? Establish a shared verification phrase before a scam call ever happens. Trust Onion uses three rotating codewords that change every 60 seconds. If the caller can't say the words, the call ends there. Note that a failed callback alone doesn't confirm the original caller was legitimate. ### What does University of Cincinnati research say about why AI scams are persuasive? Marketing professor Kimberly Hyun found that hearing a familiar voice triggers an automatic trust response that bypasses careful evaluation. Scammers use AI voice cloning to fake that familiarity, making targets more likely to comply before they can think critically. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. The private three-word challenge adds a check beyond a familiar voice, caller ID, or message, free to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Fake FPL Calls Are Offering $4,000 Rebates. They're AI." published: 2026-07-25T00:02:37.451Z updated: 2026-10-11T06:12:55.643Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/fpl-ai-scam-calls-fake-rebate-offers --- # Fake FPL Calls Are Offering $4,000 Rebates. They're AI. **Cite as:** Fake FPL Calls Are Offering $4,000 Rebates. They're AI., Trust Onion, 2026-10-11. https://trustonion.io/blog/fpl-ai-scam-calls-fake-rebate-offers In July 2026, Florida Power & Light warned customers about a surge in AI-generated calls offering fake energy rebates of up to $4,000, and the voice on the other end already knew their name. The call arrives sounding calm and professional. A voice says your name, tells you FPL owes you up to $4,000 in energy rebates, and warns that this is your last notice to claim it. There is no person on the other end. FPL issued a formal warning in July 2026 about a surge in AI-generated scam calls and texts targeting its customers. The goal is to get you to call back, then collect sensitive personal information or extract a payment. The scam also arrives by text and email, all following the same script. What makes this round harder to dismiss is the name. Customers report feeling startled when the voice addresses them personally, because it signals this isn't a random robocall. As one reaction captured it: "it knew my name." Scammers get first names cheaply, through data brokers, leaked databases, and public records. Dropping a name into a call script costs almost nothing and makes the call feel far more credible. It is not proof the caller is legitimate. --- Voice cloning technology can produce a convincing synthetic voice from a small audio sample, no robotic cadence, no obvious tell. According to the World Economic Forum, deepfake fraud attempts increased 500% in 2024. Utility impersonation fits this technology well because people already expect to hear from their power company about billing and programs. A $4,000 credit or a free AC unit is the kind of offer you want to be true, especially in Florida in July. FPL noted that elderly customers are especially vulnerable, and the call design reflects that. Older adults are more likely to answer unknown numbers and more likely to trust an official-sounding voice. But anyone who hears their name and a deadline can feel the pull. FPL does not offer $4,000 cash rebates through outbound phone calls. If a call arrives claiming otherwise, hang up and contact FPL directly using the number on your bill or at FPL.com, not the number provided in the message. A callback to a known number is a stronger check, though it does not prove the original caller was legitimate. The same skepticism applies to any link in a text or email claiming to be from FPL. Never give out your Social Security number, account password, or payment information based on an inbound call. ## One Question That Stops the Chain These calls don't always stay about utility accounts. Scammers sometimes route victims to a fake supervisor or manufacture a follow-up emergency involving a relative. A shared family verification habit breaks that chain early. Trust Onion gives every household three rotating codewords that change every 60 seconds, calculated locally on each phone with no server and no internet required. When any caller claims to be a family member in trouble, the person who picks up pauses and asks one question: "What are the words?" If the caller can't answer correctly, the conversation stops. AI can clone a voice in seconds. It cannot fake codewords that changed a minute ago and exist only on your family's phones. If you or someone you know received one of these calls, report it to the FTC at ReportFraud.ftc.gov, notify FPL directly, and file a complaint with the Florida Office of the Attorney General. If financial information was shared, contact your bank immediately. The $4,000 number is designed to feel too good to ignore. That feeling is the mechanism. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - FPL issued a warning in July 2026 about AI-generated calls offering fake rebates of up to $4,000 to steal personal information. - The scam uses AI-synthesized voices that address victims by their first name, but knowing your name is not proof a caller is legitimate. - FPL does not offer cash rebates through outbound calls; hang up and contact FPL directly using a number from your bill or FPL.com. ## Frequently asked questions ### Is FPL calling customers about a $4,000 rebate? No. FPL confirmed this is a scam. The company does not offer cash rebates or free AC units through outbound phone calls. If you receive a call like this, hang up and contact FPL directly at the number on your bill. ### How can I tell if an FPL call is fake? Legitimate FPL representatives will not pressure you with deadlines or ask for payment on an unexpected inbound call. If you're unsure, hang up and call FPL directly using the number on your bill or at FPL.com. A callback to a known number is a stronger check, but does not prove the original caller was legitimate. ### Why did the scam call know my first name? Scammers buy personal data from data brokers or access information from data breaches. Knowing your name costs them almost nothing and makes the call sound more credible. It is not proof the caller is legitimate. ### How do family codewords protect against phone scams? Rotating codewords give your family a quick way to verify identity over any call. If someone claims to be a relative in trouble and can't answer "What are the words?" correctly, you know immediately it isn't them. ### What should I do if I already gave information to a scam caller? Report it to the FTC at ReportFraud.ftc.gov and contact your bank immediately if any financial information was shared. Also notify FPL and the Florida Attorney General's office. Act quickly to limit damage. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free to set up at trustonion.io and takes about two minutes, giving every household a simple way to pause any suspicious call with one question: "What are the words?" **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Fake Walmart Calls Are Using AI Voices to Steal Your Identity" published: 2026-07-21T02:53:00.154Z updated: 2026-10-11T06:12:56.151Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-walmart-robocall-scam-playstation-identity-theft --- # Fake Walmart Calls Are Using AI Voices to Steal Your Identity **Cite as:** Fake Walmart Calls Are Using AI Voices to Steal Your Identity, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-walmart-robocall-scam-playstation-identity-theft A robocall named 'Carl' tells you someone just charged $919 to your Walmart account for a PlayStation 5. Press 1 to dispute it. That single keypress hands your Social Security number to a criminal. The call sounds like a Walmart customer service agent: calm, professional, helpful. Since July 2026, a nationwide robocall campaign has been running exactly this script, with AI-generated voices going by the names "Carl" or "Emma." The FCC ordered the voice service provider responsible to cease and desist. The calls kept coming. The pitch is simple: an unauthorized purchase of roughly $900 to $919, usually a PlayStation 5, has appeared on your account. Press 1 to dispute it. Pressing 1 connects you to a live fraudster who "verifies your identity" by asking for your name, address, date of birth, account information, and, in many reported cases, your Social Security number. Every request is framed as protection: cancel the charge, secure your account, get your refund. None of it is real. ## Why the Voice Fools You Robocalls used to sound robotic. That era is over. Researchers studying synthetic audio put human detection accuracy at around 55 to 60 percent, barely better than a coin flip. The "Carl" and "Emma" voices are generated on demand, adjusting tone and pacing in real time. Walmart has no agent named Carl calling you about a PlayStation 5, but the voice just keeps talking. The $919 price point is not random. It sits just below $1,000, a threshold some financial institutions use for automatic fraud flags. Scammers study these limits. According to the FTC's Consumer Sentinel Network report, impersonation scams cost Americans $1.1 billion in 2023 alone, part of a broader $10 billion lost to fraud that year. Send 10 million robocalls and even a 0.1 percent success rate yields 10,000 victims. --- The Walmart scam is the easier version to spot. You have no relationship with "Carl" and no reason to trust him. The harder version is when the voice belongs to someone you love. With 20 to 30 seconds of audio, a scammer can clone your son's voice, your mother's, your best friend's. The technology is widely available, inexpensive, and requires no technical expertise. In 2023, a mother in Arizona received a call that sounded exactly like her 15-year-old daughter crying and saying she had been kidnapped. The voice was cloned. The daughter was safe at school. The mother could not tell the difference. ## What Stops It Legitimate companies do not cold-call you and ask for your Social Security number to cancel a purchase. If you get a call like this, hang up, then contact Walmart or your bank using the number on their official website, card, or statement. Do not call back any number the caller provided. A failed callback does not prove the original caller was legitimate; always use an independently sourced contact method. For calls that sound like someone you know, Trust Onion gives you and your trusted contacts three rotating codewords, calculated locally on your phone, that change every 60 seconds. When a voice claims to be someone you trust, one question settles it: "What are the words?" A familiar voice, a spoofed caller ID, and a convincing script are all things a scammer can fake. A Proofie™, a selfie signed by your passkey the moment you take it, adds a further layer: anyone can check in the Trust Onion app that your key signed the exact original photo, after a known moment, and that nothing has changed since. AI can clone a voice. It cannot know codewords that exist only on the phones of people you have personally authorized. The real caller answers in three seconds. In 2023, a mother in Arizona could not tell a cloned voice from her daughter's. A shared codeword would have ended that call before the fear set in. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - A nationwide robocall scam uses AI voices named 'Carl' and 'Emma' to impersonate Walmart and steal Social Security numbers, with the FCC ordering the responsible provider to cease and desist. - Impersonation scams cost Americans $1.1 billion in 2023 alone, part of more than $10 billion lost to fraud that year, according to the FTC. - Three rotating codewords are something an AI-cloned voice can never know. Ask 'What are the words?' before trusting any unexpected call from a person or institution you recognize. ## Frequently asked questions ### Is the Walmart PlayStation 5 phone call a scam? Yes. Calls claiming an unauthorized $900 to $919 PlayStation 5 purchase was made on your Walmart account are a known nationwide robocall scam. Walmart is not calling you. Do not press 1 and do not share any personal information. ### How do I report the fake Walmart robocall? Report it to the FTC at reportfraud.ftc.gov and to the FCC at fcc.gov/consumers/guides/filing-informal-complaint. You can also forward the number to 7726 (SPAM) if you received it as a text. ### Can AI really clone my family member's voice? Yes. Current voice cloning technology requires as little as 20 to 30 seconds of audio and is widely available at low cost. The resulting voice is convincing enough that most people cannot tell it apart from the real person. ### What should I do if I get a call that sounds like a family member in trouble? Pause before you act. Ask a question only the real person would know, or use a shared family codeword. Hang up and call the person directly on their known number. A failed callback does not prove the first caller was legitimate. Never send money or share personal information based on an unexpected call alone. ### What is Trust Onion and how does it stop voice cloning scams? Trust Onion is a free app that gives you and your contacts three rotating codewords that change every 60 seconds. When someone calls claiming to be a person or institution you trust, ask for the words. An AI-cloned voice cannot know them, so the scam fails immediately. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. The private three-word challenge adds a check beyond a familiar voice, caller ID, or message, free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Farm Equipment Scams Are Fooling Georgia Farmers" published: 2026-07-21T00:04:41.326Z updated: 2026-10-11T06:12:56.226Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-farm-equipment-scams-georgia-farmers --- # AI Farm Equipment Scams Are Fooling Georgia Farmers **Cite as:** AI Farm Equipment Scams Are Fooling Georgia Farmers, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-farm-equipment-scams-georgia-farmers A Bulloch County farmer found what looked like a legitimate equipment listing, wired money to a dealership representative who sounded entirely professional, and received nothing. The Georgia Department of Agriculture warned in July 2026 that this is happening across the state. The website had the branding, the photos, the contact forms. The person who called back knew the product details and responded within minutes. What the Bulloch County farmer had no way to know was that none of it was real. In July 2026, the Georgia Department of Agriculture warned farmers statewide that criminals were building convincing fake dealership websites and following up by phone or text, posing as sales representatives, to push buyers into wiring money for equipment that never ships. The scam works because both pieces reinforce each other: the site builds trust, the call closes the deal. Farm equipment is an ideal target. A single tractor can run from $50,000 to over $200,000, so scammers need to fool only one or two buyers to turn a serious profit. AI has made the setup cheap and fast. Fake websites that once took weeks to build now take hours. Voice tools can feed a scammer real-time product answers during a call, and AI can generate realistic business names, addresses, and fake customer reviews. ## How the Con Unfolds A buyer finds a listing through a search engine or social media ad. The site closely mimics a legitimate dealership. A "representative" responds quickly, sounds confident, and knows the inventory. Then comes the ask: wire a deposit to hold the equipment, framed as standard policy for large purchases. Wire transfers are used because they are nearly impossible to reverse. After payment, communication stops and the website disappears. Below-market prices are the first hook. A $120,000 tractor listed at $60,000 with vague explanations deserves immediate scrutiny. Pressure to move fast is the second: urgency is designed to override caution before a buyer thinks to verify anything. Legitimate dealerships accept multiple payment methods, so a seller who insists on wire transfer only, under a deadline, is telling you something. To check whether a dealer is real, go to the equipment manufacturer's official website and use their dealer locator or contact number. Never rely on contact information from the listing itself. A callback to a number you found independently is a stronger check, but a completed callback does not, by itself, confirm the original caller was legitimate. --- Farm equipment fraud sits inside a much larger pattern. The Federal Trade Commission reported that consumers lost over $10 billion to fraud in 2023, a record at the time, with impersonation scams making up a substantial share. The mechanics that fooled the Bulloch County farmer are identical to those used against corporate finance teams. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every participant was a deepfake. Vendor impersonation, fake executive calls, fake dealership representatives: the tool is the same. ## The Question That Stops It Before any wire is approved or vendor detail is changed, a finance or operations team member can ask one question: "What are the words?" Trust Onion gives authorized staff three rotating codewords that change every 60 seconds, calculated locally on each device with no server required. If the caller knows the current words, they are who they say they are. If they hesitate or guess wrong, the answer arrives before any money moves. AI can clone a voice in under a minute. It cannot know three words that exist only on authorized devices and rotate on a schedule only the team follows. For the Bulloch County farmer, the voice sounded right and the website looked right. One question with no good answer would have ended the whole thing in seconds. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI tools now allow scammers to build convincing fake farm equipment dealership websites in hours, then follow up by phone posing as sales representatives to pressure wire transfers. - Wire transfers are the preferred payment method in these scams because they are nearly impossible to reverse after sending. Legitimate dealerships accept multiple payment methods. - Verifying a dealer through the equipment manufacturer's official website, not the listing's own contact details, is one of the most reliable ways to avoid being scammed. ## Frequently asked questions ### How can I tell if a farm equipment website is fake? Look for prices well below market value, no verifiable physical address, and pressure to wire money quickly. Call the equipment manufacturer directly using their official website to confirm whether the dealership is authorized before making any payment. ### Are farm equipment scams increasing in Georgia? Yes. The Georgia Department of Agriculture issued a warning in July 2026 about a rise in fake dealership websites targeting farmers statewide. AI tools have made these scams cheaper and faster to run, increasing how often they occur. ### What should I do if a farm equipment seller only accepts wire transfer? Stop the transaction. Legitimate dealerships accept multiple payment methods. A seller who insists on wire transfer only, especially under time pressure, is a strong indicator of fraud. Wire transfers are nearly impossible to reverse once sent. ### How do AI farm equipment scams work? Scammers build fake dealership websites using AI, then follow up by phone posing as sales representatives. They use AI-generated product knowledge to sound credible, push buyers toward a wire transfer deposit, and disappear once payment is sent. ### How do I verify a farm equipment dealer is legitimate? Go directly to the equipment manufacturer's official website and use their dealer locator or contact number. Ask whether the specific business is an authorized seller. Never rely solely on contact information listed on the dealer's own website. ## More from Trust Onion Give your finance and operations teams a simple two-factor check for high-stakes requests. Before any wire is approved or vendor detail is changed, staff ask "What are the words?", three codewords that rotate every 60 seconds and are known only by authorized people. Trust Onion is free and ready at trustonion.io. Protect Your Business Free **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "A Couple Lost $800,000 to an AI Scam. Here's How." published: 2026-07-18T00:04:11.572Z updated: 2026-10-11T06:12:56.725Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/georgia-couple-lost-800000-ai-scam-voice-cloning --- # A Couple Lost $800,000 to an AI Scam. Here's How. **Cite as:** A Couple Lost $800,000 to an AI Scam. Here's How., Trust Onion, 2026-10-11. https://trustonion.io/blog/georgia-couple-lost-800000-ai-scam-voice-cloning A metro Atlanta couple lost $800,000 to scammers armed with nothing more than a cloned voice and an urgent story. CBS News reported the case in July 2026, alongside a South Florida attorney whose voice was replicated and turned against his own clients. The money was gone before the real family member knew anything had happened. According to CBS News reporting from July 2026, the Atlanta couple's loss was part of a documented national pattern. AI scam losses across the United States have reached nearly $900 million, and that figure covers only reported cases. In South Florida, a separate incident showed the same technology working from a different angle: scammers cloned an attorney's voice and used his professional credibility to deceive the people who trusted him most. Neither case required a data breach or a hacked account. Just audio, a cloning tool, and a family with no way to verify who was actually on the line. The mechanics are straightforward. AI voice cloning requires as little as 20 to 30 seconds of audio, drawn from a voicemail, a social media clip, or a brief phone call. Scammers feed that sample into a cloning tool, several of which are commercially available and require no technical expertise, then call a family member with a crisis: an arrest, a hospital, a car accident. Something that demands money immediately and punishes hesitation. --- The emotional architecture of these calls is deliberate. Research shows humans correctly identify AI-generated voices only about 55 to 60 percent of the time under calm conditions. A scam call is not calm. The urgency is manufactured to short-circuit careful reasoning. When you hear a voice that sounds like someone you love, you don't run a technical analysis. You react. That reaction is the product. The standard advice, hang up and call your family member back on a known number, is genuinely useful. But a failed callback does not prove the original caller was legitimate: scammers spoof caller ID so the number looks right, and they keep victims emotionally agitated to discourage the pause required to think clearly. Families with no shared verification system in place before the call arrives have nothing to fall back on in the moment. ## A Question That Ends the Call Trust Onion gives families three rotating codewords, calculated locally on each person's phone, that change every 60 seconds on a shared schedule. When a suspicious call arrives, one question settles it: "What are the words?" A real family member answers immediately. A scammer, however convincing the cloned voice, cannot. The words are never stored on a server and cannot be intercepted in transit. For families who want a visual layer of verification, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. The app captures the photo, adds a fingerprint and QR watermark, then computes a SHA-256 hash of the final image. A standard P-256 WebAuthn passkey signs after Face ID, fingerprint, or device-passcode unlock, binding the full signing key to the exact original photo, the time, and the What3Words location. Verification checks that signature against the person's public key in your shared Trust Onion group. Proofies are public by default and stored securely on AWS; you can add a password or delete one at any time, though copies already downloaded cannot be recalled. Codewords work alongside Proofies, not as part of the signed payload. ## What the Atlanta Case Leaves Behind The five steps that cost one couple $800,000 are the same steps used in every variant of this scam: harvest audio, clone the voice, call with a crisis, request fast payment by wire transfer, gift card, or cryptocurrency, then disappear before anyone asks questions. The technology is not going to become less accessible. What changes the outcome is a shared system established before the call comes. "What are the words?" is a question a scammer has no answer for, no matter how well they sound like the person you love. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning tools can replicate someone's voice using as little as 20 to 30 seconds of audio from social media or voicemails, and several require no technical expertise. - Humans correctly identify AI-generated voices only 55 to 60 percent of the time under calm conditions, making your ears an unreliable defense when a scammer adds emotional urgency. - AI voice scam losses in the United States have reached nearly $900 million in reported cases alone, as illustrated by a metro Atlanta couple who lost $800,000 and a South Florida attorney whose cloned voice was used against his own clients. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers record a short audio sample from social media or voicemails, feed it into a voice cloning tool, then call family members pretending to be a loved one in crisis. They request urgent wire transfers, gift cards, or cryptocurrency before the victim can verify the story. ### How much audio does a scammer need to clone your voice? As little as 20 to 30 seconds of audio is enough for most voice cloning tools to produce a convincing replica. That sample can come from a voicemail, a social media video, or a brief phone call. ### Can you tell if a phone call is using an AI-cloned voice? Usually not reliably. Research shows humans correctly detect AI-generated voices only about 55 to 60 percent of the time under calm conditions. During a stressful, urgent call, detection rates are likely even lower. ### How can I protect my family from AI voice scams? Set up a shared verification method your family can use during unexpected calls. Hanging up and calling back on a known number helps, but a failed callback does not prove the original caller was legitimate. Trust Onion's three rotating codewords give families a question no cloned voice can answer: "What are the words?" ### How common are AI voice cloning scams in the United States? Reported AI scam losses in the United States have reached nearly $900 million, and that figure only reflects cases that were actually reported. Experts believe the true total is higher. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Setup takes about two minutes and it's completely free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "The Call Every Parent Fears: AI Now Fakes Your Child's Voice" published: 2026-07-17T00:06:22.281Z updated: 2026-10-18T05:19:24.508Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-fake-kidnapping-ransom-scam --- # The Call Every Parent Fears: AI Now Fakes Your Child's Voice **Cite as:** The Call Every Parent Fears: AI Now Fakes Your Child's Voice, Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-voice-cloning-fake-kidnapping-ransom-scam CBS News Bay Area anchor Juliette Goodrich picked up the phone on February 14, 2026, and heard her daughter's voice screaming for help. It was an AI-generated voice clone, and a scammer was demanding $2,500 to "release" her. The call appeared to come from her daughter's actual phone number. The voice sounded exactly like her daughter, crying and frightened. Then a second voice came on, claiming to have kidnapped her. Her daughter was fine. But for a few terrifying seconds, a professional broadcaster who covers scams for a living believed her child was in danger. That moment of panic is the point. It is worth $2,500 to someone. The Goodrich call made headlines, but the scam is not new. In the case of a victim also referenced in the CBS News report, scammers used AI-cloned voice replicas and demanded a ransom paid in bitcoin. Same playbook, different family. The FTC reported that imposter scams cost Americans $2.7 billion in 2023, with virtual kidnapping variations among the fastest-growing subcategories, driven by how cheap and accessible voice cloning technology has become. ## How the Call Is Built The scam follows a tight, rehearsed structure. Caller ID spoofing makes the call appear to come from your child's actual number, so your guard drops before you say hello. The call opens with a few seconds of cloned voice, usually crying or screaming, designed to spike adrenaline and shut down rational thinking. A second voice then takes over as the supposed captor, keeping you on the line, keeping you emotional, and pushing you toward payment before you can reach anyone else. Voice cloning now requires as little as 20 to 30 seconds of audio, which can come from a voicemail, a TikTok video, a YouTube clip, or an Instagram reel. Almost anyone with an active social media presence has already handed over enough. The demanded amount is calibrated to be painful but reachable: $2,500 is a number many people can pull together quickly through Venmo, Zelle, wire transfer, or gift cards, without triggering major bank holds. Scammers also tell you not to hang up, not to call anyone, not to contact police, exploiting the panic rather than any real threat. ## Why Your Gut Cannot Save You People often think they would know their child's voice well enough to spot a fake. Human detection of AI-generated audio currently runs around 55 to 60 percent accuracy, barely better than a coin flip, according to multiple studies on synthetic speech detection, and that is under calm, controlled conditions. In a moment of terror, your brain is not running an audio analysis. It is reacting. The clone does not need to be perfect. It just needs to be good enough for the first five seconds. AI cannot replicate a secret your family chose together. Trust Onion is a free app that gives your family three rotating codewords on a 60-second cycle. If someone calls claiming to be your daughter, ask "What are the words?" A scammer has exactly one path forward: silence, or a guess. The codewords are calculated locally on your family's authorized devices and were never spoken in any audio a scammer could have harvested. For visual confirmation, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. Use the app to send and verify Proofies, compare the signing key against the person's full public key in your shared group, and check that the exact original photo has not changed since it was signed. Signed time and place cannot be changed undetected; they are not independent proof of physical whereabouts or exact capture time. Family codewords work alongside Proofies, not as an overlay or signed field. If you receive a distress call, ask for the words, then hang up and call your child directly on their known number from your contacts, not the number that called you. A failed callback does not prove the original caller was legitimate. Contact local police if you believe someone may be in danger. Goodrich went public with her story so other families could prepare. The scam worked on her for a few seconds because she had no way to instantly verify it was not real. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning requires as little as 20 to 30 seconds of audio, meaning anyone with a voicemail, TikTok, or YouTube presence is already a potential target. - Human ability to detect AI-generated audio is only slightly better than chance, so trusting your gut is not a reliable defense against a cloned voice. - Virtual kidnapping scams combine caller ID spoofing with cloned voices and deliberate isolation to push victims toward fast payment before they can verify their child is safe. ## Frequently asked questions ### How do virtual kidnapping scams using AI voices work? Scammers spoof your child's phone number, play a cloned voice crying or screaming, then a second person poses as the captor and demands ransom. The goal is to trigger panic and push you toward fast payment before you can verify your child is safe. ### How much audio does someone need to clone a voice? As little as 20 to 30 seconds of audio is enough for modern AI voice cloning tools. That audio can come from a voicemail, TikTok, YouTube video, or Instagram reel, making almost anyone with social media a potential target. ### Can you tell if a phone call is using an AI cloned voice? Not reliably. Human detection of AI-generated audio is only slightly better than random chance. Even people who know about voice cloning report feeling shaken when hearing a realistic clone of a family member's voice. ### What should you do if you get a fake kidnapping call? Stay calm and do not send money immediately. Hang up and call your child directly using a number from your contacts, not the number that called you. A failed callback does not prove the original caller was legitimate. Contact local police if you believe someone may be in danger. ### How common are AI voice cloning scams targeting parents? They are growing fast. The FTC reported imposter scams cost Americans $2.7 billion in 2023, with virtual kidnapping variations among the fastest-growing subcategories, driven by how cheap and accessible voice cloning technology has become. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set up takes two minutes, it works offline, and it's free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Her Daughter's Voice Was Cloned. The Kidnapping Was Fake." published: 2026-07-17T00:03:15.942Z updated: 2026-10-11T06:12:57.396Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-fake-kidnapping-scam-savi-security --- # Her Daughter's Voice Was Cloned. The Kidnapping Was Fake. **Cite as:** Her Daughter's Voice Was Cloned. The Kidnapping Was Fake., Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-cloning-fake-kidnapping-scam-savi-security A mother in Arizona picked up the phone and heard her daughter's voice, terrified, claiming she'd been kidnapped. The phone number matched her daughter's. The voice matched her daughter's. Neither was real. Scammers had cloned the daughter's voice using AI and spoofed her number, staging a fake crisis to extort money. The mother believed it, for a few devastating minutes, before the ruse unraveled. What happened to her is no longer unusual. The FTC received more than 36,000 reports of impersonator scams involving family members in 2024, with losses topping $1.1 billion. Voice cloning now requires as little as 20 to 30 seconds of audio, pulled from a voicemail, a TikTok, a YouTube video, or a recorded call. Once scammers have a sample, they can generate speech that sounds like your child, your parent, your spouse, and make that voice say anything. Then they spoof the real phone number. The caller ID says it's your daughter. The voice sounds like your daughter. The message is that your daughter is in danger. ## The Playbook The call comes in, often late at night or during a moment of distraction. The fake voice delivers a few seconds of panic. A second person, the supposed captor, gets on the line with demands. They tell you not to hang up, not to call anyone else, not to contact police, keeping you on the line so you can't verify anything. Pressure plus isolation plus a voice you trust. Detection tools are one response. Patrick and Ryan Coughlin watched this happen to their mother, then built Savi Security, a consumer app with real-time call monitoring and text filtering, and raised $7 million in seed funding to bring it to market. Real-time AI detection during a phone call is genuinely hard. Phone audio is compressed, calls are short, and scammers keep improving. Human accuracy at spotting AI-generated audio hovers around 55 to 60 percent, barely better than a coin flip, and you're not making that judgment in a lab with headphones. You're making it in three seconds, while your heart is pounding. Asking "does this voice sound real?" is not a reliable test. --- There's a simpler question. Instead of trying to detect a cloned voice, you ask something the fake voice cannot answer: "What are the words?" That's how Trust Onion works. Families share three private codewords, known only to the people in their circle, calculated locally on each person's phone. A cloned voice, no matter how convincing it sounds, doesn't know your family's three words. A scammer calling from a spoofed number doesn't know them either, because they were never sent to a server, never stored anywhere that could be breached. The words rotate every 60 seconds, so even if someone somehow learned them, they'd expire almost immediately. Note: if a callback to a known number goes unanswered or sounds wrong, that alone does not confirm the original caller was legitimate. If you believe someone may genuinely be in danger, contact authorities. ## Before the Call Comes Every protection tool has one thing in common: it has to exist before the crisis. Codewords need to be shared during a calm moment, not while someone is screaming on the other end of the line. The conversation is simple: "Hey, if you ever get a weird call from someone claiming to be me, here's what to ask." The Coughlin family's mother had no tool like this when it happened. She had a phone, a caller ID that said her daughter, and a voice that sounded like her daughter. There was nothing to ask, no way to verify, just fear and a demand for money. "What are the words?" would have ended it in seconds. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Voice cloning requires only 20 to 30 seconds of audio from public sources like TikTok or voicemails to convincingly impersonate a family member. - Human accuracy at identifying AI-generated audio is only 55 to 60 percent, so you cannot rely on your instincts to spot a fake voice under pressure. - A family codeword system offers a simple defense that bypasses voice detection entirely, because a cloned voice has no way to know words that exist only on your family's phones. ## Frequently asked questions ### What is a virtual kidnapping scam? A virtual kidnapping scam is a fraud where criminals call and claim to have a family member held hostage. Modern versions use AI-cloned voices to make the victim sound real and scared, pressuring you to pay a ransom before you can verify anything. ### How do scammers clone someone's voice for a phone scam? Scammers collect 20 to 30 seconds of audio from public sources like social media videos, voicemails, or recorded calls. AI tools then generate new speech in that person's voice, allowing criminals to make the cloned voice say anything they want. ### Can you tell if a voice on the phone is AI-generated? Probably not reliably. Studies show humans correctly identify AI-cloned audio only 55 to 60 percent of the time under controlled conditions. In a real, high-stress call you have seconds to decide, making accurate detection even less likely. ### What is a family codeword and how does it stop AI voice scams? A family codeword is a secret phrase shared only among trusted family members. If a caller cannot provide the codeword, you know something is wrong. It bypasses voice detection entirely because a cloned voice has no way to know the secret phrase. ### How common are AI voice cloning scams in 2024 and 2025? The FTC received over 36,000 reports of impersonator scams involving family members in 2024, with total losses exceeding 1.1 billion dollars. Experts expect these numbers to rise as voice cloning tools become cheaper and easier to use. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. AI can clone a voice, but it cannot know words that exist only on your family's phones. Trust Onion is free, works offline, and takes about two minutes to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Cloned Her Son's Voice in 10 Seconds. Then It Called Her." published: 2026-07-15T00:05:10.349Z updated: 2026-10-11T06:12:57.521Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-scam-mom-i-need-money --- # AI Cloned Her Son's Voice in 10 Seconds. Then It Called Her. **Cite as:** AI Cloned Her Son's Voice in 10 Seconds. Then It Called Her., Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-cloning-scam-mom-i-need-money Ten seconds of audio from a social media video is all it takes to clone your child's voice. An NBC 7 San Diego demonstration in March 2026 showed that free online tools can produce a convincing copy from a clip that short. The call arrives without warning. Your son's voice, unmistakably his, fills the speaker: "Mom, I need money. I'm in trouble. Please don't hang up." Your hand is already reaching for your wallet. That moment of pure parental reflex is the entire business model. AI voice cloning has made the fake emergency call one of the most effective scams running today. NBC 7 San Diego reported on March 3, 2026 that these schemes are rising sharply, both in San Diego and nationally. The FBI has confirmed the trend and urged families to act. The Federal Trade Commission reported that Americans lost more than $2.7 billion to imposter scams in 2023, and AI voice cloning is pushing those numbers higher. ## How the Setup Works A scammer finds a few seconds of your family member's voice online: a TikTok clip, a YouTube video, a graduation speech. Free cloning tools require no special skills. Within seconds, they have a synthetic voice that sounds like the real person. The call follows a script. A fake emergency, a car accident, an arrest, a kidnapping. The cloned voice sounds panicked, which raises the emotional stakes and lowers your defenses. A second person often takes over, playing a lawyer, a police officer, or a kidnapper. Then comes the instruction that should end the call immediately: "Just stay on the line. We'll handle this. Don't call the police yet." That line isolates victims from anyone who might help them think clearly. Research suggests people correctly identify AI-generated voices only 55 to 60 percent of the time, even when they're specifically listening for fakes. In a high-stress call, you are not evaluating audio quality. You are listening to your kid cry. ## Who Gets Targeted Parents are the most common targets, and grandparents are especially vulnerable. The grandparent emergency scam has existed for years; AI voice cloning made it far more convincing. San Diego, with its large military population and high social media usage, sees active targeting, according to the NBC 7 report. Experts and the FBI agree on one core defense: establish a secret passphrase with your family. If a distressing call arrives, ask for it. If they cannot provide it, hang up and call the real person directly on a number you already have saved. A successful callback does not prove the original caller was legitimate; it only confirms whether your family member is actually safe. A single static passphrase has a weakness, though. If it is shared, overheard, or guessed, it stops working. --- Trust Onion takes that idea further. The app gives your family three private codewords that rotate automatically every 60 seconds, calculated locally on each authorized phone with no server required. They work offline. A word that is overheard becomes useless almost immediately. When something feels wrong, you ask one question: "What are the words?" A cloned voice can mimic how your son sounds. It cannot know the three words your family's phones generated this moment. For added verification, a Proofie™ is a selfie signed using your passkey in the Trust Onion app; use the app to send and verify Proofies and compare the signing key against the person's full public key in your shared group. Family codewords work alongside Proofies, not as an overlay or signed field. If a call opens with "Mom, I need money," it ends the moment you ask for the words and hear silence. Scammers run volume operations and need calls to work fast. A family with a verification system is a family they skip. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning tools can replicate a family member's voice in seconds using audio pulled from public social media, and free tools require no special skills. - Americans lost more than $2.7 billion to imposter scams in 2023, and AI voice cloning is making these schemes more convincing and harder to detect in real time. - If a caller tells you not to hang up or contact anyone else, treat it as an immediate red flag; hang up, call your family member directly on a known number, and confirm they are safe. ## Frequently asked questions ### What is an AI voice cloning scam? Scammers record a few seconds of someone's voice from social media, clone it with free AI tools, then call relatives pretending to be that person in a fake emergency. They pressure victims to send money quickly before anyone can verify the situation. ### How can I tell if a phone call is using an AI cloned voice? It is very difficult to detect in real time. Research shows people correctly identify AI voices only 55 to 60 percent of the time even when listening carefully. Hang up and call your family member directly on their known number to confirm they are safe. A successful callback does not prove the original caller was legitimate. ### How do I protect my family from voice cloning scams? Set up a secret passphrase with close family members. If anyone calls claiming to be a relative in danger, ask for the passphrase. If they cannot provide it, end the call and contact that family member directly through a trusted number. Rotating codewords, like those in Trust Onion, are harder to compromise than a static phrase. ### Who is most at risk for AI voice cloning scams? Parents and grandparents are the most common targets because scammers exploit the instinct to protect family. Grandparents are especially vulnerable, as the grandparent emergency scam has existed for years and AI voice cloning now makes it far more believable. ### What should I do if I think I received an AI voice cloning scam call? Hang up immediately and call your family member directly using a saved contact number. Report the call to the FTC at ReportFraud.ftc.gov and your local FBI field office. Never wire money or send gift cards based on an emergency phone call alone. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. They change every 60 seconds, work offline, and are free to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "€3 Million Gone: How Deepfakes Fooled a Company's Own Bank" published: 2026-07-12T00:02:37.774Z updated: 2026-10-11T06:12:57.876Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/capillary-tech-deepfake-banking-fraud-voice-cloning --- # €3 Million Gone: How Deepfakes Fooled a Company's Own Bank **Cite as:** €3 Million Gone: How Deepfakes Fooled a Company's Own Bank, Trust Onion, 2026-10-11. https://trustonion.io/blog/capillary-tech-deepfake-banking-fraud-voice-cloning In June 2026, Capillary Technologies disclosed that an overseas subsidiary had lost approximately €3 million after attackers used voice cloning, forged signatures, and social engineering to impersonate the company's own executives. By the time anyone realized what had happened, the money was already moving to unauthorized accounts. The voice on the call sounded exactly like a Capillary Technologies executive. It wasn't. Capillary Technologies is a Bengaluru-based SaaS company with institutional backing and professional finance teams. Its overseas subsidiary had processes in place. None of that stopped a cloned voice and some forged paperwork from moving €3 million out the door. At the time of disclosure, the company had recovered €0.45 million, leaving roughly €2.55 million still missing. This kind of fraud is no longer theoretical. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every other participant was a deepfake. In the Capillary case, attackers didn't even need video. ## How the Fraud Worked The attack combined three techniques, none novel on their own, but together they worked. Voice cloning produced audio that sounded like Capillary's key managerial personnel. Modern tools can generate a convincing replica from as little as 20 to 30 seconds of audio, and earnings calls, conference presentations, YouTube videos, and LinkedIn posts all work as source material. Forged signatures added a paper trail that looked legitimate. When a voice says "transfer the funds" and a document arrives with a matching signature, the pressure to comply is real. Social engineering tied it together: the attackers knew enough about the company, its personnel, and its subsidiary structure to make the requests feel routine. That's not luck. That's research. According to the World Economic Forum, deepfake fraud attempts increased 500% in 2024. The technology keeps getting cheaper, and the gap between what's real and what sounds real keeps narrowing. Employees fall for this not because they're negligent, but because humans are wired to trust familiar voices. When a call sounds like a known executive and arrives with supporting documents, questioning it feels unnatural. Attackers research company structures in advance precisely because they know this. ## The Verification Problem Every fraud like this comes down to the same failure: someone couldn't verify they were actually talking to who they thought they were talking to. Phone numbers can be spoofed. Email accounts can be compromised. Voices can be cloned. Signatures can be forged. What holds up is a shared secret: information only the real person would know, not publicly available, and rotated frequently enough to be useless if stolen. Trust Onion gives finance and operations teams exactly that: three rotating codewords, calculated locally on authorized devices, that change every 60 seconds. Before approving a wire transfer or acting on an executive instruction, staff ask: "What are the words?" If the caller can't answer, the request stops there. The words are never sent to a server, work offline, and expire on a 60-second rotation. "Before I process this transfer, what are the words?" is a sentence that stops a cloned voice cold. For teams that need to verify physical presence, a Proofie™ is a selfie signed using a passkey in the Trust Onion app. Verification checks the passkey signature against the full public key, the original photo's SHA-256 hash and byte length, and the signed record, including time and What3Words location. A valid Proofie establishes that whoever created the signed record possessed the private key at proof creation; compare the verified full signing key with the person's public key in your shared Trust Onion group. A subsidiary receives what sounds like an urgent instruction from headquarters. The voice is convincing. The paperwork looks right. The window to think clearly is short. Three words close that window on the attacker. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Capillary Technologies lost approximately €3 million through voice cloning and forged signatures alone, with only €0.45 million recovered at the time of disclosure. - Modern voice cloning tools can produce a convincing replica from as little as 20 to 30 seconds of audio, using public sources such as earnings calls, conference presentations, or LinkedIn videos. - According to the World Economic Forum, deepfake fraud attempts increased 500% in 2024, making businesses of every size and funding level potential targets. ## Frequently asked questions ### How did deepfake fraud steal 3 million euros from Capillary Technologies? Attackers used cloned executive voices and forged signatures to trick an overseas subsidiary into authorizing fraudulent transfers. The familiar-sounding audio combined with legitimate-looking paperwork made the requests appear routine. As of disclosure, only €0.45 million had been recovered. ### How little audio does someone need to clone a voice? Modern voice cloning tools can produce convincing replicas from as little as 20 to 30 seconds of audio. Public sources like earnings calls, conference presentations, YouTube videos, and LinkedIn posts all provide enough usable material for attackers. ### How common is deepfake fraud against businesses? According to the World Economic Forum, deepfake fraud attempts increased 500% in 2024. The technology is becoming cheaper and more accessible, making businesses of all sizes potential targets, including well-funded companies with professional finance teams. ### What is the best way for businesses to verify identity and prevent voice cloning fraud? Shared secrets are currently one of the most reliable defenses: private information only the real person would know, not publicly available, and rotated frequently enough to be useless if stolen. Callback procedures through independently verified numbers add another layer, though a successful callback alone does not confirm the original caller was legitimate. ### Why do employees fall for deepfake voice scams even with security processes in place? Humans are wired to trust familiar voices. When a call sounds like a known executive and arrives with supporting documents, questioning it feels unnatural. Attackers research company structures and personnel in advance to make fraudulent requests feel completely routine. ## More from Trust Onion Give your finance and operations teams a simple two-factor check for high-stakes requests. Before any wire, vendor change, or executive instruction gets actioned, staff ask: "What are the words?" The three codewords rotate every 60 seconds and are known only by authorized people. Trust Onion is free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "The Call Every Parent Dreads (And How to Survive It)" published: 2026-07-11T00:04:48.370Z updated: 2026-10-18T05:19:25.965Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-fake-kidnapping-scam-family-protection --- # The Call Every Parent Dreads (And How to Survive It) **Cite as:** The Call Every Parent Dreads (And How to Survive It), Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-voice-cloning-fake-kidnapping-scam-family-protection A woman spent nearly two hours on the phone with a voice that sounded exactly like her college-aged daughter before wiring $3,270 to Mexico. Then her real daughter called from another line. The call came from her daughter's actual phone number. The voice was crying, scared, saying she'd been in an accident and taken. According to a January 2026 report from InvestigateTV, it was an AI-generated clone built from audio pulled off social media. By the time the woman realized what had happened, the money was gone. This is the virtual kidnapping scam rebuilt with cheap AI tools. Cybersecurity experts now say scammers need as little as two seconds of someone's voice to produce a convincing fake. Shorter than it takes to say "Hey, leave me a message." Once they have that clip, they can make it cry, plead, say your name. ## Why the Call Is So Hard to Break The woman's case hit every pressure point at once. The caller ID showed her daughter's number, because spoofing costs almost nothing. The voice sounded right. And the person running the call kept her on the line for almost two hours, isolating her, escalating whenever she started to calm down. That is not improvisation. It is a script designed to shut down clear thinking. Scammers tell victims not to hang up. They warn that calling anyone else will make things worse. They keep the cloned voice audible in the background, crying and frightened. Every time a victim steadies herself, the pressure goes back up. Two hours of that, and most people will do whatever they are asked. One detail from the woman's case is worth holding: the call did not come from an unknown number. It came from her daughter's number. Caller ID is trivially easy to fake, so the reassurance most people feel when they see a familiar name on their screen means nothing here. ## The Scale of the Problem The Federal Trade Commission reported that Americans lost $1.1 billion to impersonation scams in 2023. Virtual kidnapping calls have been documented across dozens of states. The InvestigateTV report from January 2026 confirms the trend is not slowing, because voice cloning has removed the last barrier: you no longer need a skilled impersonator. You need a clip and a laptop. --- The uncomfortable question is what actually stops this. Calling your child's cell and getting no answer proves nothing; a scammer can say "She's right here with me, don't try to reach her." Asking a question only your child would know gives a practiced fraudster room to stall or threaten. What a scammer cannot fake is information that was never online and never on a server: a rotating codeword that only real family members carry on their phones. Trust Onion generates a set of three words that change every few hours and are calculated locally, with no server involved. When a call comes in that doesn't feel right, you ask: "What are the words?" A real family member opens the app and answers. A caller with a perfect voice clone has no idea. The same three-word challenge works for security and finance teams verifying executive requests or high-risk approvals over the phone, anywhere caller ID cannot be trusted. If you get a call like the woman's, a few things matter immediately. Do not wire money; transfers to Mexico or gift-card payments are nearly impossible to reverse, and a real emergency would involve law enforcement, not a cash demand. Hang up and call back on a number you already have saved, not the number that just called you. A failed callback does not prove the original caller was legitimate, so use a number from a card, a statement, or another source you trust independently. If your family uses Trust Onion, ask "what are the words?" and if the caller cannot answer, you have your answer. Call 911 if you have any reason to believe someone may genuinely be in danger. Voice cloning will keep getting cheaper and faster. Social media gives criminals a nearly unlimited supply of source audio. But AI can clone a voice. It cannot guess three words that rotate every few hours and never leave the phones of the people who matter most. The woman's two-hour nightmare could have been a three-second answer, or a very fast hang-up. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Scammers can clone a convincing voice from as little as two seconds of audio pulled from social media, then make it say anything, including crying or pleading. - Caller ID can be spoofed to show a familiar number, so seeing a loved one's name on your screen is not proof they are calling. - Americans lost $1.1 billion to impersonation scams in 2023, and voice cloning technology is making these scams more accessible to more criminals. ## Frequently asked questions ### How do scammers clone someone's voice for a kidnapping scam? Scammers use AI voice cloning tools that require as little as two seconds of audio, often pulled from public social media videos or voicemails. The cloned voice can then be made to say anything, including crying or pleading, making fake kidnapping calls extremely convincing. ### Can scammers fake a call from my child's phone number? Yes. Caller ID spoofing is cheap and easy, allowing scammers to make a call appear to come from any number, including your child's. Seeing a familiar name on your screen does not confirm who is actually calling. ### What should I do if I get a virtual kidnapping call? Stay as calm as possible, hang up and call your loved one on a number you already have saved, and avoid sending any money. A failed callback does not prove the original caller was legitimate. Contact the FBI or FTC to report the incident, and call 911 if someone may genuinely be in danger. ### How can families protect themselves from AI voice cloning scams? Use a private rotating codeword that only family members know and ask for it during any suspicious call. This is one defense scammers cannot bypass, since they have no way to know a word your family chose in private that changes every few hours on your phones. ### How common are virtual kidnapping scams in the United States? Very common and growing. The FTC reported $1.1 billion lost to impersonation scams in 2023. Virtual kidnapping calls have been documented across dozens of states, and voice cloning technology continues to make these scams easier for criminals to run. ## More from Trust Onion See how Trust Onion gives people and teams a practical way to verify identity, whether you're a parent protecting your family or a security professional managing high-risk approvals. Explore Trust Onion Free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Her Son's Voice Asked for Help. It Wasn't Her Son." published: 2026-07-09T00:02:19.478Z updated: 2026-10-18T05:19:28.806Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-scam-canadian-mother-family-codeword --- # Her Son's Voice Asked for Help. It Wasn't Her Son. **Cite as:** Her Son's Voice Asked for Help. It Wasn't Her Son., Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-voice-cloning-scam-canadian-mother-family-codeword A Canadian mother picked up the phone and heard her son's voice, scared, in trouble, asking for money. Every word sounded exactly like him. None of it was real. The voice had been cloned from audio pulled off social media. Scammers need as little as 20 to 30 seconds of audio, a TikTok clip, a birthday reel, a graduation livestream, fed into a free or low-cost tool available to anyone online. Within minutes, they can make that voice say anything they want, then dial a parent. In 2024, Canadians reported losing nearly C$3 million to family-emergency and grandparent voice-cloning scams, according to Yahoo Finance Canada. That figure counts only reported losses; fraud involving embarrassment or confusion is consistently underreported. The Canadian mother was one call away from becoming part of that number. The formula is consistent: create urgency, isolate the target, demand fast action before anyone can verify anything. A second scammer often plays a police officer, a lawyer, or a hospital administrator, taking over once the cloned voice has done its job. By the time a parent is talking logistics, the emotional damage is already done. ## Why the Voice Works Human detection accuracy for AI-generated audio hovers around 55 to 60 percent, barely better than guessing, even when the listener knows the voice well. Scammers count on the parenting response overriding the fraud checklist. The Canadian mother noticed the story shifting as the call went on. The urgency felt manufactured. When she tried to slow things down, the caller pushed harder. She didn't send the money. Not everyone catches it in time. Pressure is always the clearest red flag. Real emergencies don't require skipping verification. A real family member, even a panicked one, will understand if you say "I need to call you back on your regular number." A scammer will not allow that. Note, though, that a failed callback is not proof the original caller was legitimate. Always use a number you already have from a card, a statement, or your own contacts, and alert authorities if you genuinely believe someone may be in danger. --- ## Three Words, Rotating Every 60 Seconds Fraud prevention experts quoted in the reporting on the Canadian mother's case recommend setting up a family codeword. A cloned voice, no matter how accurate, cannot know a word the family agreed on privately. Trust Onion takes that idea further. Instead of a single static word that could be overheard or guessed, the app gives everyone in your circle three rotating codewords that change every 60 seconds, calculated locally on the phone with no server required. When a call comes in from someone claiming to be a grandchild or a child in trouble, you pause and ask one question: > "What are the words?" The answer is either correct or it isn't. A Proofie™, a selfie signed using your passkey the moment you take it, adds another layer: anyone can verify in the Trust Onion app that the signing key matches the person's public key in your shared group, and that the exact original photo has not changed since it was signed. Codewords and Proofies work alongside each other. The Canadian mother caught the scam because the story didn't hold up under scrutiny. Instincts under emotional pressure are unreliable. Three rotating codewords don't rely on instincts. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Scammers can clone a family member's voice from as little as 20 to 30 seconds of public audio found on social media, using free or low-cost tools available online. - Canadians reported losing nearly C$3 million to voice-cloning family-emergency scams in 2024, and actual losses are likely higher because most fraud goes unreported. - A family codeword defeats a cloned voice because it requires real-time knowledge no scammer can access; Trust Onion's three rotating codewords change every 60 seconds for stronger protection. ## Frequently asked questions ### How do scammers clone a family member's voice? Scammers extract 20 to 30 seconds of audio from public social media videos and feed it into free or low-cost AI voice cloning tools. Within minutes they can generate a convincing voice that says anything they choose and use it to call relatives. ### What is a virtual kidnapping scam using AI voice cloning? A virtual kidnapping scam uses a cloned voice to impersonate a loved one claiming to be in danger. A second scammer often poses as a police officer or lawyer to control the conversation and demand fast payment before the victim can verify the situation. ### How can I tell if a distressing phone call is a voice cloning scam? Watch for a story that shifts during the call, intense pressure to act immediately, and resistance when you ask to call back on a known number. Legitimate emergencies allow you to pause and verify. Scammers will not. ### What should I do if I think I am receiving a voice cloning scam call? Hang up and call your family member on their known number. Ask a question only they would know, or use a pre-arranged family codeword. Do not send money by wire transfer, gift cards, or cryptocurrency before confirming the situation independently. Alert authorities if you believe someone may genuinely be in danger. ### How much money have people lost to AI voice cloning scams? Canadians alone reported losing nearly C$3 million to family-emergency voice-cloning scams in 2024. Actual losses are likely higher because fraud involving embarrassment or confusion is consistently underreported to authorities. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. Trust Onion is free and takes minutes to set up at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "The Fake Kidnapping Call That Launched a Family's Mission" published: 2026-07-08T00:05:34.935Z updated: 2026-10-11T06:12:58.972Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/fake-kidnapping-call-ai-voice-clone-family-safety --- # The Fake Kidnapping Call That Launched a Family's Mission **Cite as:** The Fake Kidnapping Call That Launched a Family's Mission, Trust Onion, 2026-10-11. https://trustonion.io/blog/fake-kidnapping-call-ai-voice-clone-family-safety A mother picked up the phone and heard her daughter screaming for help. The voice was perfect, the terror was real, and the daughter was fine, because the caller was an AI demanding ransom. The Coughlin family knows the call. Their mother nearly paid a ransom after an AI-generated voice mimicked her daughter crying and begging for help, while a second voice on the line claimed to be holding her captive. The daughter was never in danger. The voice was indistinguishable from the real thing, and that is precisely what makes this scam so hard to dismiss. Patrick and Ryan Coughlin, the brothers in that family, turned the experience into a company. In July 2026, TechCrunch covered the launch of Savi Security, an app built to detect AI-powered scams across calls, texts, and emails. Savi raised $7 million in seed funding. A family's near-miss became a funded startup, which tells you this is not a fringe problem. ## How the Call Works Voice cloning now requires as little as 20 to 30 seconds of audio: a voicemail, a TikTok, a podcast clip. Once a scammer has the recording, they can generate a convincing reproduction of that person's voice saying anything. The call follows a pattern: a panicked voice you recognize screams for help, a supposed captor gets on the line and tells you not to call the police, and you are kept talking so you cannot verify anything. Every second is designed to override clear thinking. Fear does the rest. The numbers confirm the scale. According to the Federal Trade Commission, phone scams cost Americans $1.77 billion in 2023 alone, with impersonation scams as the leading category. The World Economic Forum reported that deepfake fraud attempts increased 500% in 2024. In February 2024, engineering firm Arup lost $25 million when an employee joined a video call where every participant was a deepfake. If that can happen to trained professionals, it can happen to a parent who picks up the phone and hears a child screaming. ## Why Your Ears Cannot Save You Human ability to detect AI-generated audio hovers around 55 to 60 percent accuracy, according to published research conducted under calm, controlled conditions. A panicked parent is not operating under calm conditions. Recognizing a voice is no longer enough. Families need a second layer of verification that does not depend on how someone sounds. That is what Trust Onion provides: three private rotating codewords, calculated locally on each family member's phone, changing every 60 seconds. No server required. It works offline. When a call comes in claiming to be someone you love, one question settles it: "What are the words?" A real family member answers immediately. A scammer cannot know the words. An AI voice cannot fake them. They are never posted anywhere and never stored on a server that could be breached. A Trust Onion™ Proofie™, a passkey-signed selfie taken in the app, adds another layer: whoever holds the private key signs the exact photo, binding it to a moment in time, so family members can verify presence beyond a voice alone. Use the Trust Onion app to send, verify, and compare the full signing key against the person's public key in your shared group. Savi Security's real-time call monitoring has genuine value. Catching a scam while it is happening can stop money from moving. But it requires the app to be running, a live data connection, and a correct real-time identification, all meaningful dependencies when fear is already in the room. --- The Coughlin family's mother spent seconds in terror, hearing what she believed was her daughter's voice. Three codewords would have ended that call before the fear had time to take hold. If the caller cannot answer "What are the words?", you know right then, with no analysis required. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning can replicate a loved one's voice from as little as 20 to 30 seconds of audio found on social media or voicemail, making virtual kidnapping scams nearly impossible to detect by ear alone. - Phone scams cost Americans $1.77 billion in 2023 according to the FTC, and deepfake fraud attempts grew 500% in 2024, confirming AI-powered impersonation is a mainstream threat, not a rare edge case. - Scammers deliberately keep victims on the phone to prevent verification. A private family codeword system stops the con instantly, because a cloned voice cannot supply words it never had access to. ## Frequently asked questions ### How do virtual kidnapping scams using AI voice cloning work? Scammers clone a loved one's voice from a short audio clip, then call you playing that voice in distress. A fake captor demands payment and keeps you on the line so you cannot verify the situation. The entire call is designed to trigger fear before you can think clearly. ### How much audio does someone need to clone your voice? As little as 20 to 30 seconds of audio is enough to clone a voice convincingly. That clip can come from a voicemail, a TikTok, a podcast, or any public post where someone speaks. ### How common are AI voice cloning scams? Common enough to track. The FTC reported $1.77 billion lost to phone scams in 2023, with impersonation scams leading the category. The World Economic Forum found deepfake fraud attempts grew 500% in 2024. ### What should you do if you get a virtual kidnapping call? Hang up and immediately call the person the scammer claims to have, but note that a failed callback alone does not prove the original caller was legitimate. Use a private family codeword to verify real emergencies. Never wire money or send gift cards before confirming the situation through an independent channel. Alert authorities if someone may genuinely be in danger. ### Can AI voice scams happen to businesses too? Yes. In February 2024, engineering firm Arup lost $25 million after an employee joined a video call where every participant was a deepfake. AI scams target both individuals and organizations with increasing sophistication. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. AI can clone a voice, but it cannot fake words calculated locally on your family's phones. Trust Onion is free and takes minutes to set up. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Scams Surge 1,210%: It Only Takes 3 Seconds" published: 2026-07-06T00:03:18.708Z updated: 2026-10-11T06:12:59.297Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-scams-surge-1210-percent-three-seconds-audio --- # AI Voice Scams Surge 1,210%: It Only Takes 3 Seconds **Cite as:** AI Voice Scams Surge 1,210%: It Only Takes 3 Seconds, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-scams-surge-1210-percent-three-seconds-audio A parent picks up the phone and hears their son's voice, panicked, begging for $15,000 to avoid arrest. The voice is perfect. It was built from three seconds of audio pulled from a Facebook video. According to a June 2026 Fox News report citing cybersecurity researcher Kurt Knutsson, AI voice cloning scams surged 1,210% in 2025. The technology costs almost nothing, runs on a laptop, and needs just three seconds of audio to produce a convincing imitation of someone you love. That audio is already out there, in birthday videos, Instagram reels, and voicemails, waiting to be harvested. Scammers do not cold-call phone books. They research. Data brokers sell profiles listing names, addresses, relatives, and phone numbers. A scammer buys a profile, finds the target's son on social media, clips a few seconds of video, and feeds it to a cloning tool. The call that follows sounds exactly right, because the voice is real. The script is consistent. The cloned voice says it is in trouble, maybe an arrest, maybe an accident. It begs you not to tell anyone else. It says a lawyer needs $15,000 wired immediately. The manufactured panic is the point: it keeps the target reactive until the money moves. ## Why the Voice Convinces You Humans are wired to recognize the voices of people they love, and that recognition runs faster than conscious thought. When something sounds like your child in distress, your nervous system responds before your logic catches up. Researchers have found that human accuracy at detecting cloned voices hovers around 55 to 60 percent, barely better than a coin flip. The Fox News report notes that criminals use data broker profiles to map out family relationships, then source audio from social media to match a voice to a name. It is systematic, scalable, and getting faster. Public social media profiles are an open audio library. TikToks, Facebook videos, YouTube clips, even forwarded voice notes: any audio online is potentially harvestable. Privatizing your accounts is worth doing, but voicemails exist, old public posts exist, and the threshold keeps dropping. Three seconds today might be one second tomorrow. --- ## What Actually Stops It The Fox News article lists several defenses: family code words, callback rules, reduced social media exposure. Code words are the most powerful because an AI can clone a voice in three seconds, but it cannot clone knowledge that exists only inside your family's heads. Trust Onion gives every family three rotating codewords that change every 60 seconds, calculated locally on your phone with no server involved. When a call comes in from someone claiming to be your son, you ask one question: "What are the words?" A scammer cannot guess them. They were not in any Facebook video, any data broker profile, or any voicemail. If you do hang up to call back on a number you already have, remember that a completed callback does not prove the original caller was legitimate. The person who answers must still know the family's private codewords. Trust Onion also supports Proofie™, a selfie signed by your passkey the moment you take it. The signature binds your full public key to the exact original photo, the date, time, and location in the signed record. Verification checks that signature against your public key in your shared family group. A valid Proofie establishes that whoever created it possessed the private key at that moment; it does not guarantee physical presence if a key is compromised. Codewords work alongside Proofies, not as part of a Proofie's signed payload. The scam script is engineered to make you act before you think. One question with an answer only your real family member can give breaks that loop before the money moves. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Voice cloning scams surged 1,210% in 2025 because the technology now requires just three seconds of audio and costs almost nothing to use. - Human ability to detect cloned voices is only 55 to 60 percent accurate, meaning instincts alone cannot reliably protect you from a convincing imitation. - Scammers research targets using data broker profiles and harvest voice samples from public social media before calling a relative with a scripted crisis demanding immediate money. ## Frequently asked questions ### How little audio does it take to clone someone's voice? As little as three seconds of audio is enough for modern voice cloning tools to generate a convincing imitation. Scammers can pull this from a social media video, a voicemail, or any publicly available clip featuring the target's voice. ### How do AI voice scams work? Scammers buy personal data from data brokers, find a family member on social media, and clone their voice from a short clip. They then call a relative pretending to be in crisis and demand emergency money wired immediately, using panic to prevent verification. ### Can you tell if a voice on the phone is AI generated? Not reliably. Research shows people correctly identify cloned voices only 55 to 60 percent of the time, barely better than guessing. If you receive a panicked call requesting money, hang up and call the person directly using a number you already have, then ask for the family codewords. ### Are social media videos a risk for voice cloning scams? Yes. Public videos on TikTok, Instagram, Facebook, and YouTube give scammers free access to voice samples. Any audio featuring a family member that is publicly accessible online can potentially be harvested and used to clone that person's voice. ### How can I protect my family from AI voice scams? Set a family code word that anyone can use to verify identity during a suspicious call. Limit public audio on social media, opt out of data broker listings, and always hang up to call back directly on a known number before sending any money. The person who answers must still know the codewords. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. AI can clone a voice in three seconds, but it cannot fake words that exist only on your family's phones. Trust Onion is free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Fake Cop Calls Are Draining Bank Accounts in South Carolina" published: 2026-07-03T15:43:38.724Z updated: 2026-10-11T06:12:59.300Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/fake-cop-calls-police-impersonation-scam-beaufort-county --- # Fake Cop Calls Are Draining Bank Accounts in South Carolina **Cite as:** Fake Cop Calls Are Draining Bank Accounts in South Carolina, Trust Onion, 2026-10-11. https://trustonion.io/blog/fake-cop-calls-police-impersonation-scam-beaufort-county In February 2024, the Beaufort County Sheriff's Office went public after multiple residents each lost thousands of dollars to callers who claimed to be deputies, cited badge numbers, and demanded immediate payment to cancel a fake arrest warrant. The caller had a name, a title, and a case number. You missed jury duty, the voice said. There's a warrant out for your arrest. Pay now or officers will be at your door. That call was a scam, and it cost real people real money. The Beaufort County Sheriff's Office issued a public warning in February 2024 after the scheme resurfaced and multiple residents lost thousands of dollars per incident. The FTC reported that Americans lost over $1.3 billion to impersonation scams in 2023, and the FBI's Internet Crime Complaint Center consistently ranks government impersonation among the top fraud categories by victim loss. This scam keeps coming back because it keeps working. The mechanics are straightforward. Spoofing a phone number costs almost nothing, so the caller ID on your screen can show the Beaufort County Sheriff's Office main line while the person speaking calls from anywhere in the world. A familiar local number gets answered. A plausible story about an outstanding warrant, combined with the threat of immediate arrest, creates enough pressure that some people pay before they think to question any of it. No legitimate law enforcement agency demands payment by phone, in gift cards or wire transfer, but that fact is easy to lose in a frightening moment. Scammers make the moment more frightening on purpose. They tell victims not to hang up and say that involving anyone else will make things worse. Cutting someone off from the people who could help them think clearly gives the scam a much better chance of working. --- The scam often runs a second act. After the initial call rattles someone, a follow-up arrives from someone claiming to be a family member in trouble, a lawyer who can help, or a witness to an arrest. That is the moment a private verification challenge matters most. Trust Onion gives families three codewords that rotate every 60 seconds, calculated locally on the phone with no server required. When a call comes in from someone claiming to be a son, a bank, a government agency, or anyone else you are supposed to trust, one question cuts through it: "What are the words?" A real person in your circle knows them. A scammer, no matter how official the caller ID looks or how convincing the voice sounds, does not. AI can now clone a voice from a short audio clip. It cannot know three codewords that rotate on a schedule and never leave the authorized devices. If you call back to verify, use a number you find yourself from an official source, not one the caller gave you. A completed callback does not prove the original caller was legitimate; someone in your family or circle must still know the private codewords. That check answers the real question: is this really who they say they are? The Beaufort County Sheriff's Office reminded residents after the February 2024 incidents that real deputies do not demand payment by phone, and real agencies do not threaten arrest unless you pay within the hour. If a call like that comes in, hang up. Report it to the FTC at ReportFraud.ftc.gov and to the FBI's IC3 at ic3.gov, and alert your local police so they can warn others. Courts notify people about jury duty by mail. Warrants involve paperwork, not gift cards. The moment a caller demands immediate phone payment to cancel an arrest, the script is already written, and it was never written by law enforcement. ## Key takeaways - Scammers spoof real police department phone numbers so caller ID shows a legitimate local number, making fake law enforcement calls appear credible. - No real law enforcement agency will ever demand immediate payment by phone using gift cards or wire transfers, and that demand alone confirms a scam. - Americans lost over $1.3 billion to impersonation scams in 2023, making government impersonation one of the costliest fraud categories tracked by the FTC and FBI. ## Frequently asked questions ### How can I tell if a police call is a scam? Legitimate police never demand immediate phone payment by gift card or wire transfer. If a caller pressures you to pay now to avoid arrest, hang up. Call your local police department directly using a number you look up yourself to verify any claimed warrant or fine. ### Can scammers really fake a police department phone number? Yes. Phone number spoofing is cheap and easy. A scammer anywhere in the world can make your caller ID display a real local police department number. Seeing a familiar number on your screen does not confirm who is actually calling you. ### What should I do if I get a fake cop call? Hang up immediately. Do not provide personal information, banking details, or payment of any kind. Report the call to the FTC at ReportFraud.ftc.gov and file a complaint with the FBI's IC3 at ic3.gov. Alert your local police department so they can warn others. ### What is the jury duty scam phone call? Callers claim you missed jury duty and have an active warrant, then demand immediate payment by gift card or wire transfer to cancel the arrest. This is a scam. Courts contact people about jury duty by mail, not by phone, and never request payment to resolve a missed appearance. ### How do I protect an elderly parent from police impersonation scams? Set up a private codeword so family members can verify real emergencies. Remind elderly relatives that real law enforcement never demands phone payments. Encourage them to hang up on any pressuring caller and contact you or the police directly, using a number from an official source, before taking any action. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords add a check beyond a familiar voice, caller ID, or message. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "He Heard His Son's Voice. It Was AI. It Cost Him $15,000." published: 2026-07-03T00:05:21.410Z updated: 2026-10-18T05:19:21.798Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-clone-scam-houston-man-loses-15000 --- # He Heard His Son's Voice. It Was AI. It Cost Him $15,000. **Cite as:** He Heard His Son's Voice. It Was AI. It Cost Him $15,000., Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-voice-clone-scam-houston-man-loses-15000 A 71-year-old Houston man heard his son's voice on the phone, scared, in tears, saying he'd been arrested for DUI after hitting a pregnant woman. He sent $15,000 in cryptocurrency. His son had never been arrested. The voice was AI. The second person on the line introduced himself as a public defender. He was calm, authoritative, and had a plan: $15,000 in bond money, paid via cryptocurrency, right now. The Houston man followed the instructions. He was trying to help his kid. When he reached his actual son, the truth arrived fast. His son was fine, knew nothing about any of it. The entire call had been built on a cloned voice and a rehearsed script. The Houston man is now speaking out publicly so other parents understand this can happen to anyone. ## The Technology Behind the Call AI voice cloning tools can replicate a person's voice from as little as 20 to 30 seconds of audio, a voicemail, a YouTube clip, a social media video. Scammers feed that sample into a cloning tool and get a voice they can make say anything. The result carries the cadence, the tone, the small vocal quirks that make a voice recognizable. A parent who has known their child's voice for decades can still be fooled. That is not a failure of intelligence or love. The tools for deception got better, and the tools for verification did not keep up. What happened to the Houston man is a version of what law enforcement calls the grandparent scam: an older adult gets a call from a family member who sounds desperate and needs money fast, secretly. The AI layer makes it far more convincing. According to the FBI, Americans lost more than $948 million to impersonation scams in 2023, and that number has climbed every year as these tools have become cheaper and easier to access. --- Every detail of this scam is designed to prevent clear thinking. The urgency is manufactured. The secrecy is manufactured, don't tell anyone, it will only make things worse. Cryptocurrency is chosen because those transactions are fast, hard to trace, and almost impossible to reverse. By the time the Houston man reached his son and understood what had happened, the money was gone. Authorities advise hanging up and calling your family member directly on a number you already have saved, not a number the caller provides. That advice is sound, but a successful callback does not prove the original caller was legitimate. The callback works because it bypasses the scammer entirely. The harder problem is pausing long enough to make that call when someone who sounds like your child is frightened on the other end of the line. ## What Three Codewords Would Have Changed Trust Onion is a free app that gives families a shared set of three rotating codewords, calculated locally on each phone with no server involved. The words change every 60 seconds. When a call arrives claiming to be a family member, you ask one question: "What are the words?" If the caller cannot answer, the call ends. A cloned voice cannot know codewords that exist only on your family's phones, rotating on a schedule, never transmitted over any network a scammer can intercept. For added verification, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. The signature covers the photo's exact content, the time, and location, so anyone can check that a specific person's key signed that exact image after a known moment, and that nothing has changed since. Codewords and Proofies work alongside each other. The Houston man chose to go public with his story. Many people who lose money to scams like this feel embarrassed, though they have nothing to be embarrassed about. These scams are engineered to exploit the deepest instinct a parent has: protect the people you love. Three rotating words, agreed on in advance, would have ended that $15,000 call in seconds. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning tools can replicate a person's voice from as little as 20 to 30 seconds of publicly available audio, making a cloned voice indistinguishable from the real thing even to a parent. - According to the FBI, Americans lost more than $948 million to impersonation scams in 2023, and losses continue to rise as AI voice cloning tools become cheaper and easier to access. - Scammers deliberately manufacture urgency and demand untraceable cryptocurrency payments to stop victims from pausing to verify. A shared family codeword creates that pause before any call arrives. ## Frequently asked questions ### What is an AI voice cloning scam? An AI voice cloning scam uses artificial intelligence to replicate a real person's voice from a short audio sample. Scammers use the cloned voice to impersonate a family member in distress and pressure victims into sending money quickly. ### How do scammers clone someone's voice? Scammers pull audio from voicemails, social media videos, podcasts, or YouTube clips. As little as 20 to 30 seconds of audio is enough for AI tools to recreate a person's tone, cadence, and vocal patterns convincingly. ### How can I protect myself from a grandparent or family emergency scam? Hang up and call your family member on a number you already have saved, not one the caller provides. Agree on a family codeword in advance and ask "What are the words?" before acting. Never send cryptocurrency based on a phone call alone, no matter how urgent it sounds. ### Why do scammers ask for cryptocurrency in emergency scams? Cryptocurrency transactions are fast, difficult to trace, and nearly impossible to reverse. Scammers choose this method specifically because victims cannot recover funds once the transfer is complete. ### How much money do Americans lose to impersonation scams each year? According to the FBI, Americans lost more than $948 million to impersonation scams in 2023. That figure has increased every year as AI voice cloning tools have become cheaper and easier for scammers to access. ## More from Trust Onion Help a parent or grandparent verify unexpected calls with three rotating codewords. If the caller can't answer "What are the words?", the call ends. Trust Onion is free and takes about two minutes to set up with the people you love. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Scams Surged 1,210% , Your Family Needs a Plan" published: 2026-07-02T21:43:59.926Z updated: 2026-10-11T06:13:00.289Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-scams-clone-family-voice-1210-percent --- # AI Voice Scams Surged 1,210% , Your Family Needs a Plan **Cite as:** AI Voice Scams Surged 1,210% , Your Family Needs a Plan, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-scams-clone-family-voice-1210-percent Your phone rings and it's your son's voice, shaking, telling you he's been in a car accident and needs $15,000 wired right now. It isn't your son. It's a three-second clip of his voice, pulled from a social media video and run through an AI voice cloner. According to Fox News, AI voice scams surged 1,210% in 2025. Scammers need three seconds of audio, sometimes less. Before the call, scammers scrape data broker profiles for a family member's name, phone number, address, and relationships. Then they find audio: a birthday video on Instagram, a voicemail greeting, a TikTok clip. The AI clones the voice, pitch and cadence included. Then they call you. The scenario is almost always urgent. A car accident. An arrest. A hospital. Something that triggers the part of your brain that wants to help before you stop to think. Researchers have found that people detect cloned audio correctly only 55 to 60 percent of the time, essentially a coin flip. You cannot trust your ear. ## How the Scam Plays Out A parent gets a call from what sounds like their son. He's crying, scared, says he rear-ended someone and the other driver is threatening to call police unless he pays $15,000 in cash or wire transfer right now. He begs them not to call back because his phone is broken or being held by someone. Then a second person gets on the line, playing a lawyer or a police officer, confirms the story, applies pressure, and offers wire instructions. The real son, at home or at work, has no idea any of it happened. The Federal Trade Commission reported that imposter scams cost Americans $2.7 billion in 2023 alone. Voice cloning pushes that number higher because the tools are free or nearly free. ## Why "Call Him Back" Isn't Enough Fox News recommends callback rules as a defense, and that's good advice. But scammers anticipate it. They tell you the phone is broken, dead, or confiscated. A callback is a good instinct, but it depends on the other person answering, and scammers are good at closing that door before you think to open it. A failed callback also does not prove the original caller was legitimate. You need a verification method that holds even when the scammer is actively trying to stop you from verifying. Fox News also recommends limiting public audio and video on social media, and that's wise. But voicemail greetings are public by default. Old videos may have been downloaded before you locked your account. One public post from a friend who tagged you can expose audio you didn't know was out there. Privacy settings are a layer of protection, not a complete solution. Buried in the Fox News piece is the advice that actually stops this scam: establish a family code word. A cloned voice can sound exactly like your child, but it cannot know a secret word your family agreed on privately. The AI has nothing to clone. The data broker profile doesn't include it. Trust Onion takes that idea further. Instead of a single static code word that could eventually be overheard or guessed, the free Trust Onion app gives your family three rotating codewords that change every 60 seconds, calculated locally on your phone with no server required. When a call comes in, you ask: "What are the words?" A real family member knows them. A scammer, no matter how convincing the voice clone sounds, cannot answer. The words rotate every 60 seconds, so even if words were somehow compromised, they expire before they can be used. Talk to your family about this threat and set up a verification plan before anyone picks up the phone. Review what audio is publicly accessible, lock down social media profiles, and consider changing voicemail greetings. Scammers count on urgency overriding your judgment. The moment your family has a shared answer to "What are the words?", that urgency has nowhere to go. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning scams surged 1,210% in 2025, and scammers need as little as three seconds of audio pulled from social media or voicemail to clone a loved one's voice convincingly. - People detect cloned audio correctly only 55 to 60 percent of the time, so trusting your ear alone is not a reliable defense, and a failed callback does not prove the original caller was legitimate. - Imposter scams cost Americans $2.7 billion in 2023 alone, and a pre-agreed family code word is the most reliable way to expose a voice clone scam even when the scammer is actively blocking callbacks. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers collect a few seconds of your family member's voice from social media or voicemails, use AI tools to clone it, then call pretending to be that person in a crisis. They pair the familiar voice with urgent scenarios like accidents or arrests to pressure you into sending money quickly. ### Can you tell if a voice on the phone is AI generated? Not reliably. Research shows people detect cloned audio correctly only 55 to 60 percent of the time, barely better than guessing. Never rely on your ear alone to verify a caller's identity during a high-pressure situation. ### What is a family safe word and how does it stop voice scams? A family safe word is a pre-agreed secret phrase only your household knows. If someone calls claiming to be a family member in trouble, you ask for the word. A scammer cannot provide it, exposing the fraud even when the voice sounds completely real. ### Why doesn't calling your family member back protect you from voice cloning scams? Scammers anticipate callbacks and tell victims the phone is broken, dead, or confiscated, creating time pressure to discourage verification. A failed callback also does not prove the original caller was legitimate. A code word works even when the scammer is actively blocking your ability to verify. ### How do scammers get enough voice audio to clone someone? They only need three seconds or less. Common sources include Instagram videos, TikTok clips, YouTube content, and voicemail greetings. Any publicly accessible audio where someone speaks naturally is enough for modern AI cloning tools to replicate pitch, tone, and cadence. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. AI can clone a voice, but it cannot fake words that only your family knows, and Trust Onion is completely free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "1 in 3 People Got a Fake AI Voice Call Last Year" published: 2026-07-02T21:32:53.409Z updated: 2026-10-11T06:13:00.657Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/1-in-3-people-received-ai-deepfake-phone-call-2026 --- # 1 in 3 People Got a Fake AI Voice Call Last Year **Cite as:** 1 in 3 People Got a Fake AI Voice Call Last Year, Trust Onion, 2026-10-11. https://trustonion.io/blog/1-in-3-people-received-ai-deepfake-phone-call-2026 Nearly one in three people worldwide received a phone call last year where the voice was AI-generated, designed to sound like someone they trusted. A 2026 report by call-protection company Hiya found that 1 in 12 Americans lost money to a phone scam, with an average loss of $682. The numbers from Hiya's 2026 global report are blunt. Nearly 1 in 3 consumers worldwide received an AI deepfake phone call in the past year. In the U.S., the average person fields 10 unwanted calls per week, and 1 in 12 Americans lost money to a phone scam, with an average loss of $682. On top of those losses, 34% of consumers globally said their trust in phone calls declined over the past year. That erosion has a second cost. People stop answering. They miss calls from doctors, schools, and family members in genuine emergencies. Scammers win twice: once when they take money, and again when they make everyone afraid to pick up. ## Why Your Ears Can No Longer Save You Voice cloning no longer requires sophisticated equipment or weeks of training data. Modern AI tools can replicate a person's voice from as little as 20 to 30 seconds of audio pulled from a voicemail, a short video, or a social media clip. Once cloned, that voice can say anything. Human ability to detect synthetic audio is genuinely limited. Research puts accuracy at around 55 to 60 percent under controlled conditions, barely better than a coin flip, and that is before emotional pressure enters the picture. When the voice sounds like your child or your parent, asking yourself "does this sound like them?" is no longer a reliable test. Scammers design their attacks around exactly that vulnerability. The classic grandparent scam has run for years on urgency and love: a caller claims to be a grandchild in crisis, asks for bail money or emergency funds, and pleads for secrecy. AI voice cloning made it worse. Now the caller doesn't just claim to be a grandchild. They sound like one. Families have wired thousands of dollars before thinking to call back on a known number. By then, the money is gone. The problem is not gullibility. The problem is that the tool people have always used to verify identity, the voice itself, has been compromised. --- ## A Check That Doesn't Rely on Sound Calling back on a known number helps, though it takes presence of mind when you are scared, and a failed callback does not prove the original caller was legitimate. Security and fraud teams face the same pressure on the business side: AI-generated voices are already being used to impersonate executives and push through fraudulent wire transfers. What individuals, families, and teams need is something simple, shared, and impossible for a scammer to know. Trust Onion is a free app that gives people a shared set of three rotating codewords, calculated locally on each device with no server required, working offline. When a call comes in from someone claiming to be a family member or a colleague, one question settles it: "What are the words?" AI can clone a voice in seconds. It cannot know three codewords rotating on a private schedule that never touch a central server. For higher-stakes business requests, the same three-word challenge works as a practical second factor before approving a wire transfer or a vendor change. The Hiya report makes clear that AI voice scams are widespread and already costing American consumers an average of $682 per incident. The voice might be convincing. The urgency might feel real. But the words are the one thing a cloned voice cannot borrow. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Nearly 1 in 3 people worldwide received an AI deepfake voice call in the past year, and 1 in 12 Americans lost money to a phone scam, with an average loss of $682. - AI tools can clone a person's voice from as little as 20 to 30 seconds of audio, and humans detect synthetic audio correctly only about 55 to 60 percent of the time, making ears an unreliable defense. - The grandparent scam and executive impersonation fraud have both grown more dangerous because AI-generated voices can now sound exactly like a real family member or colleague, removing the one cue people relied on to spot a fake. ## Frequently asked questions ### How common are AI voice scam calls? Very common. A 2026 report by Hiya found nearly 1 in 3 consumers globally received an AI deepfake phone call in the past year. In the U.S., 1 in 12 Americans lost money to a phone scam, with an average loss of $682. ### How do scammers clone someone's voice for a scam call? Scammers use AI tools that can replicate a voice from as little as 20 to 30 seconds of audio, sourced from a voicemail, a YouTube video, or a social media clip. Once cloned, the voice can be made to say anything. ### Can you tell if a phone call is using an AI-generated voice? Not reliably. Research shows humans detect synthetic audio correctly only about 55 to 60 percent of the time under controlled conditions. Emotional pressure, like hearing a voice that sounds like a family member, makes accurate detection even harder. ### What is the grandparent scam and how does AI make it worse? The grandparent scam involves a caller pretending to be a grandchild in crisis and asking for emergency money. AI voice cloning now lets scammers sound exactly like the real grandchild, making the scam far more convincing and harder to question in the moment. ### What should you do if you get a suspicious call from a family member asking for money? Hang up and call the person back using a number you already have saved. Do not use any number the caller provides. Note that a failed callback does not prove the original caller was legitimate. A shared private codeword, unknown to any scammer, adds a reliable second check. ## More from Trust Onion See how Trust Onion gives people and teams a practical way to verify identity. Explore Trust Onion Free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Bay Area Mom Wired $5,400 Before One Call Ended the Scam" published: 2026-05-26T17:25:30.854Z updated: 2026-10-18T05:19:34.645Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/bay-area-mom-ai-voice-clone-fake-kidnapping-scam --- # Bay Area Mom Wired $5,400 Before One Call Ended the Scam **Cite as:** Bay Area Mom Wired $5,400 Before One Call Ended the Scam, Trust Onion, 2026-10-18. https://trustonion.io/blog/bay-area-mom-ai-voice-clone-fake-kidnapping-scam A Bay Area mom wired $5,400 to Mexico over roughly five hours before she made the one call that ended everything. Her daughter was at work, safe, and had no idea any of it had happened. The voice on the phone sounded exactly like her 37-year-old daughter. It said she had been kidnapped by a Mexican drug cartel. The scammers kept the Bay Area mom on the line, escalating the fear, feeding her instructions: wire money to Mexico, don't hang up, don't call anyone. Every second she stayed on that call was a second she wasn't calling her daughter to find out she was fine. That is the design. By the time she finally did call, $5,400 was gone. The Bay Area mom is not naive. She is a mother who heard what sounded like her daughter in distress and did what any parent would do. The technology is the problem. According to Operation Shamrock, the law enforcement effort tracking these scams, AI-assisted virtual kidnapping fraud is growing fast, and the FBI has issued repeated warnings about it. ## How the Formula Works Voice cloning now requires only seconds of audio. A voicemail. A birthday video on Instagram. That is enough for the tools available today to generate a convincing replica. The scammer doesn't need to sound like the person themselves; the software handles that. They manage the emotional pressure while the fake voice plays. The formula is consistent. They find a target, usually a parent. They scrape audio of a family member from social media or voicemail. They generate a cloned voice clip, play it early in the conversation, then take over to demand payment. They tell you not to call police. They tell you not to hang up. Fear short-circuits the instinct to simply call your child back. When you believe someone you love is in danger, your brain is not running a calm cost-benefit analysis. Scammers are trained to keep you in that state. The Bay Area mom's case is not unusual. It is a template. --- There is a moment early in every one of these calls where everything could change. You pick up. You hear the voice. Your stomach drops. Right there, in the first thirty seconds, a window exists. Without a way to verify who you're actually talking to, that window closes fast. ## The Question That Closes the Window Trust Onion gives families three rotating codewords that change every 60 seconds. If someone calls claiming to be your daughter, you ask: "What are the words?" A real voice clone can match tone, cadence, even the little laugh your daughter always does. It cannot know three codewords generated locally on your phone, never stored on a server, never posted anywhere, never captured in any recorded audio. If the caller can't answer, the call is over. Not after five hours. In seconds. Because the words rotate every 60 seconds, even someone who overheard them moments ago couldn't use them now. If you receive a call like this, hang up and call your family member directly on a number you already have saved. A successful callback confirms your family member is safe, but a failed callback does not prove the original caller was legitimate; use a number from your own contacts, not one the caller provides. Report the incident to the FBI's Internet Crime Complaint Center at ic3.gov and your local police. Operation Shamrock and similar task forces are actively tracking these networks, and every report matters. The Bay Area mom spent five hours and $5,400 before she made the one call that broke the scam. One question could have made that five seconds. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning requires only seconds of audio from social media or voicemail to generate a convincing fake of a family member's voice. - Virtual kidnapping scammers deliberately keep victims on the line to prevent the one call that would expose the fraud, and fear, not carelessness, is what they exploit. - AI-assisted virtual kidnapping fraud is flagged repeatedly by the FBI and tracked by law enforcement operations like Operation Shamrock. ## Frequently asked questions ### What is an AI voice cloning scam? AI voice cloning software replicates a real person's voice from a short audio clip, often pulled from social media. Scammers play the fake voice to convince a parent their family member is in danger, then demand money before the victim can verify the truth. ### How do virtual kidnapping scammers find their targets? Scammers target parents, scraping audio of a family member from public social media posts, voicemails, or videos to feed the cloning software. The target is chosen because of their emotional connection to the person whose voice gets cloned. ### What should you do if you get a virtual kidnapping call? Hang up and call your family member directly on a number you already have saved. Do not wire money or follow instructions to avoid calling police. A failed callback does not prove the original caller was legitimate. Report the incident to the FBI's Internet Crime Complaint Center at ic3.gov. ### How much money do people lose to AI voice cloning scams? Losses vary, but victims frequently wire thousands of dollars before discovering the fraud. In one documented Bay Area case, a mother sent $5,400 in a single call. Because funds are wired internationally, recovery is extremely difficult once the money is sent. ### Can you tell the difference between a real voice and an AI cloned voice on a phone call? In many cases, no. Modern voice cloning tools produce highly convincing replicas from just seconds of audio. On a call with emotional stress and background noise, distinguishing a cloned voice from a real one is very difficult, which is why a separate verification method matters. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. No AI voice clone can answer "What are the words?" , set up your family group free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Deepfake Scam Calls Are Surging. Here's How to Stop Them." published: 2026-05-15T00:03:39.502Z updated: 2026-10-11T06:13:01.166Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/deepfake-scam-calls-summer-surge-2026 --- # Deepfake Scam Calls Are Surging. Here's How to Stop Them. **Cite as:** Deepfake Scam Calls Are Surging. Here's How to Stop Them., Trust Onion, 2026-10-11. https://trustonion.io/blog/deepfake-scam-calls-summer-surge-2026 Americans lost $12.5 billion to scams in 2024, and the average victim of a scam call lost $1,500. According to experts quoted by CW33 in May 2026, a seasonal summer surge in AI-powered deepfake calls is already underway. Voice cloning now requires just 20 to 30 seconds of audio. A short voicemail, a quick social media video, a clip from a family call recorded months ago is enough for a criminal to generate a convincing imitation of someone's voice, close enough that most people cannot tell the difference in real time. Scammers use these tools to impersonate airlines, hotels, banks, and travel agents. They call during a trip, when people are out of routine and more likely to panic. They call parents when the person being impersonated is unreachable. The urgency is manufactured, the voice is fake, and the pressure is real. ## How the Scam Works The setup varies, but the shape is almost always the same. A call arrives. The voice sounds familiar, or official, or both. There is a problem that needs solving right now, money to send, information to provide, something to approve before the window closes. Experts point to a few tells: strange pauses between words, a slightly flat tone, and relentless pressure to act immediately. But these tells are getting harder to spot as the tools improve. Newer voice cloning models produce more natural cadence and more realistic emotional tone, so audio-detection advice will be even less reliable by next summer than it is today. The more dangerous version does not target you directly. It targets someone you love. Your mother gets a call. The voice sounds exactly like yours. It says you have been in an accident, or arrested, or robbed abroad, and that money must be wired immediately without telling anyone else. The Federal Trade Commission has documented cases where elderly victims sent thousands of dollars before anyone in the family knew the call had happened. --- Summer travel season makes all of this worse. People are away from home, out of routine, and more likely to get an unexpected call about a delayed flight, a frozen card, or a family member in distress. Scammers know exactly which moment to exploit. ## A Check That Does Not Depend on Your Ear The advice going around is to listen for AI voice tells. That advice is not wrong, but it puts the entire burden on the person receiving the call, in real time, while they are scared. That is a hard test to pass. Trust Onion is a free app that gives people a private set of three rotating codewords to share with anyone they want to verify: people they know, or institutions they have pre-registered a challenge with. The words rotate every 60 seconds, calculated locally on each device with no server involved. When someone calls claiming to be a person you know, a bank, or another trusted institution, you ask one question: "What are the words?" If the caller cannot answer, the call is over. An AI can clone a voice. It cannot know three codewords rotating on a private schedule that live only on authorized devices. The words expire automatically, so stolen words become useless within seconds. For added visual verification, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. Use the app to send and verify Proofies, compare the signing key against the person's full public key in your shared group, and check that the exact original photo has not changed since it was signed. Codewords work alongside Proofies, not as an overlay or signed field. Set this up now, when everyone is calm and the stakes are low. Talk to the people in your life and decide on a plan before the call comes. The caller sounded exactly like her child. By the time she realized it did not matter, the money was gone. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Voice cloning technology can replicate someone's voice using just 20 to 30 seconds of audio, making deepfake scam calls highly convincing. - Americans lost $12.5 billion to scams in 2024, with victims of scam calls losing an average of $1,500 per incident. - Relying on your ear alone to detect fake voices is not a reliable defense, especially as cloning tools continue to improve, making a private codeword challenge a more dependable verification method. ## Frequently asked questions ### How little audio does someone need to clone your voice? As little as 20 to 30 seconds of audio is enough to clone a convincing imitation of someone's voice. This audio can come from a voicemail, a social media video, or a recorded phone call. ### How do deepfake scam calls work? Scammers use AI-cloned voices to impersonate a family member or official organization. They manufacture an urgent problem, such as an arrest or frozen account, and pressure the victim to send money or share personal information immediately before thinking it through. ### What are the warning signs of an AI voice scam call? Common tells include unnatural pauses between words, a slightly flat or emotionless tone, and intense pressure to act immediately. However, newer voice cloning tools are making these signs harder to detect, so listening alone is not a reliable defense. ### How much money do people lose to deepfake scam calls? Victims lost an average of $1,500 per incident in 2024. In family impersonation scams, some victims sent thousands of dollars before realizing the call was fraudulent. ### Why are deepfake scam calls worse during summer travel season? Travelers are away from home, out of their normal routine, and more likely to receive unexpected calls about emergencies. Scammers exploit this disruption to manufacture urgency around delayed flights, frozen cards, or family members in distress. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. The private three-word challenge adds a check beyond a familiar voice, caller ID, or message. --- title: "AI Cloned His Daughter's Voice. He Almost Paid." published: 2026-05-05T12:01:29.463Z updated: 2026-10-11T06:13:01.636Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-cloned-daughters-voice-extort-vancouver-man --- # AI Cloned His Daughter's Voice. He Almost Paid. **Cite as:** AI Cloned His Daughter's Voice. He Almost Paid., Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-cloned-daughters-voice-extort-vancouver-man A Vancouver man picked up the phone and heard his daughter's voice, crying, panicked, and begging for money. It wasn't her. Scammers had cloned her voice using AI, and they nearly pulled it off. The call came in exactly the way security researchers have been warning about. Reported by KGW out of Portland, the case involved a man in Vancouver, Washington who heard what sounded like his daughter in distress. The scammers followed with a demand for money. He didn't send it, but the call shook him. This is the virtual kidnapping scam, now upgraded with AI voice cloning. Scammers used to coach someone to scream in the background. Now they skip that step entirely. ## How Little Audio It Takes Voice cloning used to require hours of audio and expensive software. Today, publicly available tools can generate a convincing clone from as little as 20 to 30 seconds of audio: a short Instagram reel, a TikTok, a voicemail, a graduation speech posted on Facebook. The cloned voice can say anything the scammer types. It can cry, plead, say "Dad, please, I need you." Researchers at the University of London found that human detection accuracy for AI-generated audio hovers around 55 to 60 percent. That's barely better than a coin flip, and our ears are no longer reliable detectors. Scammers target parents because the emotional stakes are as high as they get. The script is always fast and urgent: "I was in a car accident." "I got arrested." "I'm being held." "Don't call anyone else, just send money now." The urgency is designed to prevent any pause long enough to think. The Federal Trade Commission reported that Americans lost $2.7 billion to imposter scams in 2023, and the FTC has explicitly warned that AI tools are making these calls harder to detect and easier to run at scale. KGW noted that AI experts who reviewed the Vancouver case said the technology is accessible and the barrier to entry is low. The same call is being placed in Phoenix, Atlanta, Minneapolis, and small towns that never make the news. ## The One Thing They Cannot Fake Every one of these scams shares the same weakness: the caller cannot know something they were never told. Scammers can clone a voice, fake a phone number, and invent a story. What they cannot do is produce a piece of information a family agreed on privately and never posted online. That's where Trust Onion's three rotating codewords come in. When a suspicious call arrives, you ask: "What are the words?" If the caller can't answer, the call ends there. A note on callbacks: hanging up and calling your child back on a known number is a sensible first step, but a successful callback does not prove the original caller was legitimate. The caller must still know your family's private Trust Onion Three Words. Picture the Vancouver call with a codeword in place. Phone rings. Panicked voice, sounds like your daughter. "Dad, I need help." You say: "What are the words?" Silence. Or a wrong answer. The scam collapses in three seconds. If it really is your daughter, she knows the words. She says them. You help her. Families who survive these calls without losing money almost always have one thing in common: they paused. They introduced some friction into a call designed to eliminate friction. Three rotating codewords formalize that pause, turning "something feels off" into a concrete, answerable test. Trust Onion also offers Proofie™, a selfie signed by your passkey the moment you take it. Use the Trust Onion app to send, receive, and verify Proofies; verification checks the passkey signature against the full public key, the original photo's SHA-256 hash, and the signed record, including time and What3Words location. Compare the verified full signing key with the person's public key in your shared Trust Onion group, because the shortened key label alone is not an identity check. The Vancouver man's instincts told him something was wrong, and that instinct saved him. But instinct isn't a system. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning tools can generate a convincing fake voice from as little as 20 to 30 seconds of publicly available audio, such as a social media video or voicemail. - Humans correctly identify AI-generated audio only 55 to 60 percent of the time, making your ears an unreliable defense against a cloned voice. - Every voice cloning scam shares one weakness: the caller cannot produce a private piece of information your family agreed on in advance, which is exactly what a rotating family codeword exploits. ## Frequently asked questions ### How do scammers clone a family member's voice for a kidnapping scam? Scammers use AI tools that need as little as 20 to 30 seconds of audio, pulled from public social media posts, voicemails, or videos. The cloned voice can then say anything the scammer types, including emotional pleas like "Dad, please, I need you," designed to pressure you into sending money immediately. ### Can you tell if a phone call is using an AI cloned voice? Usually not reliably. Research from the University of London found people correctly identify AI-generated audio only 55 to 60 percent of the time, barely better than guessing. Do not rely on how a voice sounds to verify whether a distress call is real. ### What should I do if I get a call saying my child is in danger? Stay calm and ask a verification question only your real family member could answer. Do not send money before confirming identity. Calling back on a known number is sensible, but a successful callback does not prove the original caller was legitimate. Your child must still know your family's private codewords. ### How much money do Americans lose to AI voice scams each year? The FTC reported Americans lost $2.7 billion to imposter scams in 2023. AI voice cloning is accelerating that number by making fake calls harder to detect and easier to run at scale. The FTC has issued explicit warnings about AI tools lowering the barrier for this type of fraud. ### What is a family codeword and how does it stop voice cloning scams? A family codeword is a private word or phrase agreed on in advance and never shared publicly. When someone calls claiming to be a loved one in distress, you ask "What are the words?" Scammers cannot produce the answer because they were never told it, which immediately exposes the call as fake. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. When a suspicious call comes in, just ask: "What are the words?" AI can clone a voice, but it cannot fake codewords calculated privately on your family's devices. Trust Onion is free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Connecticut Lost $16.1 Million to AI Scams in 2025" published: 2026-05-02T00:04:57.343Z updated: 2026-10-11T06:13:02.013Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/connecticut-lost-16-million-ai-scams-2025 --- # Connecticut Lost $16.1 Million to AI Scams in 2025 **Cite as:** Connecticut Lost $16.1 Million to AI Scams in 2025, Trust Onion, 2026-10-11. https://trustonion.io/blog/connecticut-lost-16-million-ai-scams-2025 Connecticut residents lost $16.1 million to AI-powered scams in 2025, the highest per-capita loss of any state in the country, according to an analysis of FBI statistics reported by CT News Junkie. The scams didn't arrive as elaborate schemes. They arrived as phone calls that sounded exactly like your bank, or your grandson. The voice on the line was convincing. The caller ID matched. And by the time anyone thought to question either one, the money was already gone. Connecticut has about 3.6 million people. Losing $16.1 million in a single year means a lot of families got hurt, not through corporate breaches or stolen databases, but through phone calls. According to CT News Junkie's analysis of FBI statistics, scammers used three main tactics in 2025: voice cloning to impersonate relatives, spoofed caller ID to fake bank phone numbers, and deepfake celebrity videos to push fraudulent investment schemes. None of these tactics are new. AI just made them work on people who never would have fallen for the old versions. ## Why Connecticut The CT News Junkie report doesn't name a single cause for Connecticut ranking first, but the demographics are suggestive. The state has one of the highest median household incomes in the U.S., around $90,000 according to Census Bureau data, and higher-income households carry more assets, which makes them more attractive targets. Connecticut also has a significant retiree population along the shoreline and in Fairfield County, and older adults are disproportionately targeted by impersonation scams. 2025 was also the year AI voice tools became genuinely cheap. What once required a studio and a skilled audio engineer now runs on a laptop. Researchers at Carnegie Mellon University demonstrated convincing voice clones built from under 30 seconds of source material: a voicemail, a birthday video on Facebook, a clip from a local news segment. Scammers clone the voice, then call a parent or grandparent in a moment of staged panic. The script involves an accident, an arrest, a hospital visit, something urgent that needs money right now. The voice sounds right. The emotion sounds right. ## The Bank Spoof Problem Voice cloning gets the attention, but spoofed caller ID is just as damaging. Scammers can display any number they choose: your bank's fraud department, the IRS, a local police department. The call follows a familiar pattern. There's suspicious activity on your account, they need to verify your identity, and they need you to move funds to a "secure" account to protect them. The urgency is manufactured, the number is fake, and the account belongs to the scammer. The Federal Trade Commission reported that impersonation scams, government and business combined, cost Americans $2.95 billion in 2023. With AI making these calls more convincing, 2025 numbers are expected to be higher when full federal data is released. Research on human detection of AI-generated audio offers little comfort: people identify synthetic voices correctly only about 55 to 60 percent of the time under controlled conditions, and in a real call, with stress and emotion in the mix, that number almost certainly drops. A private codeword challenge stops this kind of call cold. Trust Onion gives families three simple words that rotate every 60 seconds. When a call comes in from someone claiming to be a relative or a bank, you ask one question: "What are the words?" If they know them, it's really them. If they hesitate or give the wrong answer, you hang up. Keep in mind that a failed callback on its own doesn't prove the original caller was legitimate; always use a number from your card, a bank statement, or another independently sourced contact, and alert authorities if you believe someone may be in danger. For anyone who wants a visual check alongside that verbal one, a Proofie™ is a selfie signed using your passkey in the Trust Onion app. Verification checks the passkey signature against the full signing public key, the original photo's hash, and the signed record. An AI can clone a voice. It cannot know three codewords that live only on authorized devices and change constantly. Talk about this with the people you trust before a call comes in. Set up a shared codeword challenge with relatives, close friends, or anyone who might reach you in an emergency. No bank, government agency, or legitimate organization will ever ask you to move money to protect it. Connecticut lost $16.1 million last year to calls that sounded exactly like someone people trusted. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Connecticut lost $16.1 million to AI scams in 2025, the highest per-capita rate in the U.S., with voice cloning, spoofed caller ID, and deepfake celebrity videos as the three primary tactics. - AI voice cloning requires under 30 seconds of audio from a voicemail or social media video to convincingly impersonate a family member, according to Carnegie Mellon University researchers. - The Federal Trade Commission reported that impersonation scams cost Americans $2.95 billion in 2023, and AI tools have since made those calls significantly harder to detect by ear alone. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers record as little as 30 seconds of a relative's voice from social media or voicemails, clone it using AI tools, then call pretending that person is in an emergency. They pressure you to send money immediately before you can verify the situation. ### How can you tell if a call from your bank is fake? You cannot rely on caller ID alone, since scammers can spoof any number. Hang up and call your bank using the number on the back of your card or a statement. Legitimate banks will never ask you to move funds to a secure account over the phone. ### Why are older adults targeted more by AI impersonation scams? Older adults are more likely to answer unknown calls, less familiar with AI voice cloning, and statistically have more savings. Scammers exploit emotional urgency, such as a fake grandchild emergency, to bypass skepticism before victims can think critically. ### How much audio does a scammer need to clone your voice? Researchers at Carnegie Mellon University have shown convincing voice clones can be built from under 30 seconds of audio. A single voicemail, Facebook video, or news clip can provide enough material to impersonate someone convincingly. ### What should you do if you think you received an AI voice cloning scam call? Hang up and call the person the scammer claimed to be using a number you already have saved. Report the incident to the FTC at ReportFraud.ftc.gov and contact your bank if any financial information was shared during the call. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords add a check beyond a familiar voice, caller ID, or message. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "'Hi Mom, Hi Dad' Scam Texts Are Fooling Irish Families" published: 2026-04-22T12:04:17.687Z updated: 2026-10-11T06:13:02.044Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/hi-mam-hi-dad-scam-texts-ireland-family-impersonation --- # 'Hi Mom, Hi Dad' Scam Texts Are Fooling Irish Families **Cite as:** 'Hi Mom, Hi Dad' Scam Texts Are Fooling Irish Families, Trust Onion, 2026-10-11. https://trustonion.io/blog/hi-mam-hi-dad-scam-texts-ireland-family-impersonation A text arrives from an unfamiliar number: 'Hi Mom, it's me. I've got a new number, can you save it?' A few messages later comes the ask for money. According to TechBuzz Ireland, a fresh wave of these family impersonation texts is circulating in Ireland right now, running alongside fake bank messages designed to steal financial credentials. The message is short and friendly. It uses a name you trust. The unfamiliar number is explained away before you notice it: new phone, lost the old one, please save this contact. By the time the urgent request arrives, the conversation feels real. This is the 'Hi Mam, Hi Dad' scam. It targets love and the instinct to help a child in trouble, and right now it is spreading across Ireland. TechBuzz Ireland reported in April 2026 that these family impersonation texts are circulating alongside a separate wave of bank impersonation messages, fake texts pushing people toward fraudulent login pages built to capture account credentials. Both attacks exploit the same weakness: SMS lands in a trusted inbox with no spam filter, and most people do not question a message that arrives there. ## How the Con Unfolds The scammer's opening move is the whole game. Claiming a new number first neutralises every red flag before you register one. You don't recognise the sender? Of course not, it's new. From that point, the conversation feels like family. Parents are the primary target, specifically parents who might reasonably expect a child to lose a phone or switch numbers. The scammer needs very little to start: a first name, a general sense of family structure, a believable story. Social media profiles, old data breaches, and public Facebook pages can supply all of it. The point of no return is not the first text or even the second. It is the moment money moves. Irish banks and consumer protection agencies consistently warn that reversing authorised transfers is not guaranteed. Speed and urgency are deliberate tools. The faster you act, the less time you have to think. --- ## What Breaks It This scam has one obvious weakness. The person texting claims to be your child and claims to know you, but there is one thing they cannot know: three shared codewords known only to your family. Trust Onion is a free app that gives every family member the same three rotating codewords, calculated locally on each device with no server required and full offline use. The words change every 60 seconds, so an overheard set is already expired. When a suspicious text or call arrives, you ask: "What are the words?" Your real family member answers immediately. A scammer has nothing. Note that a failed callback, reaching voicemail or a disconnected line, does not prove the original texter was legitimate. Use a number already saved in your contacts, and if someone may be in danger, alert the authorities. If you receive a text like this, do not engage with the new number. Call your child on their known number. In Ireland, forward suspicious texts to 7726 to help network operators identify and block scam numbers. If money has already moved, contact your bank immediately and report it as a scam. The 'Hi Mam, Hi Dad' scam keeps working because it targets something real: the instinct to help a child in trouble. There is nothing foolish about that impulse. Scammers simply count on it arriving faster than doubt. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - The 'Hi Mam, Hi Dad' scam impersonates your child over text, using a fake new-number story to explain away suspicion before asking for urgent money. - Once a bank transfer is authorised, reversal is not guaranteed, so acting quickly under pressure without verifying is the single biggest risk. - Three shared rotating codewords, asked with 'What are the words?', expose the scam instantly before any money moves. ## Frequently asked questions ### What is the Hi Mam Hi Dad scam in Ireland? Criminals text parents pretending to be their child with a new number, then ask for urgent money. The scam is spreading across Ireland, reported by TechBuzz Ireland in April 2026 alongside a wave of fake bank messages targeting the same trusted SMS channel. ### How do I know if a text from my child is a scam? Call your child on their known number. If that is not possible, ask something only they would know. A pre-arranged family codeword is the most reliable check: ask "What are the words?" and your real child answers instantly. A scammer cannot. ### Can Irish banks refund money lost to a Hi Mam Hi Dad scam? Refunds are not guaranteed. Because the account holder authorised the transfer, banks treat it differently from unauthorised fraud. Report it to your bank immediately; recovery depends on how quickly you act and whether the receiving account can be frozen. ### How do scammers get your personal information for family text scams? Public social media profiles, old data breaches, and open Facebook pages supply names and family details. Scammers need only a first name and a plausible family structure to open a convincing conversation, which takes very little research. ### What should I do if I receive a suspicious text claiming to be my child? Do not send money. Contact your child through a number already saved in your contacts. In Ireland, forward the text to 7726. If money has already moved, call your bank immediately and report it as a scam to Garda fraud services. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set up your family group at trustonion.io and make "What are the words?" the first question whenever something feels off. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Michigan AG Warns: AI Can Now Sound Exactly Like Your Kid" published: 2026-04-22T11:31:33.103Z updated: 2026-10-11T06:13:02.433Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/michigan-ag-warns-ai-voice-cloning-family-scams --- # Michigan AG Warns: AI Can Now Sound Exactly Like Your Kid **Cite as:** Michigan AG Warns: AI Can Now Sound Exactly Like Your Kid, Trust Onion, 2026-10-11. https://trustonion.io/blog/michigan-ag-warns-ai-voice-cloning-family-scams On April 20, 2026, Michigan Attorney General Dana Nessel issued a consumer alert: scammers are using AI to clone the voices of family members and call you for money. The voice on the line may sound exactly like your child. It isn't. AI voice cloning can replicate someone's speech patterns, tone, and accent from as little as 20 to 30 seconds of audio. That's one short voicemail, a single TikTok, or a few seconds of a family video posted online. AG Nessel's office warned families across Michigan that this is no longer theoretical. The FTC reported that Americans lost $2.7 billion to impersonation scams in 2023, and the number has climbed every year since. A 2023 McAfee survey found that 77% of AI voice scam victims lost money, with an average loss of over $1,400. Some families lost far more. ## How the Scam Runs The structure rarely varies. A call comes in: a family member is in trouble, a car accident, an arrest, a hospital visit. Then a second voice gets on the line, playing a lawyer or police officer, explaining what's needed: cash, a wire transfer, gift cards, sometimes cryptocurrency. Then comes the secrecy ask. Don't tell anyone, because it could make things worse. That instruction isolates the target and stops them from calling another family member to check. For years, the grandparent scam worked by keeping details vague enough that the victim filled in the blanks. Voice cloning removes the vagueness. Now the voice actually sounds like your grandchild, and the scammer may already know names and personal details pulled from social media. Our brains trust voices we recognize. Scammers count on that. AG Nessel's office recommends hanging up and calling your family member directly on a number you already have saved, not one the caller provides, then checking with another family member before doing anything. A failed callback does not prove the original caller was legitimate; use a number from your own contacts or another independently sourced method. These are sound instincts, but the scam is built to make those steps feel impossible while your heart is racing. --- ## A System That Works Before the Call Comes Trust Onion gives families three shared codewords that rotate every 60 seconds, calculated locally on each person's phone with no server required. When a call comes in and something feels off, ask: "What are the words?" A real family member knows them. An AI clone does not. A cloned voice can mimic how someone sounds; it cannot know three private words that changed 60 seconds ago and exist only on your family's phones. For a call that needs more than words, a Proofie™ is a selfie signed using a passkey in the Trust Onion app. Verify it in the app, compare the full signing key against the person's public key in your shared group, and check that the original photo has not changed since it was signed. Codewords and Proofies work alongside each other. For most suspicious calls, asking "What are the words?" is enough. AG Nessel's warning makes one thing clear: the time to prepare is before the emergency, real or fake. Talk to your family this week, explain how these scams work, and make the codeword question a normal part of how you handle calls from loved ones. Scammers are betting you haven't done that yet. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning can replicate a loved one's voice from just 20 to 30 seconds of audio found on social media or voicemails. - Americans lost $2.7 billion to impersonation scams in 2023, with AI voice scam victims losing an average of over $1,400 per incident. - Scammers use urgency, fake authority figures, and secrecy requests to prevent victims from verifying the call with actual family members. ## Frequently asked questions ### How does AI voice cloning work in phone scams? Scammers use AI tools to clone a person's voice from short audio clips, sometimes as little as 20 seconds, taken from social media videos or voicemails. The cloned voice impersonates a family member and pressures victims to send money quickly. ### How can I tell if a distress call from a family member is an AI scam? Hang up and call your family member directly on a number you already have saved. A failed callback does not prove the original caller was legitimate. If the caller pressures you to stay on the line or keep the situation secret, treat it as a red flag. ### What is the grandparent scam and how has AI made it worse? The grandparent scam involves fraudsters posing as a grandchild in crisis to extort money. AI voice cloning now makes these calls sound like the actual grandchild, and scammers use personal details from social media to make the story more believable. ### What payment methods do AI voice scammers typically request? Scammers commonly request wire transfers, gift cards, cash picked up by a courier, or cryptocurrency. These methods are difficult or impossible to reverse once sent, which is why scammers push victims to pay quickly while still on the phone. ### What does the Michigan Attorney General recommend if you get a suspicious family emergency call? AG Nessel advises hanging up and calling your family member directly on a known number. Do not follow instructions to keep the call secret, and never send money before confirming the emergency is real. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set up your family group free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Cloned Her Daughter's Voice. She Lost Thousands." published: 2026-04-21T00:05:12.561Z updated: 2026-10-18T05:19:18.749Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-cloned-daughters-voice-fake-kidnapping-scam-missouri --- # AI Cloned Her Daughter's Voice. She Lost Thousands. **Cite as:** AI Cloned Her Daughter's Voice. She Lost Thousands., Trust Onion, 2026-10-18. https://trustonion.io/blog/ai-cloned-daughters-voice-fake-kidnapping-scam-missouri A Missouri mother heard her daughter screaming. The call came from her daughter's actual phone number, the voice sounded exactly right, and by the time the 90-minute call ended, she had wired thousands of dollars to strangers. The voice on the line was crying and terrified. It said it had been kidnapped. It sounded, according to WDBJ7's February 26, 2026 report, exactly like the Missouri mother's college-age daughter. Then a second voice came on, threatening to kill her unless the mother wired money immediately. She paid. Thousands of dollars over about 90 minutes. Her daughter was fine and had no idea any of this was happening. This was not a lucky guess or a prank call. Voice cloning software needs only a 20-30 second audio sample to produce a convincing replica of someone's voice. For a college student who posts videos or leaves voicemails, that sample is easy to find. Phone number spoofing is equally accessible: scammers can make a call appear to come from any number they choose, including your daughter's cell. When the voice matches the number on the screen, the combination is nearly impossible to question in real time. The 90-minute window was deliberate. Keeping a victim on the line prevents them from hanging up to verify whether the person they're supposedly hearing is actually safe. Every second the mother stayed on that call was a second she couldn't reach her daughter. --- The Missouri mother did not make a foolish mistake. The tools used against her were sophisticated, and the script was designed to exploit exactly the instincts that make her a good mother. She had no fast, reliable way to disprove what she was hearing. That's the gap these scams live in: the space between "this sounds like my child" and "I can confirm this IS my child." Closing that gap doesn't require technical expertise. It requires a shared secret. Trust Onion is a free app built around that idea. Families share three private codewords that rotate every 60 seconds, calculated locally on each device with no server involved. When a call comes in from someone claiming to be a family member, you ask: "What are the words?" An AI voice clone can sound exactly like your daughter. It cannot know three codewords that change every 60 seconds and live only on your family's devices. The preparation happens before the call. One conversation covers it: "Hey, if you ever call me in an emergency, I'm going to ask you for the words. And if I ask, don't be offended. Just answer it." The app also lets family members send and verify a Proofie™, a selfie signed using your passkey the moment you take it, so the exact photo and signing key can be checked independently in the Trust Onion app. If you decide to hang up and call your loved one back on a number you already have saved, do that. But a completed callback does not prove the original caller was legitimate; the caller must still know your family's private codewords. Contact local law enforcement immediately if you believe a real threat may exist. ## The Technology Isn't Slowing Down Voice cloning quality improves constantly. The audio samples needed keep getting shorter. The spoofing tools keep getting cheaper. The answer isn't to become a better audio analyst. It's to have a verification method that doesn't rely on your ear at all. For families with college students, setting this up is worth doing this week, not because something bad is likely to happen, but because panic doesn't leave room for strategy. The scammer who called the Missouri mother had a perfect voice clone and her daughter's number spoofed. What they didn't have, and couldn't have had, were the words. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - Voice cloning requires only a 20-30 second audio sample, making anyone who posts videos or voicemails a potential target. - Scammers combine AI voice cloning with phone number spoofing and keep victims on the line for extended periods to prevent independent verification, and all three tactics worked together against the Missouri mother. - A pre-arranged family codeword closes the gap between 'this sounds like my child' and 'I can confirm this IS my child,' and an AI clone cannot supply words that rotate every 60 seconds on your family's devices. ## Frequently asked questions ### How do AI voice cloning scams work? Scammers collect a short audio sample from social media or voicemails, clone the voice with AI software, then call family members pretending that person is in distress. They pair the fake voice with spoofed caller ID to make the call appear legitimate. ### How much audio does a scammer need to clone your voice? As little as 20-30 seconds of audio is enough for current voice cloning tools to produce a convincing replica. Any publicly available video, voicemail, or recorded call can provide that sample. ### What is a virtual kidnapping scam? A fraud where criminals convince a victim their loved one has been kidnapped and demand immediate payment. No actual kidnapping occurs. The scammer uses fear and urgency to prevent the victim from verifying the claim. ### How can families protect themselves from AI voice cloning scams? Establish private family codewords that anyone can use to verify identity during a suspicious call. If the caller cannot provide the codeword, hang up and call your loved one on a number you already have saved. A failed callback does not prove the original caller was legitimate; the caller must still know your family's private codewords. ### What should you do if you receive a fake kidnapping call? Stay as calm as possible, avoid wiring money, and ask the caller for your family codeword. Try to hang up and call your loved one directly. Contact local law enforcement immediately if you believe a real threat may exist. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Set them up before the next call comes at trustonion.io , it's free, works offline, and takes about five minutes to give everyone you love a way to prove it's really them. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Your Kid's Voice Can Be Cloned From a TikTok Video" published: 2026-04-16T10:43:56.286Z updated: 2026-10-11T06:13:03.088Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/ai-voice-cloning-family-scam-codeword-defense --- # Your Kid's Voice Can Be Cloned From a TikTok Video **Cite as:** Your Kid's Voice Can Be Cloned From a TikTok Video, Trust Onion, 2026-10-11. https://trustonion.io/blog/ai-voice-cloning-family-scam-codeword-defense Scammers can clone your child's voice from a short clip pulled from Instagram, TikTok, or a YouTube video. According to the FTC, you have no reliable way to tell the difference just by listening. A birthday video. An Instagram story. Twenty to thirty seconds of audio posted publicly online. That is all a scammer needs to generate a fake voice that sounds like your son or your daughter, scared and desperate, calling from what sounds like the worst moment of their life. In March 2023, CBS News reported what security researchers had been warning about for years: AI voice cloning tools had become cheap, fast, and convincing enough to fool parents. The FTC put it plainly: you can no longer trust that a voice on the phone belongs to the person it sounds like. Most families have years of audio and video of their loved ones posted publicly. Scammers search for it. ## How the Call Unfolds The call arrives and it is your kid's voice, or close enough that your brain fills in the gaps. They are in trouble. A car accident. Jail. Wire money now, and please do not tell anyone. Then a second voice gets on the line, a "lawyer" or a "police officer," adding pressure and explaining how to send the funds. The whole call is engineered to hit you emotionally before your rational thinking catches up. The cloned voice is what drops your guard first. Research shows people correctly identify AI-generated voices only 55 to 60 percent of the time under calm, controlled conditions. During a call where you believe your child is in danger, that accuracy falls further. --- The FTC's warning in early 2023 confirmed what researchers already knew: trusting your ears is no longer a reliable defense. When CBS News asked experts what families should actually do, the answer was consistent: use a secret family codeword. AI can clone a voice. It cannot clone knowledge. ## The Codeword Defense Your family agrees on a word or phrase in advance, something meaningless to an outsider. When a call comes in from someone claiming to be a family member in crisis, you ask for it before doing anything else. "What's the word?" If they cannot produce it, you have your answer. The scammer may push back, claiming they forgot or there is no time. That is the scam talking. The real version of your family member would know the word. One important detail: a static codeword, once overheard or guessed, becomes useless. Words that rotate on a schedule expire on their own. Trust Onion is a free app that puts this system in your pocket. Your family shares three private codewords that rotate every 60 seconds, calculated locally on each device. When a suspicious call arrives, ask: "What are the words?" If they know them, good. If they do not, the call ends and the scam fails. The app also supports Proofie™, a selfie signed using your passkey the moment you take it. The signature binds the photo to the signing key, time, and location in the signed record. Use the Trust Onion app to send, verify, and compare Proofies against the full public key in your shared family group. Family codewords work alongside Proofies as a separate layer, not as part of the signed photo or its record. If you hang up and call your family member back on a number you already know, keep in mind that a successful callback does not prove the original caller was legitimate. The caller must still know the family's private Trust Onion Three Words. The FTC told families to use a secret codeword. A shared word removes unearned trust from the equation. When your loved one's voice can be copied from a social media video, asking for that word is not cold. It is careful. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio. ## Key takeaways - AI voice cloning tools can replicate your child's voice from as little as 20 to 30 seconds of publicly posted audio. - Humans correctly identify AI-generated voices only 55 to 60 percent of the time, making your ears an unreliable defense against cloning scams. - The FTC has officially warned that a voice on the phone is no longer proof of a person's identity, and recommends verification methods like family codewords. ## Frequently asked questions ### Can scammers clone my child's voice from TikTok or Instagram? Yes. Modern AI voice cloning tools need as little as 20 to 30 seconds of audio. A short birthday video, Instagram story, or TikTok clip posted publicly is enough for scammers to generate a convincing fake voice of your child. ### How does the AI voice cloning phone scam work? Scammers call a parent using a cloned voice of a family member claiming to be in an emergency. A fake lawyer or officer then joins the call to pressure the victim into wiring money quickly and secretly. ### How can I protect my family from voice cloning scams? Set up a secret family codeword only your household knows. If you receive a suspicious emergency call, ask for the codeword before doing anything else. AI can clone a voice but cannot know a private word your family agreed on in advance. ### Can you tell the difference between a real voice and an AI cloned voice? Rarely. Research shows people correctly identify AI-generated voices only 55 to 60 percent of the time under calm conditions. During a stressful emergency call, your ability to detect a fake voice drops even lower. ### What does the FTC say about AI voice cloning scams? The FTC warned in early 2023 that a voice on the phone can no longer be trusted as proof of identity. They advise families to use verification methods like codewords rather than relying on how a caller sounds. ## More from Trust Onion Protect your family with Trust Onion's three rotating codewords. Download the free app at trustonion.io and set up your family group in minutes. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Scottsdale Man Loses $4,000 in Late-Night Virtual Kidnapping Hoax" published: 2026-10-28T00:04:27.545Z updated: 2026-10-28T00:04:27.576Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/scottsdale-man-loses-4-000-in-late-night-virtual-kidnapping-hoax --- # Scottsdale Man Loses $4,000 in Late-Night Virtual Kidnapping Hoax **Cite as:** Scottsdale Man Loses $4,000 in Late-Night Virtual Kidnapping Hoax, Trust Onion, 2026-10-28. https://trustonion.io/case-studies/scottsdale-man-loses-4-000-in-late-night-virtual-kidnapping-hoax A Scottsdale man wired more than $4,000 via Apple Pay after a late-night call, placed from his father's spoofed number, claimed his parents were being held at gunpoint. Virginia police confirmed his parents were safe at home before he realized he had been deceived. ## Incident facts - **Incident date:** October 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $4,000 ## Timeline - **The Setup:** Scammers spoofed the victim's father's phone number, ensuring the late-night call would appear credible and trigger immediate panic rather than skepticism. - **The Attack:** A stranger on the line claimed the victim's parents were being held at gunpoint and demanded payment via Apple Pay to two separate numbers, using manufactured urgency to cut off any independent verification. - **The Impact:** The victim sent more than $4,000 across two Apple Pay transactions while simultaneously texting 911, acting entirely on fear. - **The Discovery:** Virginia police confirmed the victim's parents were unharmed and at home, revealing the call as a hoax. - **The Fallout:** The victim lost $4,000 with no recovery reported. An AARP Arizona specialist noted that virtual kidnapping scams are engineered to prevent victims from pausing long enough to confirm the threat is real. ## How the attack worked The call arrived late at night, displaying the victim's father's name on the screen. A stranger's voice claimed both parents were being held at gunpoint and that money had to move immediately. The caller directed payment to two Apple Pay numbers, a split that likely served to complicate any reversal attempt. According to an AARP Arizona specialist cited in the FOX5 Vegas report, virtual kidnapping scams run entirely on manufactured fear. The goal is to keep the victim panicking long enough to send money before they can reach the person supposedly in danger. Spoofing a trusted family member's number is the opening move, because it removes the first and most obvious safeguard: caller ID. ## Damage assessment The victim lost $4,000 in minutes, sent across two Apple Pay transactions before Virginia police confirmed his parents were safe. Apple Pay transfers to unknown recipients are effectively irreversible once completed, leaving little recourse after the call ended. "Virtual kidnapping scams rely on manufactured fear to prevent victims from independently verifying the threat," the AARP Arizona specialist told FOX5 Vegas. That manufactured fear is the entire product. ## How verification helps If this family had been using Trust Onion, one question would have changed everything. The moment a stranger claimed the victim's parents were in danger, asking the supposed captor, or even texting a parent directly, 'What are the words?' would have cut through the panic. The real parents would know the current three codewords. A scammer running a kidnapping hoax cannot. Trust Onion's three codewords rotate every 60 seconds and are calculated locally on each family member's device, with nothing stored on a server for anyone to steal or spoof. A family that agrees in advance to always ask for the words before sending money has a private, zero-cost tripwire that phone spoofing cannot defeat. ## Key lessons - Caller ID is not identity verification: spoofing a trusted family member's number is a standard first step in virtual kidnapping scams. - Panic is the mechanism, not a side effect. Scammers script these calls to prevent any pause for independent verification, so a pre-agreed family challenge word removes the need to think clearly under pressure. - Irreversible payment methods like Apple Pay are chosen deliberately. Once the transfer completes, recovery is unlikely regardless of how quickly the fraud is discovered. ## Key takeaways - A Scottsdale man lost $4,000 via Apple Pay after scammers spoofed his father's phone number and falsely claimed his parents were being held at gunpoint. - Virtual kidnapping scams use manufactured urgency to stop victims from contacting the person supposedly in danger before money moves. - A pre-agreed family codeword challenge, asked before any emergency payment is made, can expose a hoax call that even a spoofed number cannot authenticate. ## Frequently asked questions ### What happened in the Scottsdale virtual kidnapping scam? A Scottsdale man received a late-night call that appeared to come from his father's phone number. A stranger claimed his parents were being held at gunpoint and demanded payment via Apple Pay. He sent more than $4,000 before Virginia police confirmed his parents were safe at home. ### How much money was lost in the Scottsdale kidnapping hoax? The victim sent more than $4,000 via Apple Pay, split across two separate numbers. Apple Pay transfers to unknown recipients are effectively irreversible, and no recovery was reported. ### How do virtual kidnapping scammers make their calls seem real? They spoof a trusted family member's phone number so the call appears legitimate on caller ID, then use urgent, high-emotion scripting to prevent the victim from pausing to contact the person supposedly in danger. ### How could Trust Onion's three rotating codewords have helped in this case? A family using Trust Onion can ask 'What are the words?' before acting on any emergency call. The real family member knows the current codewords; a scammer does not. That single question would have exposed the hoax before any money moved. ### What should you do if you receive a virtual kidnapping call? Stay calm and do not send money. Try to reach the person supposedly in danger through a known number. A failed callback does not prove the original caller was legitimate; the caller must still know your family's private Trust Onion Three Words. Use common sense and alert authorities immediately if you believe someone may genuinely be in danger. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Trapped a Mother in a Five-Hour Fake Kidnapping Call" published: 2026-10-26T00:06:10.261Z updated: 2026-10-26T00:06:10.321Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-trapped-a-mother-in-a-five-hour-fake-kidnapping-call --- # AI Voice Clone Trapped a Mother in a Five-Hour Fake Kidnapping Call **Cite as:** AI Voice Clone Trapped a Mother in a Five-Hour Fake Kidnapping Call, Trust Onion, 2026-10-26. https://trustonion.io/case-studies/ai-voice-clone-trapped-a-mother-in-a-five-hour-fake-kidnapping-call A California mother wired $5,400 to Mexico after scammers used an AI-cloned version of her daughter's voice to simulate a kidnapping and kept her on the phone for five hours. The daughter was never in danger, but the mother had no way to know that. ## Incident facts - **Incident date:** October 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $5,400 ## Timeline - **The Setup:** Scammers gathered enough audio of the daughter, likely from social media, to clone her voice using AI tools capable of producing a convincing real-time simulation. - **The Attack:** The mother received a call in which the AI-cloned voice of her daughter appeared to cry out in distress, followed by a scammer demanding ransom and instructing her to stay on the line and tell no one. - **The Impact:** Over five hours on the phone, the mother was cut off from anyone who could verify her daughter's safety, and ultimately wired $5,400 to Mexico. - **The Discovery:** The mother learned her daughter was safe and unharmed only after the money had already been sent. - **The Fallout:** The incident was reported to Fortune, where a University of Cincinnati professor explained that a familiar voice lowers cognitive defenses, making AI voice cloning scams highly effective, and experts called on families to establish private safe words. ## How the attack worked The call opened with what sounded exactly like her daughter's voice, frightened and crying. What followed was five hours of careful isolation: the scammers kept the mother on the line and told her not to contact anyone else, a tactic designed to prevent the one call that would have ended the whole scheme. With her daughter's voice in her ear and a stranger directing her next steps, the mother wired $5,400 to Mexico before the truth surfaced. University of Cincinnati marketing professor Kimberly Hyun, speaking to Fortune, identified the mechanism that made it work: a familiar voice lowers our cognitive defenses. The scammers did not need a perfect imitation, only one good enough to clear that threshold. AI voice cloning tools have made that threshold far easier to reach, requiring only a short audio sample of the kind posted freely to social media every day. ## Damage assessment The mother lost $5,400 that crossed international borders and is almost certainly unrecoverable. The financial loss is measurable. The five hours she spent believing her daughter was in danger are not. Fortune reported that her experience is far from rare. Experts now describe AI voice cloning as a threat every family faces, and the article carried a direct instruction: every family needs a safe word. ## How verification helps When the call came in and her daughter's voice filled the line, one question would have changed everything: "What are the words?" A real daughter, wherever she was, would have known the answer. The scammer, holding only a cloned voice and no knowledge of the family's private Trust Onion codewords, could not have answered. Trust Onion gives families three private codewords that rotate every 60 seconds, calculated locally on each device with no server involved. There is no database to breach, no phrase to intercept. If someone calls claiming to be a family member in distress, the words are the only verification that matters. An AI voice clone sounds exactly right and proves nothing. The three words prove it is really them. ## Key lessons - A convincing voice is not proof of identity: AI can clone a family member's voice from social media audio in minutes. - Scammers use isolation as a weapon, keeping victims on the line and away from anyone who could quickly verify a loved one's safety. - Families need a shared private verification method they can use instantly during a call, before any money moves. ## Key takeaways - A California mother lost $5,400 after AI-cloned voice scammers simulated her daughter's kidnapping over a five-hour phone call. - AI voice cloning requires only a short audio sample, making social media posts a readily available source for scammers. - Experts recommend every family establish a private safe word or rotating codeword system to verify callers in real time. ## Frequently asked questions ### What happened in the California AI voice cloning kidnapping scam? Scammers used AI to clone the voice of a California mother's daughter, simulated a kidnapping over the phone, and kept the mother on the line for five hours. She wired $5,400 to Mexico before learning her daughter was never in danger. ### How much money did the victim lose in this AI voice scam? The mother wired $5,400 to Mexico. Because the transfer crossed international borders, recovery is extremely unlikely. ### How can families protect themselves from AI voice cloning scams? Establish a shared private codeword that any family member can be asked to provide during a suspicious call. Trust Onion's three rotating codewords change every 60 seconds and are calculated on-device, so a scammer with a cloned voice has no way to know the current words. ### Why are AI voice cloning scams so convincing? According to University of Cincinnati marketing professor Kimberly Hyun, a familiar voice lowers cognitive defenses. AI tools can clone a voice from a short audio sample, such as a social media video, producing an imitation realistic enough to bypass a parent's instinct to question. ### What should I do if I receive a ransom call involving a family member's voice? Ask the caller to provide your family's private codewords. Hang up and call your family member back on a known number, but note that a failed callback does not prove the original caller was legitimate. Use common sense and contact authorities immediately if you believe someone may be in danger. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Free AI Tools Cloned a Journalist's Voice and Fooled Their Family" published: 2026-10-24T00:03:12.850Z updated: 2026-10-24T00:03:12.879Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/free-ai-tools-cloned-a-journalist-s-voice-and-fooled-their-family --- # Free AI Tools Cloned a Journalist's Voice and Fooled Their Family **Cite as:** Free AI Tools Cloned a Journalist's Voice and Fooled Their Family, Trust Onion, 2026-10-24. https://trustonion.io/case-studies/free-ai-tools-cloned-a-journalist-s-voice-and-fooled-their-family A ZDNet journalist used free AI voice cloning tools to clone their own voice, then placed a simulated scam call on family members who failed to detect the fake. The experiment showed how little skill or money a would-be fraudster now needs to impersonate someone a family knows and trusts. ## Incident facts - **Incident date:** October 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Prevented - **Financial impact:** non-financial ## Timeline - **The Setup:** The journalist found freely available AI voice cloning tools that required no technical expertise and only a short audio sample to produce a convincing voice clone. - **The Attack:** Using the cloned voice, the journalist placed a simulated scam call to family members, presenting a fabricated urgent scenario to test whether the fake voice would be believed. - **The Impact:** Family members who knew the journalist well did not detect the cloned voice during the call, showing the technology can deceive even close relatives. - **The Discovery:** The journalist revealed the experiment to family members after the call, confirming they had been speaking with an AI-generated voice clone the entire time. - **The Fallout:** ZDNet published the findings as a consumer safety warning, documenting that realistic family impersonation is now accessible to anyone with a phone and an internet connection. ## How the attack worked The journalist fed a short sample of their own voice into a freely available AI cloning tool and generated audio that their family could not distinguish from the real thing. No subscription, no technical background, and no money changed hands. The simulated call used a pressured scenario designed to mirror the kind of urgent request a real scammer would make, and family members who hear that voice every day answered without suspecting anything was wrong. The experiment made one thing plain: the barrier to voice cloning has effectively disappeared. Anyone with a grudge, a scheme, or a few idle hours can now replicate someone's voice and call that person's family. The technology does not care how well the family knows the speaker. ## Damage assessment No money was lost and no real harm was done because the call was a controlled experiment. But the result was a precise blueprint for fraud: free tools, a convincing clone, and family members who had no way to tell the fake from the person they love. "I didn't even question it," one family member said after learning the truth. ## How verification helps If the family had been using Trust Onion, the journalist could have asked any caller claiming to be them: "What are the words?" A scammer using even a perfect voice clone cannot answer. The three codewords are calculated privately on each family member's device, rotate every 60 seconds, and never pass through any server a fraudster could reach. The experiment proved that voice alone is not enough to confirm identity. A single shared question, asked before any money moves or any emergency plan is followed, turns a convincing clone into an obvious fake. ## Key lessons - Free, publicly available AI tools can clone a recognizable voice convincingly enough to deceive close family members who hear that voice regularly. - Urgency and emotional pressure in a call are deliberate tactics; slowing down to ask a simple verification question breaks the scammer's script. - A shared private codeword that the caller must know in real time is something an AI voice clone cannot fake, no matter how accurate the audio. ## Key takeaways - A journalist cloned their own voice with free AI tools and fooled family members in a controlled 2026 experiment documented by ZDNet. - Voice cloning now requires no technical skill, no payment, and only a short audio sample, making family impersonation scams accessible to anyone. - Families who share rotating private codewords can expose a fake caller instantly, because the cloned voice cannot supply the current words. ## Frequently asked questions ### What did the ZDNet voice cloning experiment show? A ZDNet journalist cloned their own voice using free AI tools and placed a simulated scam call on family members. The family did not detect the fake, showing that realistic voice cloning is now accessible to anyone and can fool people who know the speaker well. ### How much does it cost to clone someone's voice with AI? The ZDNet experiment showed it can cost nothing. Free, publicly available tools produced a voice clone convincing enough to deceive close family members, with no technical expertise required. ### How can families protect themselves from AI voice cloning scams? Families can share a set of private rotating codewords using Trust Onion. When a caller claims to be a loved one, ask 'What are the words?' A scammer using a voice clone cannot answer, exposing the fake immediately regardless of how realistic the audio sounds. ### Can you tell an AI voice clone from a real person on a phone call? The ZDNet experiment suggests you often cannot, even when you know the speaker well. The only reliable check is something the AI clone cannot know: a private, time-sensitive codeword agreed in advance. ### What should I do if I get a suspicious call from a family member's number? Ask for the current codeword before responding to any request. You may also call back on a number you know independently, but a successful callback does not prove the original caller was legitimate. The caller must still know your family's private Trust Onion three words. Use common sense and alert authorities if you believe someone may be in danger. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Mumbai Senior Loses ₹50 Lakh to AI Voice Clone on WhatsApp" published: 2026-10-18T00:03:17.559Z updated: 2026-10-18T00:03:31.056Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/mumbai-senior-loses-50-lakh-to-ai-voice-clone-on-whatsapp --- # Mumbai Senior Loses ₹50 Lakh to AI Voice Clone on WhatsApp **Cite as:** Mumbai Senior Loses ₹50 Lakh to AI Voice Clone on WhatsApp, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/mumbai-senior-loses-50-lakh-to-ai-voice-clone-on-whatsapp A 69-year-old Mumbai resident handed ₹50 lakh in cash to a courier after fraudsters used an AI-cloned voice on WhatsApp to impersonate a trusted community figure claiming to be stranded in New Delhi. Scammers reinforced the deception with a temporary location pin before deleting it, and cybercrime police are now investigating. ## Incident facts - **Incident date:** October 2026 - **Victim type:** Elderly individual - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** ₹50 lakh ## Timeline - **The Setup:** Fraudsters identified a respected community figure whose voice the victim knew and trusted, then used AI tools to clone that voice convincingly enough for a WhatsApp audio call. - **The Attack:** The cloned voice called the victim on WhatsApp, claimed to be stranded in New Delhi, and urgently requested a cash loan, sending a temporary location pin to simulate legitimacy. - **The Impact:** The victim physically handed ₹50 lakh in cash to a courier arranged by the scammers, believing they were helping a friend in distress. - **The Discovery:** The victim later contacted the real community figure and discovered no such emergency had occurred and no trip to New Delhi had taken place. - **The Fallout:** Mumbai cybercrime police opened an investigation; the scammers had already deleted the location pin and the courier had disappeared with the cash. ## How the attack worked The call arrived on WhatsApp carrying a voice the victim had no reason to doubt. AI had reproduced the tone, cadence, and accent of a respected community figure closely enough that the 69-year-old did not question who was on the line. The caller said he was stranded in New Delhi and needed an urgent loan, framing it as a personal favour between people who trusted each other. To seal the deception, the scammers sent a WhatsApp location pin as apparent proof of where the caller was, implying it would anchor a repayment arrangement. The pin was deleted after it had done its work. The victim arranged ₹50 lakh in cash and handed it to a courier the scammers had dispatched, never speaking to the real person until the money was already gone. ## Damage assessment The victim lost ₹50 lakh in a single transaction, delivered in cash with no way to recall it. The location pin vanished before investigators could examine it. According to the Free Press Journal's report, cybercrime police are pursuing the case, but cash handed to an unidentified courier leaves little to trace. The real community figure, whose voice was stolen without his knowledge, was left to explain to a friend that he had never made that call. ## How verification helps If the victim's family had been using Trust Onion, a single question, 'What are the words?', would have stopped this before any money moved. The family's three codewords rotate every 60 seconds and are calculated locally on each person's device. A cloned voice, however convincing, cannot know the current words. For older adults who receive unexpected calls from people they trust, especially calls involving urgency, travel, or requests for cash, this habit is the simplest safeguard available. The caller claims to be someone you know: ask for the words. If they cannot answer, the call is not authenticated, no matter how familiar the voice sounds. ## Key lessons - An AI-cloned voice on WhatsApp can sound indistinguishable from someone you know and trust, including a respected community figure. - Urgency combined with a plausible location detail, such as a temporary WhatsApp pin, is designed to compress the time a victim has to think critically. - Cash handed to a courier is effectively unrecoverable; stopping the transfer before it happens is the only reliable protection. ## Key takeaways - A 69-year-old Mumbai resident lost ₹50 lakh in cash to an AI-cloned voice impersonating a trusted community figure on WhatsApp. - Scammers used a temporary WhatsApp location pin to simulate legitimacy, then deleted it before investigators could trace it. - A rotating three-word codeword challenge would have exposed the impersonation immediately, because the AI voice cannot know the current words. ## Frequently asked questions ### What happened in the Mumbai AI voice cloning scam? Fraudsters used an AI-cloned voice to impersonate a trusted community figure on WhatsApp, telling a 69-year-old Mumbai resident he was stranded in New Delhi and needed an urgent loan. The victim handed ₹50 lakh in cash to a courier sent by the scammers. Cybercrime police are investigating. ### How much money did the Mumbai senior citizen lose? The victim lost ₹50 lakh, paid in cash and delivered to a courier arranged by the fraudsters. Cash transfers of this kind are very difficult to recover once completed. ### How can older adults protect themselves from AI voice cloning calls? Agreeing in advance on a shared set of rotating codewords with family or trusted contacts means any caller must know the current words to be believed. Trust Onion's three codewords rotate every 60 seconds on each device. A cloned voice cannot answer correctly. ### Why did the WhatsApp location pin make the scam more convincing? The scammers sent a temporary location pin to simulate proof that the caller was genuinely in New Delhi and to imply a traceable repayment arrangement. They deleted it after the victim complied, removing the only digital trail that might have helped investigators. ### Is it safe to call back a number to verify an urgent request for money? Calling back the number that contacted you does not confirm identity, because scammers can control that number. Call the person on a number you already have saved independently, and remember that even a successful callback is not enough on its own: the caller must still know your shared Trust Onion codewords. If you believe someone may genuinely be in danger, contact local authorities. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Moncton Man Jailed 33 Months for Grandparent Scam Targeting 20 Elderly Americans" published: 2026-10-12T00:03:26.093Z updated: 2026-10-24T04:45:25.015Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/moncton-man-jailed-33-months-for-grandparent-scam-targeting-20-elderly-americans --- # Moncton Man Jailed 33 Months for Grandparent Scam Targeting 20 Elderly Americans **Cite as:** Moncton Man Jailed 33 Months for Grandparent Scam Targeting 20 Elderly Americans, Trust Onion, 2026-10-24. https://trustonion.io/case-studies/moncton-man-jailed-33-months-for-grandparent-scam-targeting-20-elderly-americans A 39-year-old defendant from Moncton, N.B., was sentenced by a Vermont federal judge to 33 months in U.S. federal prison after running a grandparent scam that collected $256,000 in cash from roughly 20 elderly American victims over three weeks in mid-2023. He recruited fake bail bondsmen to travel door-to-door collecting the money, then laundered and distributed the proceeds to co-conspirators before fleeing to Costa Rica. ## Incident facts - **Incident date:** Mid-2023 - **Victim type:** Elderly individual - **Attack type:** Voice cloning - **Outcome:** Resolved - **Financial impact:** $256,000 ## Timeline - **The Setup:** The defendant recruited individuals to pose as bail bondsmen and coordinated a phone-based grandparent scam targeting elderly Americans, coaching callers to impersonate distressed grandchildren and lawyers demanding urgent cash. - **The Attack:** Over roughly three weeks, fake callers contacted approximately 20 elderly victims, told them a grandchild was in legal trouble, and sent recruiters to their homes to collect cash payments totalling $256,000. - **The Impact:** Twenty elderly Americans handed over a combined $256,000 in cash, believing they were rescuing a grandchild from jail. - **The Discovery:** U.S. authorities tracked the defendant to Costa Rica, where he was arrested and extradited to the United States to face federal charges. - **The Fallout:** The defendant pleaded guilty to wire fraud and money laundering conspiracies and was sentenced by a Vermont federal judge to 33 months in federal prison and ordered to pay $256,000 in restitution. ## How the attack worked The calls followed a script built to short-circuit a grandparent's judgment. A voice claimed to be a grandchild in legal trouble, too embarrassed to call a parent, begging for bail money before things got worse. A second caller, posing as a lawyer or bondsman, confirmed the emergency and explained that cash, collected in person, was the only way to help. Urgency and shame kept victims from stopping to verify. The defendant ran that script across roughly 20 households over three weeks in 2023. Recruiters he hired drove to victims' doors, collected the cash, and passed it up the chain. By the time any family member thought to check whether a grandchild was really in custody, the money was gone. ## Damage assessment Twenty elderly Americans lost a combined $256,000, an average of roughly $12,800 each, to callers they believed were their grandchildren in crisis. The losses were not abstract: victims handed over cash at their own front doors, in person, to strangers they trusted because a voice on the phone had told them to. The defendant was ordered to pay restitution, but recovery in cash-based scams is rarely complete. For the victims, the deeper cost was the moment they opened the door. ## How verification helps When the caller claimed to be a grandchild in trouble and begged for cash before anyone else found out, a single question could have changed the outcome. A grandparent who asks 'What are the words?' puts the burden of proof on the caller, not on their own instincts. The real grandchild, added to a shared Trust Onion group, would know the current three codewords. A scammer, no matter how convincing the voice, cannot. Trust Onion's codewords rotate every 60 seconds and are calculated locally on each family member's device, with no server to hack and nothing a fraudster can intercept. The three-word check takes seconds and works even when a caller sounds exactly right, which is precisely when it matters most. ## Key lessons - Grandparent scams rely on urgency and shame to stop victims from pausing to verify; a shared family verification word breaks that pressure in seconds. - Cash collected in person is almost never recoverable, making prevention the only reliable protection. - Scam operations can move quickly across dozens of victims before any single case is reported, so individual awareness is not enough without a family-level verification habit. ## Key takeaways - The Moncton defendant was sentenced to 33 months in U.S. federal prison and ordered to pay $256,000 in restitution for running a grandparent scam against roughly 20 elderly Americans. - The scam used fake lawyers and bail bondsmen to collect cash in person, a method that leaves almost no recovery path for victims once money changes hands. - A rotating three-word family codeword gives grandparents a simple, free way to challenge any unexpected call before handing over money or personal information. ## Frequently asked questions ### What happened in the Moncton grandparent scam case? A 39-year-old defendant from Moncton, N.B., coordinated a scheme in which callers posed as grandchildren in legal trouble and recruited fake bail bondsmen to collect cash from approximately 20 elderly American victims. He was sentenced in October 2026 by a Vermont federal judge to 33 months in U.S. federal prison and ordered to pay $256,000 in restitution. ### How much money did the grandparent scam victims lose? The approximately 20 elderly American victims lost a combined $256,000, averaging roughly $12,800 each. The defendant was ordered to pay that amount in restitution, though cash-based losses are rarely fully recovered. ### How does a grandparent scam call work? A caller poses as a grandchild claiming to be in legal trouble, often asking the grandparent not to tell their parents. A second caller, posing as a lawyer or bail bondsman, confirms the story and requests immediate cash. The urgency and secrecy are designed to prevent any verification before money changes hands. ### How could a grandparent have stopped this scam? Asking 'What are the words?' would have exposed the fraud immediately. Trust Onion gives families three rotating codewords that change every 60 seconds. A real grandchild in a shared family group knows the current words; a scammer cannot. The check is free, takes seconds, and requires no technical skill. ### What should a grandparent do if they get a call like this? Pause before acting. Ask any caller claiming to be a family member for the family's private codewords. You can also hang up and call your grandchild directly on a number you already have stored. A failed callback does not prove the original caller was legitimate; the caller must still know your family's private Trust Onion Three Words. If you believe someone may be in real danger, contact local authorities. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Scam Traps California Mom in 5-Hour Kidnapping Nightmare" published: 2026-10-08T00:04:37.540Z updated: 2026-10-18T05:19:58.787Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-scam-traps-california-mom-in-5-hour-kidnapping-nightmare --- # AI Voice Scam Traps California Mom in 5-Hour Kidnapping Nightmare **Cite as:** AI Voice Scam Traps California Mom in 5-Hour Kidnapping Nightmare, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/ai-voice-scam-traps-california-mom-in-5-hour-kidnapping-nightmare California mother and Navy veteran who lost $5,400 across four wire transfers after scammers used an AI-cloned version of her daughter's voice to stage a fake kidnapping. Her daughter had been at work, safe, the entire time. ## Incident facts - **Incident date:** October 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $5,400 ## Timeline - **The Setup:** Scammers generated an AI-cloned audio sample of the daughter's voice, likely from publicly available recordings such as social media videos or voicemails. This sample became the centerpiece of a virtual kidnapping scheme targeting her mother. - **The Attack:** A man called the California mother claiming a Mexican drug cartel had kidnapped her daughter, then played the AI-cloned voice simulating distress. The caller kept the mother and her husband on the phone for five and a half hours, directing them from location to location and instructing them to wire money through MoneyGram and Western Union. - **The Impact:** Convinced her daughter's life was in danger, the California mother sent $5,400 across four separate transfers. Continuous phone contact prevented her from independently verifying her daughter's safety. - **The Discovery:** After five and a half hours, the California mother reached her daughter directly. Her daughter answered and confirmed she had been at work, safe, the entire time. - **The Fallout:** The $5,400 sent via wire transfer was unrecoverable. The California mother and her husband reported the incident to Fox News as a warning to other families about AI-cloned voice scams. ## How the attack worked The call opened with a man claiming a Mexican drug cartel had kidnapped the California mother's daughter, then immediately played an AI-cloned recording of the daughter's voice in apparent distress. The California mother is a Navy veteran with no prior reason to doubt her own ears. Hearing what sounded exactly like her daughter broke through that experience in seconds. What followed was five and a half hours of sustained control. The caller kept the California mother and her husband on the line continuously, moving them from location to location to complete four wire transfers through MoneyGram and Western Union, both chosen because the money moves fast and almost never comes back. The cloned voice reappeared whenever the California mother showed signs of hesitation, and the control broke only when she finally reached her daughter directly. ## Damage assessment The California mother lost $5,400 across four wire transfers to MoneyGram and Western Union. Funds sent through these services are typically irreversible, and recovery in virtual kidnapping cases is rare. The psychological toll ran deeper. Five and a half hours spent believing her daughter was in the hands of a drug cartel left the California mother and her husband shaken in ways a wire transfer receipt cannot measure. The manipulation was sophisticated enough to defeat the instincts of a Navy veteran, and when it was over, her daughter had been at her desk the whole time. ## How verification helps The scammers' strategy depended entirely on keeping the California mother in a state of panic with no way to check the truth. One question could have ended it: "What are the words?" The real daughter would know the family's current three rotating codewords. An AI-generated voice cannot answer, because the codewords are private, shared only within the family group, and rotate every 60 seconds on each member's device. A failed codeword challenge should prompt the listener to hang up, call the family member back on a number they know independently, and alert authorities if concern remains. Note that a successful callback alone does not prove the original caller was legitimate; the person calling back must still know the family's private Trust Onion codewords. A caller who pressures you to stay on the line and not call anyone else is using that pressure as a weapon. ## Key lessons - AI voice cloning can replicate a loved one's voice convincingly enough to deceive even alert, experienced individuals under emotional stress. - Virtual kidnapping scammers use continuous phone contact deliberately, keeping victims on the line to prevent them from calling a family member directly to verify their safety. - Wire transfer services like MoneyGram and Western Union are targeted specifically because transfers are fast and nearly impossible to reverse once completed. ## Key takeaways - A California mother and Navy veteran lost $5,400 in four wire transfers after scammers used an AI-cloned version of her daughter's voice to stage a fake kidnapping that never happened. - Scammers kept the California mother on the phone for five and a half hours to prevent her from calling her daughter directly, the one action that would have exposed the fraud immediately. - A private family codeword rotating every 60 seconds and shared only within a trusted group cannot be known or answered by an AI-generated caller, no matter how convincing the voice sounds. ## Frequently asked questions ### What happened to the California mother at the center of this scam? A California mother and Navy veteran received a call claiming her 37-year-old daughter had been kidnapped by a Mexican drug cartel. Scammers played an AI-cloned version of her daughter's voice, then kept the mother on the phone for five and a half hours while directing her to wire money. She sent $5,400 before calling her daughter and discovering her daughter was safe at work. ### How much money did the California mother lose in the AI voice scam? The California mother lost $5,400 across four separate wire transfers sent through MoneyGram and Western Union. Funds sent through these services are typically irreversible, making recovery unlikely. ### How did the scammers make the kidnapping sound real? Scammers used AI voice cloning to generate a convincing audio replica of the daughter's voice, simulating distress and fear. Hearing what sounded like her daughter's own voice convinced the California mother the threat was genuine, even as her daughter was safely at work. ### How could this family have protected themselves from this scam? The California mother could have asked the caller, "What are the words?" The real daughter would know the family's current three rotating codewords. An AI-generated voice cannot answer, because the codewords are private, shared only within the family group, and rotate every 60 seconds. If a codeword challenge fails, hang up, call your family member on a number you know independently, and contact authorities if you are still concerned. ### Why did the scammers keep the California mother on the phone for so long? Continuous phone contact is a deliberate control tactic. By keeping the victim on the line for five and a half hours, scammers prevented the California mother from calling her daughter directly to verify her safety. The sustained call was designed to maintain fear and block independent verification. ### Are AI voice cloning scams targeting families becoming more common? Yes. Virtual kidnapping scams using AI-cloned voices are a documented and growing threat. The technology needed to clone a voice from publicly available recordings is now widely accessible, and these scams have been reported across the United States. Families who share private rotating codewords have a simple, reliable way to verify a caller's identity. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Fools Orlando Woman Into Handing Over Cash to Couriers" published: 2026-10-06T00:06:09.114Z updated: 2026-11-01T12:41:44.148Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-fools-orlando-woman-into-handing-over-cash-to-couriers --- # AI Voice Clone Fools Orlando Woman Into Handing Over Cash to Couriers **Cite as:** AI Voice Clone Fools Orlando Woman Into Handing Over Cash to Couriers, Trust Onion, 2026-11-01. https://trustonion.io/case-studies/ai-voice-clone-fools-orlando-woman-into-handing-over-cash-to-couriers An Orlando woman handed over thousands of dollars in cash to couriers after scammers used AI voice cloning to impersonate her friend, claiming he was jailed following a drunk-driving crash involving a pregnant woman. The real man had no knowledge of the incident. ## Incident facts - **Incident date:** October 2026 - **Victim type:** Individual - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** undisclosed thousands of dollars ## Timeline - **The Setup:** Scammers gathered enough audio of her friend's voice to build a convincing AI-generated replica, likely from social media or other publicly available recordings, then identified the Orlando woman as a reachable contact. - **The Attack:** The Orlando woman received a call in which an AI-cloned voice impersonated her friend, claiming he had been arrested after a drunk-driving crash that injured a pregnant woman and urgently needed cash for his release. - **The Impact:** Convinced the caller was her friend, the Orlando woman gathered thousands of dollars in cash. Scammers sent couriers directly to her front door to collect it, leaving no digital transfer trail. - **The Discovery:** The fraud came to light when someone reached her friend, who had no knowledge of any arrest, crash, or cash request. - **The Fallout:** WKMG ClickOrlando reported the incident, bringing public attention to AI voice-cloning scams using courier cash collection in the Orlando area. ## How the attack worked When the Orlando woman's phone rang, the voice sounded exactly like her friend. Scammers had cloned it from audio likely pulled from publicly accessible sources, capturing enough of his cadence and tone to pass. The call opened with a distressing story: the caller used her friend's name and said "I need your help," followed by a claim that he had been arrested after a drunk-driving crash involving a pregnant woman and needed cash immediately to avoid serious legal consequences. The emotional architecture was deliberate. An arrest, a vulnerable crash victim, a ticking clock for payment. Each detail was chosen to create urgency and crowd out the instinct to pause and verify. Rather than requesting a wire transfer or gift cards, the scammers sent couriers to the Orlando woman's front door to collect the cash in person, a method that leaves no reversible transaction trail and makes recovery nearly impossible. ## Damage assessment The Orlando woman lost thousands of dollars in cash, physically collected by couriers and beyond the reach of any bank dispute or payment reversal. Once the couriers left her doorstep, the money was gone. Her friend had no knowledge of the call, the crash story, or the cash request. His voice had been cloned and used entirely without his awareness, from audio he had no reason to protect. ## How verification helps When the caller used her friend's name and said "I need your help," the Orlando woman had nothing to check against except the voice itself. Trust Onion gives people a private three-word challenge they can set up in advance with friends and contacts. Asking "What are the words?" takes seconds. The real man would know the current words. An impersonator using a cloned voice would not have been given them. The three codewords rotate every 60 seconds, so a word overheard once is soon out of date. Setting up Trust Onion with people who might call in an emergency takes minutes. A failed callback to the supposed caller does not prove the original call was legitimate, so a shared private codeword gives her another way to check when an urgent story and a cash request arrive together. ## Key lessons - A realistic-sounding voice is no longer proof of identity. AI voice-cloning tools can replicate a familiar person's voice from a small amount of publicly available audio, making voice alone an unreliable way to confirm who is calling. - Urgency and emotional pressure are core tools of voice-cloning scams. Slowing down to ask a verification question, even a brief one, is the most effective way to break the scam's momentum. - Cash collected by couriers cannot be recovered. Any request for physical cash pickup should be treated as a serious fraud warning sign, regardless of how convincing the caller sounds. ## Key takeaways - Scammers used AI voice cloning to impersonate her friend, convincing the Orlando woman to hand over thousands of dollars in cash collected by couriers sent to her front door. - Her friend had no knowledge of the call, the crash story, or the cash request, confirming the voice was entirely AI-generated. - A private three-word verification challenge would have given her a way to catch the impersonator: the real man would know the answer to "What are the words?" and a scammer would not have been given it. ## Frequently asked questions ### What happened in the Orlando AI voice-cloning scam? Scammers used AI voice cloning to impersonate the Orlando woman's friend, claiming he had been arrested after a drunk-driving crash involving a pregnant woman and urgently needed cash. Convinced by the realistic voice, the Orlando woman handed over thousands of dollars to couriers at her front door. Her friend had no knowledge of the incident. ### How much money did the victim lose? The Orlando woman lost thousands of dollars in cash, physically collected by couriers sent to her home. Because the payment was made in cash, there is no mechanism for a bank dispute or reversal. ### How could this scam have been prevented? A private verification challenge would have given her a way to catch the call before any money changed hands. Trust Onion lets people set up a shared three-word code with friends and contacts. When the caller claimed to be her friend, the Orlando woman could have asked "What are the words?" The real man would know. The words rotate every 60 seconds. ### How do scammers clone someone's voice? AI voice-cloning tools can generate a convincing replica from a small sample of audio, often gathered from social media videos, voicemails, or other publicly accessible recordings. The technology has become widely accessible, making voice alone an unreliable way to confirm who is calling. ### What should I do if I receive a call like this? Do not send cash or make any payment while on the call. Hang up and contact the person through a number you already have saved, not one provided by the caller. Note that a successful callback does not prove the original caller was legitimate. Use common sense and alert authorities if someone may genuinely be in danger. A private shared codeword set up in advance gives you another way to check. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Cloning Scam Defrauds Bhopal Security Guard of ₹35,000" published: 2026-10-05T00:11:16.541Z updated: 2026-11-01T12:41:42.793Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-cloning-scam-defrauds-bhopal-security-guard-of-35-000 --- # AI Voice Cloning Scam Defrauds Bhopal Security Guard of ₹35,000 **Cite as:** AI Voice Cloning Scam Defrauds Bhopal Security Guard of ₹35,000, Trust Onion, 2026-11-01. https://trustonion.io/case-studies/ai-voice-cloning-scam-defrauds-bhopal-security-guard-of-35-000 A 50-year-old security guard from Bhopal's TT Nagar area lost ₹35,000 to a cybercriminal who used a suspected AI-cloned voice to impersonate a trusted friend and claim urgent financial need. The scammer collected the money across three QR code transfers before the security guard called his actual friend and learned no such call had ever been made. ## Incident facts - **Incident date:** April 2026 - **Victim type:** Individual - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** ₹35,000 ## Timeline - **The Setup:** The fraudster gathered voice data from the security guard's friend, likely from publicly accessible audio, to build a convincing AI-cloned imitation. The security guard was identified as a reachable contact, and a scenario built around urgency and trust was prepared. - **The Attack:** The scammer called the security guard using the cloned voice, claimed an urgent financial need, then sent a QR code and directed him to complete three separate payment transfers totalling ₹35,000. - **The Impact:** The security guard completed all three transfers, believing he was helping a friend in genuine distress. The funds were gone the moment each payment cleared. - **The Discovery:** After the payments, the security guard contacted his actual friend through a separate channel and learned the friend had made no such call and was not in any financial difficulty. - **The Fallout:** The security guard reported the incident to TT Nagar police, who registered a case and began an investigation. Recovery of the funds remained uncertain at the time of reporting. ## How the attack worked The fraudster needed only a small audio sample of the security guard's friend's voice, potentially from a phone call, a social media video, or a voice message, to produce an imitation convincing enough to pass for the real person. By mimicking someone the security guard already trusted, the scammer bypassed the scepticism most people apply to calls from strangers. Urgency did the rest. When people believe a friend is in immediate distress, the impulse to help compresses decision-making time and discourages verification. Rather than request a direct bank transfer, the scammer sent a QR code and split the theft across three separate payments, possibly to keep each amount smaller and less likely to raise suspicion before the funds cleared. ## Damage assessment The security guard, on a fixed salary, transferred ₹35,000 across three payments before the deception was uncovered. Once funds move through a payment QR code, they pass quickly across accounts, making tracing and clawback operationally complex, and recovery remained uncertain at the time of reporting. Beyond the direct financial loss, incidents like this erode confidence in ordinary communications. Victims often find themselves questioning whether other calls from known contacts were genuine long after the event, disrupting personal relationships that had nothing to do with the scam. ## How verification helps If the security guard had been using Trust Onion with his friend, a single question asking the caller for the three codewords would have given him a way to catch it. The real friend would know the current words; a cloned voice on its own does not come with them, and the words rotate every 60 seconds. Trust Onion gives individuals a private challenge that works beyond a familiar voice or a recognised number, since caller ID can be spoofed and AI voice cloning can now replicate someone you know well enough to fool your ear. In this case, that check could have given him a reason to stop before the first transfer. ## Key lessons - A familiar voice on a call is no longer reliable proof of identity. AI voice cloning can replicate someone's voice convincingly enough to deceive people who know them well. - Urgency is a deliberate scam mechanism. Any request for immediate financial transfers, especially involving QR codes, should trigger verification through a separately sourced contact method. Calling the same number back does not confirm the original caller was genuine; the person you reach must still be able to answer your private three-word challenge. - Splitting a fraudulent payment across multiple smaller QR code transfers can be a tactic to avoid detection. Multiple payment requests from the same call should be treated as a red flag regardless of how trustworthy the caller sounds. ## Key takeaways - A Bhopal security guard lost ₹35,000 in April 2026 to a scammer who used AI voice cloning to impersonate a trusted friend. - The fraudster sent a QR code and split the theft across three separate transfers, possibly to make each payment less likely to raise suspicion. - A private three-word verification challenge would have given him a way to catch this attack before any money moved. ## Frequently asked questions ### What happened in the Bhopal voice cloning scam? In April 2026, a 50-year-old security guard from Bhopal's TT Nagar area received a call from someone impersonating a friend using a suspected AI-cloned voice. The caller claimed urgent financial need and directed the security guard to scan a QR code and complete three separate payments totalling ₹35,000. The security guard discovered the fraud only after contacting his actual friend, who confirmed he had made no such call. ### How much money did the security guard lose in the scam? The security guard lost ₹35,000 across three separate QR code transfers made during a single fraudulent phone call. ### How could this voice cloning scam have been prevented? A shared private verification method, such as Trust Onion's three rotating codewords, would have given him a way to catch the impersonator. The real friend would know the current words; a cloned voice on its own does not come with them. The words rotate every 60 seconds, so a word heard once is soon out of date. Trust Onion is free. ### Why did the scammer use a QR code instead of a bank transfer? QR code payments can be harder to trace and reverse than conventional bank transfers. Splitting the total across three separate transactions may also have been intended to avoid triggering fraud alerts on any single large payment. ### Is calling back the person who rang you enough to verify they are genuine? No. Calling the same number back does not confirm the original caller was who they claimed to be, since scammers can spoof numbers or use call forwarding. Use a contact number sourced independently, and the person must still answer your private Trust Onion three-word challenge before you act on any request involving money. If someone may genuinely be in danger, contact emergency services directly. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone and Fake WhatsApp Drained €95 Million From Italian Bank" published: 2026-10-01T00:11:08.149Z updated: 2026-10-11T06:13:04.432Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-and-fake-whatsapp-drained-95-million-from-italian-bank --- # AI Voice Clone and Fake WhatsApp Drained €95 Million From Italian Bank **Cite as:** AI Voice Clone and Fake WhatsApp Drained €95 Million From Italian Bank, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-voice-clone-and-fake-whatsapp-drained-95-million-from-italian-bank Fraudsters sent Fideuram chairman Paolo Molesini a spoofed WhatsApp message impersonating Intesa Sanpaolo CEO Carlo Messina, then followed with an AI-cloned voice of a senior law firm partner, together convincing him to authorize approximately €95 million in international wire transfers. International cooperation recovered roughly €53 million, but approximately €36 million remains untraced after passing through overseas accounts and conversion to cryptocurrency. ## Incident facts - **Incident date:** September 2026 - **Victim type:** Executive - **Attack type:** AI phone call - **Outcome:** Resolved - **Financial impact:** €95 million (approximately €36 million unrecovered) ## Timeline - **The Setup:** Fraudsters gathered publicly available information on Intesa Sanpaolo CEO Carlo Messina, a senior law firm partner with ties to Fideuram, and Fideuram chairman Paolo Molesini. They prepared a spoofed WhatsApp account replicating Messina's identity and synthesized enough voice material to clone the law firm partner's voice convincingly. - **The Attack:** Molesini received a WhatsApp message from an account appearing to belong to Messina, framing an urgent, confidential international transaction. A follow-up caller using an AI-cloned voice of the senior law firm partner provided apparent independent corroboration, and Molesini authorized approximately €95 million in wire transfers directed primarily to accounts in China and Hong Kong. - **The Impact:** Approximately €95 million left Fideuram accounts and moved through a chain of overseas accounts, with a portion converted to cryptocurrency, making tracing considerably harder. The dual-channel design gave the fraudulent instruction a false appearance of legitimacy from two independent, senior sources. - **The Discovery:** After the transfers completed, the instructions could not be verified through legitimate channels. It became apparent that the WhatsApp account was spoofed and the phone caller was not the actual law firm partner. - **The Fallout:** International law enforcement cooperation recovered approximately €53 million, but approximately €36 million remains untraced after moving through overseas accounts and being partially converted to cryptocurrency. The incident drew attention to gaps in wire-transfer authorization controls and the effectiveness of multi-channel AI fraud schemes. ## How the attack worked Fideuram chairman Paolo Molesini received two contacts in quick succession. First, a WhatsApp message from an account spoofed to impersonate Intesa Sanpaolo CEO Carlo Messina, framing the forthcoming transfers as urgent and confidential. Then a phone call, the caller's voice an AI clone of a senior law firm partner known to Molesini, providing what sounded like independent corroboration from a second trusted source. Molesini authorized approximately €95 million in wire transfers to accounts in China and Hong Kong. The two-channel design was the attack's core mechanism. A single suspicious message might prompt a callback; two apparently independent senior contacts arriving together manufactured the psychological effect of genuine corroboration. No technical intrusion into Fideuram's systems was required. The fraud succeeded entirely by targeting the human authorization layer, the point where a chairman's judgment was the primary control, and the fraudsters had identified it as the weakest point. ## Damage assessment The authorized wire transfers totaled approximately €95 million. International law enforcement cooperation recovered roughly €53 million, but approximately €36 million remains untraced: the funds passed through multiple overseas accounts and were partially converted to cryptocurrency before investigators could freeze them, showing how quickly digital assets move beyond practical reach. Beyond the direct loss, the incident raises pointed questions about authorization controls at major financial institutions, particularly for large international transfers. A chairman-level executive at a sophisticated institution was deceived by a spoofed message combined with an AI voice clone, and any organization that relies solely on caller familiarity and message appearance as verification controls faces the same exposure. ## How verification helps Before authorizing any wire transfer, a finance team member who asks the caller "What are the words?" would have immediately exposed the AI-cloned voice as fraudulent. The real law firm partner, had he actually been calling, would know the current three codewords shared within the authorized verification group. An impersonator controlling a voice clone cannot know those words because they rotate every 60 seconds and are calculated locally on each authorized device, with no server to compromise and no way to intercept the current codewords through call monitoring or social engineering alone. A failed callback does not prove the original caller was legitimate; the codeword challenge must still be met. The spoofed WhatsApp message would have failed the same challenge. Any protocol requiring written instructions from an executive to be accompanied by the current three codewords would have stopped this attack before a single euro moved. Executives, finance teams, and legal advisers within the authorized group each hold the same rotating words. An impersonator, regardless of how convincing the voice or message, does not. ## Key lessons - Multi-channel fraud schemes that combine written and voice impersonation are specifically designed to simulate independent corroboration. A single shared-secret verification step cuts through both channels at once. - AI voice cloning has reached a quality level where familiarity with a person's voice is no longer a reliable verification method. Finance teams need a verification control that voice cloning cannot replicate. - Wire-transfer authorization protocols that rely solely on caller identity and message appearance provide no defense against coordinated impersonation. A rotating codeword requirement adds a zero-cost control at the exact point where this attack succeeded. ## Key takeaways - Fraudsters moved approximately €95 million out of Fideuram using a spoofed WhatsApp message and an AI-cloned voice, with approximately €36 million remaining unrecovered after cryptocurrency conversion. - The attack used two separate channels simultaneously to manufacture a false appearance of independent corroboration, bypassing the chairman's judgment without breaching any technical system. - International law enforcement cooperation recovered roughly €53 million, but funds converted to cryptocurrency moved beyond practical tracing reach quickly, showing how narrow the recovery window is once transfers clear. ## Frequently asked questions ### What happened in the Fideuram €95 million fraud incident? Fraudsters sent Fideuram chairman Paolo Molesini a spoofed WhatsApp message impersonating Intesa Sanpaolo CEO Carlo Messina, then followed with a call using an AI-cloned voice of a senior law firm partner. The two-channel approach simulated independent confirmation from trusted sources, leading Molesini to authorize approximately €95 million in wire transfers to accounts in China and Hong Kong. ### How much money was lost and how much was recovered? Approximately €95 million was transferred fraudulently. International law enforcement cooperation recovered roughly €53 million. Approximately €36 million remains untraced after passing through overseas accounts and being partially converted to cryptocurrency. ### How could this wire transfer fraud have been prevented? A codeword verification protocol would have stopped this attack before any funds moved. Trust Onion's rotating three-word codewords give finance teams a challenge for any caller claiming executive authority: "What are the words?" The real executive knows the current codewords; an AI voice clone does not. The words rotate every 60 seconds, calculated locally on each authorized device, with no server to compromise. A failed callback does not prove the original caller was legitimate. ### Why was an AI voice clone used alongside a written message? The two-channel design was deliberate. A single suspicious message or call might trigger skepticism. Combining a written instruction appearing to come from the group CEO with a follow-up call appearing to come from a trusted external legal adviser manufactured the psychological effect of independent corroboration, making the instruction appear far more credible than either channel alone. ### What made the funds so difficult to recover? Transfers went to accounts in China and Hong Kong, outside European regulatory jurisdiction. A portion was then converted to cryptocurrency, which moves rapidly across borders and becomes much harder to trace and freeze. The combination of international account chains and cryptocurrency conversion placed approximately €36 million beyond practical recovery. --- title: "AI Voice Clone and Fake WhatsApp Message Cost Italian Bank €95 Million" published: 2026-09-29T00:05:47.079Z updated: 2026-10-11T06:13:05.054Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-and-fake-whatsapp-message-cost-italian-bank-95-million --- # AI Voice Clone and Fake WhatsApp Message Cost Italian Bank €95 Million **Cite as:** AI Voice Clone and Fake WhatsApp Message Cost Italian Bank €95 Million, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-voice-clone-and-fake-whatsapp-message-cost-italian-bank-95-million Fraudsters sent Fideuram Chairman Paolo Molesini a fake WhatsApp message impersonating Intesa Sanpaolo CEO Carlo Messina, then followed up with an AI-cloned voice call posing as a senior law firm partner, prompting Molesini to authorize €95 million in overseas wire transfers. International cooperation recovered approximately €53 million, but roughly €36 million was converted to cryptocurrency and remains missing. ## Incident facts - **Incident date:** September 2026 - **Victim type:** Executive - **Attack type:** AI phone call - **Outcome:** Successful fraud - **Financial impact:** €95 million transferred; approximately €53 million recovered; roughly €36 million unrecovered ## Timeline - **The Setup:** Fraudsters researched the relationship between Intesa Sanpaolo CEO Carlo Messina and Fideuram Chairman Paolo Molesini, then built a fake WhatsApp persona and an AI voice clone capable of simulating a senior law firm partner. - **The Attack:** Molesini received a WhatsApp message purportedly from CEO Carlo Messina, followed by a phone call using an AI-cloned voice posing as a senior law firm partner, who instructed him to authorize wire transfers totaling €95 million to accounts in China and Hong Kong. Molesini passed the instructions to Fideuram's finance department, which processed the transfers. - **The Impact:** Ninety-five million euros left Fideuram's accounts and were routed overseas. Approximately €36 million was rapidly converted into cryptocurrency, making recovery extremely difficult. - **The Discovery:** Fideuram's internal systems detected transaction anomalies after the transfers. The bank launched an internal review and engaged law enforcement, triggering an international effort to trace and freeze the funds. - **The Fallout:** International cooperation allowed authorities to recover approximately €53 million, while roughly €36 million converted to cryptocurrency remains unaccounted for. Molesini resigned, and Milan prosecutors placed at least one foreign national under investigation for computer fraud. ## How the attack worked A WhatsApp message crafted to appear from Intesa Sanpaolo CEO Carlo Messina landed in Fideuram Chairman Paolo Molesini's inbox, framing an urgent, confidential financial matter and priming him to expect a call from a trusted legal intermediary. The follow-up came as a phone call using an AI-generated voice clone designed to sound like a senior law firm partner, who presented the transfers as legally sanctioned and time-sensitive. Molesini relayed the instructions to Fideuram's finance department, which processed wire transfers totaling €95 million to accounts in China and Hong Kong without a verification step capable of confirming the original executive's identity. A message from a known superior, backed by a call from a credible professional, made the request look legitimate across two channels that were both fabricated. ## Damage assessment The direct loss was €95 million in outbound wire transfers. International cooperation recovered approximately €53 million, leaving roughly €36 million that was converted to cryptocurrency before detection and remains out of reach. The speed of that conversion shows the attackers planned their exit in advance. Chairman Paolo Molesini resigned, removing a senior executive from one of Italy's largest private banking groups at the same moment the institution was managing a public fraud disclosure. Milan prosecutors have placed at least one foreign national under investigation for computer fraud. Regulatory scrutiny of Fideuram's internal transfer approval procedures is a likely consequence. ## How verification helps A finance team member who challenged the instruction with "What are the words?" before approving any transfer would have stopped this attack at both layers. The real Carlo Messina would have known Fideuram's current three codewords; an impersonator sending a WhatsApp message cannot. The AI-cloned voice on the follow-up call would have faced the same question and failed the same way. Note that a failed callback alone does not prove the original caller was legitimate; the codeword challenge is the verification step, not the callback. Trust Onion's rotating codewords are calculated locally on each authorized device and change every 60 seconds, with no server to breach and no database to steal. A protocol requiring any wire transfer request above a defined threshold to be verbally challenged, regardless of the apparent sender's seniority or the urgency claimed, turns a three-second question into a check that AI voice cloning cannot defeat. ## Key lessons - Multi-channel contact, such as a WhatsApp message followed by a phone call, does not constitute independent verification. Both channels can be simultaneously spoofed by a coordinated fraud operation. - AI voice cloning can convincingly replicate executives and trusted third parties. Vocal familiarity is no longer a reliable authentication signal for high-value authorizations. - Cryptocurrency conversion is a deliberate exit strategy. Funds moved to crypto within hours of a fraudulent transfer become substantially unrecoverable, making prevention the only reliable defense. ## Key takeaways - Fraudsters used a fake WhatsApp message and an AI-cloned voice call to authorize €95 million in wire transfers from Italian private bank Fideuram in September 2026. - Approximately €36 million was converted to cryptocurrency within hours of the transfers and remains unrecovered despite international law enforcement cooperation. - The attack succeeded because two spoofed channels, a text message and a phone call, were each treated as independent confirmation of the same fraudulent instruction. ## Frequently asked questions ### What happened in the Fideuram AI voice clone fraud? Fraudsters sent Fideuram Chairman Paolo Molesini a WhatsApp message impersonating Intesa Sanpaolo CEO Carlo Messina, then followed up with an AI-cloned call posing as a senior law firm partner. Molesini authorized €95 million in overseas wire transfers. The bank detected anomalies, and international cooperation recovered approximately €53 million, but roughly €36 million converted to cryptocurrency remains missing. ### How much money was lost in the Fideuram fraud? €95 million was transferred out of Fideuram. Approximately €53 million was recovered through international law enforcement cooperation. Roughly €36 million was converted to cryptocurrency and has not been recovered. ### How could this wire transfer fraud have been prevented? A mandatory codeword challenge would have stopped both layers of the attack before any funds moved. Neither the WhatsApp impersonator nor the AI-cloned voice could have supplied Fideuram's current three rotating codewords. Trust Onion's codewords change every 60 seconds, are calculated locally on authorized devices, and give finance teams a challenge that AI voice cloning cannot defeat. ### Why was the fraudulent wire transfer difficult to reverse? Funds were sent to accounts in China and Hong Kong, requiring international legal coordination to freeze assets. Approximately €36 million was rapidly converted to cryptocurrency, placing it outside the conventional banking system. Only approximately €53 million was reachable through international cooperation. ### What verification step should finance teams add to prevent CEO fraud? Finance teams should require any executive requesting a wire transfer to verbally supply the current three rotating codewords before the request is actioned, regardless of the channel used, the apparent sender's seniority, or the urgency claimed. Trust Onion provides this rotating codeword system free of charge; the words rotate every 60 seconds and cannot be cloned or intercepted. --- title: "Michigan Couple Loses $66,000 in Real Estate Voice-Cloning Scam" published: 2026-09-28T00:37:59.441Z updated: 2026-10-18T05:20:05.061Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/michigan-couple-loses-66-000-in-real-estate-voice-cloning-scam --- # Michigan Couple Loses $66,000 in Real Estate Voice-Cloning Scam **Cite as:** Michigan Couple Loses $66,000 in Real Estate Voice-Cloning Scam, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/michigan-couple-loses-66-000-in-real-estate-voice-cloning-scam The Michigan couple, wired $66,000 to a fraudulent account after scammers used suspected AI voice cloning to impersonate trusted parties during a real estate closing. Both victims reviewed the call and missed the signs. The couple filed a complaint with the FBI's Internet Crime Complaint Center, and the investigation remains ongoing. ## Incident facts - **Incident date:** September 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $66,000 ## Timeline - **The Setup:** The Michigan couple were buying a home in Michigan and, unfamiliar with the closing process, relied on calls from their real estate agent, title company, or lender for wire transfer instructions. - **The Attack:** Scammers using suspected AI voice cloning called the couple, impersonating a trusted party in the transaction and instructing them to wire $66,000 to what appeared to be a legitimate closing account. The specific, non-round figure made the request seem credible. - **The Impact:** The Michigan couple wired $66,000 to the fraudulent account. No legitimate party received the funds, and the actual closing could not proceed. - **The Discovery:** The real closing parties reported they had not received the wired funds, and the couple realized they had been deceived by callers impersonating people they trusted. - **The Fallout:** The Michigan couple filed a report with the FBI's Internet Crime Complaint Center, and the investigation remained ongoing as of the CNN report published September 15, 2026. Both described publicly how they missed signs of the scam. ## How the attack worked The Michigan couple were targeted at the closing of a home purchase, one of the most financially concentrated moments in a consumer's life. Real estate transactions attract wire fraud because they involve large one-time transfers, multiple unfamiliar parties communicating by phone and email, and buyers with no baseline for what normal closing communication looks like. Scammers are suspected of using AI voice cloning to replicate a trusted party in the transaction, likely a real estate agent, title officer, or escrow representative. Voice cloning tools can produce convincing audio from a small sample of speech, and legitimate parties in real estate transactions routinely leave voicemails or join recorded calls that could supply that material. The use of a precise, non-round figure reinforced the deception: fraud researchers have documented that a specific amount carries more apparent legitimacy than a round number because it suggests a calculated, itemized total rather than an estimate. ## Damage assessment The direct loss was $66,000, the couple's entire wired closing funds. In real estate wire fraud, recovery rates are low; once funds move onward, retrieval through banking channels becomes unlikely even with prompt reporting. Beyond the money, the couple faced the collapse of a home purchase they had been working toward, with no guarantee the transaction could be completed or that replacement funds were available. Both stated publicly that they had missed the signs, which is consistent with voice-cloning cases where the caller sounds exactly like someone the victim knows and the content fits the expected context of an ongoing transaction. ## How verification helps For individual buyers, a shared rotating codeword established before a transaction begins offers a direct defense against this attack. When a caller claiming to be a real estate agent or title officer instructs a buyer to wire funds, asking for the current words immediately exposes an AI-generated voice: the real contact answers correctly, and an impersonator cannot. The Michigan couple and their trusted contacts could have set up a private Trust Onion group before closing, taking minutes and costing nothing. Note that a callback to a known number does not by itself confirm the original caller was legitimate; an independent pre-shared codeword, or a contact method sourced from an official document rather than the suspect call, is the necessary check. For security professionals advising clients on real estate or high-value transaction security, Trust Onion's three rotating codewords, calculated locally on each authorized device with no server connection and no central credential to steal, work as a practical two-factor identity check at the exact moment wire instructions are delivered. ## Key lessons - AI voice cloning can replicate trusted contacts convincingly enough that even two people reviewing the same call together will not detect the fraud without an independent verification method. - Real estate closings are high-value targets because large wire transfers, unfamiliar parties, and time pressure create conditions attackers exploit systematically. Anyone involved in these transactions should treat all wire instructions delivered by phone as unverified until confirmed through an independent channel. - Security teams advising clients on financial transaction security should recommend a shared codeword protocol as a lightweight, deployable identity check that defeats voice cloning regardless of how accurate the synthesized voice is. ## Key takeaways - The Michigan couple lost $66,000 in a suspected AI voice-cloning scam during a real estate closing in 2026, after scammers used a precise, non-round dollar amount to make the fraudulent wire transfer request appear legitimate. - Both victims reviewed the call and missed signs of fraud, showing that human judgment alone cannot reliably detect AI-cloned voices. - A shared rotating codeword exchanged before a transaction begins gives buyers and their trusted contacts a verification layer that AI voice cloning cannot defeat. ## Frequently asked questions ### What happened to the Michigan couple? The Michigan couple lost $66,000 after scammers used suspected AI voice cloning to impersonate trusted parties during a home purchase closing. They wired funds to a fraudulent account and discovered the loss when the legitimate closing could not proceed. The incident was reported to the FBI's Internet Crime Complaint Center, and the investigation is ongoing as of September 2026. ### How much money was lost in this real estate voice-cloning scam? The couple wired $66,000 to a fraudulent account. Real estate wire fraud recovery rates are generally low once funds have moved, and retrieval becomes harder the longer the delay between transfer and reporting. ### Why did the non-round dollar amount make the scam more convincing? Fraud researchers have documented that precise, non-round figures like $66,000 carry more apparent legitimacy than round numbers because they suggest a calculated, itemized total. Attackers use this tactic to reduce suspicion during wire transfer requests. ### How could this real estate wire fraud have been prevented? A shared identity verification protocol established before the transaction began would have stopped this attack. Rotating three-word codewords shared in a private group mean that when a caller instructs a wire transfer, asking for the current words immediately exposes an AI-generated voice. Note: a callback to a known number alone does not confirm the original caller was legitimate; an independently sourced contact method is also necessary. ### Is AI voice cloning commonly used in real estate fraud? Real estate wire fraud has been a documented, high-frequency attack category for years, historically relying on email impersonation. AI voice cloning is a significant escalation because it defeats the common defense of calling back a known contact. A callback does not by itself confirm the original caller was legitimate; a pre-shared codeword or independently sourced channel is necessary. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Stole $66,000 in Closing Funds from West Michigan Couple" published: 2026-09-21T07:31:58.673Z updated: 2026-10-18T05:19:55.721Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-stole-66-000-in-closing-funds-from-west-michigan-couple --- # AI Voice Clone Stole $66,000 in Closing Funds from West Michigan Couple **Cite as:** AI Voice Clone Stole $66,000 in Closing Funds from West Michigan Couple, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/ai-voice-clone-stole-66-000-in-closing-funds-from-west-michigan-couple A West Michigan couple lost $66,000 in closing funds after scammers used an AI-cloned voice, a spoofed phone number, and a fraudulent email domain to impersonate their mortgage professional. The fraud went undetected until the morning of closing, when the title company called to ask why no certified funds had arrived. ## Incident facts - **Incident date:** September 2026 - **Location:** West Michigan, Michigan, United States - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $66,000 ## Timeline - **The Setup:** Scammers gathered details about the couple's home purchase, identified their loan officer, spoofed the mortgage professional's phone number, and registered a fraudulent email domain that closely resembled the legitimate one. - **The Attack:** Scammers called the husband from the spoofed number using an AI-cloned voice, then followed up with a fraudulent email carrying fabricated wiring instructions. Believing he was confirming a routine step with his loan officer, he transferred $66,000 to the account the criminals specified. - **The Impact:** The couple's entire closing fund, $66,000, went to a scammer-controlled account. The couple had no reason to suspect anything was wrong until the morning of closing. - **The Discovery:** On the morning of closing, the title company called to confirm the couple would be bringing certified funds, revealing that no money had arrived through legitimate channels. The fraud was then reported. - **The Fallout:** The couple faced the loss of $66,000, a disrupted closing, and an uncertain path to recovering the funds. The incident became a documented example of AI-assisted real estate wire fraud targeting homebuyers at a moment of significant financial vulnerability. ## How the attack worked Scammers built the attack in three coordinated layers. They identified the mortgage professional handling the couple's loan, registered a fraudulent email domain that differed from the real one by a small, easy-to-miss detail, and spoofed the loan officer's actual phone number so the husband's caller ID showed a trusted contact. The voice on the line was AI-cloned to reproduce the cadence and tone he recognized from prior conversations. What the husband heard was a familiar name on his caller ID, a recognizable voice, and a follow-up email from what looked like the right address. Real estate closings involve large transfers on tight timelines, and wiring instructions from a mortgage professional are a normal part of that process. Nothing in his experience of the call would have flagged an obvious inconsistency. ## Damage assessment The couple lost $66,000, the full amount of their closing funds. Wire transfers are extremely difficult to reverse; funds moved to scammer-controlled accounts are typically withdrawn or forwarded within hours, leaving little practical window for a clawback even when fraud is reported quickly. Beyond the direct financial loss, the couple faced a disrupted closing and uncertainty about whether their home purchase could proceed at all. Losing the savings set aside for a new home, at the moment a family expects to be celebrating, carries an emotional cost the dollar figure alone doesn't capture. ## How verification helps When the AI-cloned voice called the husband claiming to be his loan officer, one question would have changed the outcome: 'What are the words?' Families using Trust Onion share three private codewords that rotate every 60 seconds, calculated locally on each device. A scammer who has cloned someone's voice cannot know the current words. A voice that cannot answer is not the person it claims to be. Before following any wiring instruction received by phone, ask for the words. If the caller cannot answer, hang up and call back using a number sourced independently, such as one from the lender's official website or a business card obtained in person. Note that a successful callback alone does not confirm the original caller was legitimate; the caller must still know your private Trust Onion three words. If you believe you may have been defrauded, contact your bank immediately and report the incident to local law enforcement and the FBI's Internet Crime Complaint Center at ic3.gov. ## Key lessons - AI voice cloning can reproduce a trusted person's voice convincingly enough to fool someone who knows them well, especially when combined with spoofed caller ID and a matching fraudulent email. - Real estate closings are a high-value, time-pressured target. Scammers study the transaction timeline and strike when buyers are most likely to act quickly on wiring instructions. - A shared Trust Onion group gives families and their trusted contacts three private rotating codewords that spoofed phones, cloned voices, and fake email domains cannot replicate. Asking 'What are the words?' before acting on any wiring instruction creates a verification layer no impersonator can defeat. ## Key takeaways - A West Michigan couple lost $66,000 in closing funds to a voice cloning scam in September 2026, after scammers combined an AI-cloned voice, a spoofed phone number, and a fraudulent email domain to impersonate their mortgage professional. - The fraud went undetected until the morning of closing, when the title company called to confirm certified funds that had never arrived. Wire transfers to scammer accounts are rarely recovered once completed. - Families who share Trust Onion's three rotating codewords with their mortgage professional and other closing contacts can ask 'What are the words?' the moment any suspicious call arrives. An impersonator cannot answer. ## Frequently asked questions ### What happened to the West Michigan couple? The couple of West Michigan lost $66,000 in home closing funds after scammers used an AI-cloned voice, a spoofed phone number, and a fraudulent email domain to impersonate their mortgage professional. The fraud was discovered on the morning of closing when the title company confirmed no funds had arrived through proper channels. ### How much money did the couple lose? The family lost $66,000, the full amount of their closing funds. Wire transfers are extremely difficult to reverse once completed, and funds moved to scammer-controlled accounts are typically withdrawn quickly, leaving a very narrow window for recovery even after the fraud is reported. ### How could this have been prevented? If the husband and his mortgage professional had shared a Trust Onion group before closing, he could have asked for the three rotating codewords the moment the caller claimed to be his loan officer. The real professional would have known the current words; the AI-cloned voice would not. Before acting on any wiring instruction, verify the caller knows your private three words, then confirm details through an independently sourced contact method. ### Why are homebuyers particularly vulnerable to this type of scam? Home purchases involve large wire transfers on tight, stressful timelines. Buyers are conditioned to follow instructions from their professional team quickly. Scammers who monitor real estate transactions understand this and time their attacks to coincide with the closing window, when a buyer is most emotionally invested and most likely to act on an urgent instruction from a trusted-sounding advisor. ### What should homebuyers do to protect themselves from AI voice fraud? Set up a Trust Onion group with your mortgage professional, real estate agent, and title company before any sensitive instructions are exchanged. Require that anyone calling with wiring instructions answer the current three codewords. A successful callback alone does not confirm the original caller was legitimate; the caller must also know your private Trust Onion three words. If defrauded, contact your bank immediately and file a report at ic3.gov. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Scotch Plains Resident Loses $3,100 to Family Impersonator on Social Media" published: 2026-09-19T00:04:10.555Z updated: 2026-11-04T15:00:11.247Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/scotch-plains-resident-loses-3-000-in-family-impersonation-scam --- # Scotch Plains Resident Loses $3,100 to Family Impersonator on Social Media **Cite as:** Scotch Plains Resident Loses $3,100 to Family Impersonator on Social Media, Trust Onion, 2026-11-04. https://trustonion.io/case-studies/scotch-plains-resident-loses-3-000-in-family-impersonation-scam A Scotch Plains, New Jersey resident sent $3,100 through several transactions to someone who made contact on social media and posed as a family member, according to the Scotch Plains Police blotter. The resident reported the loss on Sept. 16, 2026, and the incident remains under investigation. ## Incident facts - **Incident date:** September 2026 - **Location:** Scotch Plains, New Jersey, United States - **Victim type:** Individual - **Outcome:** Successful fraud - **Financial impact:** $3,100 ## Timeline - **The Contact:** Someone contacted the resident through social media and posed as a family member. - **The Payments:** Believing the person was a family member, the resident sent a total of $3,100 through several transactions. - **The Report:** The resident reported the loss to the Scotch Plains Police Department. The incident remains under investigation. ## How the attack worked Someone reached the resident through social media and claimed to be a family member. The police report does not say what story the person told or how the payments were requested. It says the resident, believing the person was family, sent a total of $3,100 through several transactions. Family impersonation on social media works because a message that appears to come from a relative arrives with trust already attached. The usual safeguard, a call to the relative on a number you already have, only helps if it happens before the money moves. ## Damage assessment The resident lost $3,100. The police report does not say whether any of it has been recovered, and the case remains under investigation. The Federal Trade Commission warns that impostors pressure people to act fast because it is "an emergency," and ask for payment methods such as wire transfers that are difficult to reverse. Spread across several transactions, the payments still added up to $3,100. ## How verification helps Scotch Plains police advise against relying on contact details a suspected scammer provides. Instead, contact the person on a number you already have for them, or check with another relative about their situation. A shared codeword adds a check that works inside a message thread too. If the family used Trust Onion, the resident could have replied with one question: "What are the words?" A real family member opens the app and gives the current three codewords, which rotate every 60 seconds. Someone posing as family on social media does not have them. If the words don't come, stop and reach the relative on a number you already know. A callback alone does not confirm the original sender; the real family member must still supply the current three words. ## Key lessons - Treat a request for money from a family member on social media as unverified until you confirm it on a number you already have for them. - Check with another relative or a trusted person about the family member's situation before sending money, as Scotch Plains police advise. - Families who share Trust Onion codewords can ask for the current three words in any channel, including social media messages, before any money is sent. ## Key takeaways - A Scotch Plains, NJ resident sent $3,100 through several transactions to someone who posed as a family member on social media, according to the police blotter. - The resident reported the loss on Sept. 16, 2026, and the incident remains under investigation. - Police advise verifying unexpected money requests by contacting the person on a number you already have, not one the requester provides. ## Frequently asked questions ### What happened in the Scotch Plains family impersonation scam? Someone contacted a Scotch Plains, New Jersey resident through social media and posed as a family member. Believing the person was family, the resident sent a total of $3,100 through several transactions. The resident reported it to police on Sept. 16, 2026, and the incident remains under investigation. ### How much money was lost in this scam? $3,100, sent in several transactions, according to the Scotch Plains Police blotter. The FTC warns that payments such as wire transfers can be difficult to reverse once sent. ### How could a family protect itself from this type of scam? Set up Trust Onion together before anyone needs it. When a message or call from a family member asks for money, ask: 'What are the words?' A real family member gives the current rotating codewords; an impostor on social media does not have them. If the words don't come, contact the relative on a number you already have. A callback alone does not confirm the original sender. ### What tips did Scotch Plains Police offer after this scam? The department advises residents to stop and independently verify unexpected requests for money or personal information, not to rely on a phone number provided by a suspected scammer, and to contact the person on a number they already have or check with another relative or trusted person. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Texas Grandfather Loses $1,000 to AI Voice Clone of Grandson" published: 2026-09-16T00:03:40.720Z updated: 2026-10-18T05:20:09.535Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/texas-grandfather-loses-1-000-to-ai-voice-clone-of-grandson --- # Texas Grandfather Loses $1,000 to AI Voice Clone of Grandson **Cite as:** Texas Grandfather Loses $1,000 to AI Voice Clone of Grandson, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/texas-grandfather-loses-1-000-to-ai-voice-clone-of-grandson Fraudsters cloned the voice of a Texas teenager and called his grandfather claiming the teenager was stranded in Mexico and needed $1,000. The teenager's father appeared on Good Morning America in May 2023 to warn other families after the money was sent and never recovered. ## Incident facts - **Incident date:** May 2023 - **Location:** Texas, United States - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $1,000 ## Timeline - **The Setup:** Fraudsters gathered audio of the Texas teenager, most likely from his public social media profiles, and used AI tools to clone his voice convincingly enough to deceive a family member who knew him well. - **The Attack:** The scammers called the teenager's grandfather using the cloned voice, claiming the teenager was in trouble in Mexico and urgently needed $1,000. - **The Impact:** Convinced he was hearing his real grandson in distress, the grandfather sent $1,000 to the fraudsters before anyone else in the family could verify the story. - **The Discovery:** The grandfather contacted other family members, who confirmed the teenager was safe and had never been in Mexico. - **The Fallout:** The teenager's father took the family's experience public on Good Morning America to warn other families. The $1,000 was not recovered. ## How the attack worked The scammers needed two things: a voice sample and a phone number for a family member likely to respond with urgency. Both were accessible through the Texas teenager's public social media. AI voice-cloning tools available in 2023 can generate convincing audio from just a few seconds of sample material, the kind routinely posted in videos, reels, and voice messages. The fabricated scenario was designed to short-circuit doubt: a beloved grandson, stranded in a foreign country, desperate for help. The FTC reported that impersonator scams were the single highest-reported scam category in 2022, with total losses reaching $2.6 billion. The family's case reflects a fast-growing subset of those incidents where AI voice cloning replaces cruder impersonation methods, raising the believability of the fraud substantially. ## Damage assessment The grandfather lost $1,000 that was never recovered. For many older adults on fixed incomes, a loss that size carries real financial weight beyond the dollar figure. The broader damage was emotional. During the call, the teenager's grandfather believed his grandson was in serious danger, and that fear does not disappear when the fraud is uncovered. By going public on Good Morning America, the teenager's father turned the family's loss into a warning that reached millions of viewers, a consequence the scammers almost certainly did not anticipate. ## How verification helps When the caller claimed to be the teenager and pleaded for emergency money, one question could have stopped it cold: "What are the words?" The real teenager shares three private Trust Onion codewords with his family and would have known immediately. An AI-generated impersonator cannot know rotating codewords that only authorized family members hold. Note that a failed callback alone does not prove the original caller was legitimate; the caller must still know the family's private codewords. Trust Onion's three codewords rotate every 60 seconds and are calculated locally on each family member's device, with no server to breach and no way for a scammer to intercept or guess the current words. Even a perfect voice clone fails the moment the grandfather asks for the words. ## Key lessons - AI voice-cloning tools can replicate a familiar voice convincingly enough to deceive close family members, including people who have known the real person for years. - Public social media audio and video gives scammers the raw material they need to clone a voice. Limiting who can see and hear content posted by family members reduces that exposure. - Families who share three private Trust Onion codewords can ask "What are the words?" before acting on any emergency request. Because the words rotate every 60 seconds and exist only on authorized devices, a cloned voice cannot answer correctly. ## Key takeaways - A Texas grandfather lost $1,000 after AI cloned his grandson's voice and fabricated an emergency in Mexico. - The FTC reported $2.6 billion in losses from impersonator scams in 2022, with AI voice cloning making those scams harder to detect. - Trust Onion's three rotating codewords, asked as a simple challenge during any suspicious call, would have exposed the fake voice before any money changed hands. ## Frequently asked questions ### What happened to the family in this incident? Fraudsters used AI to clone the voice of a Texas teenager and called his grandfather claiming the teenager was in trouble in Mexico and needed $1,000. The grandfather believed it was really his grandson and sent the money. The teenager's father later appeared on Good Morning America to warn other families. ### How much money did the family lose? The grandfather lost $1,000. The money was not recovered. ### How did the scammers clone the teenager's voice? Scammers most likely sourced audio from the teenager's public social media profiles. AI voice-cloning tools available in 2023 can generate convincing replicas from short audio samples, making publicly posted videos and clips a key vulnerability. ### How could this scam have been prevented? If the family had set up Trust Onion, the grandfather could have asked "What are the words?" before acting. Trust Onion gives families three private codewords that rotate every 60 seconds, stored only on authorized devices. The real teenager would have known them. An AI impersonator would not. ### Are AI voice scams targeting families common? Yes. The FTC reported that impersonator scams were the most-reported scam category in 2022, with $2.6 billion in total losses. AI voice cloning has made these scams more convincing and harder to detect without a pre-arranged verification method like shared family codewords. --- title: "Bay Area Mom Loses $5,400 in AI Voice Clone Kidnapping Hoax" published: 2026-09-05T20:04:13.853Z updated: 2026-10-18T05:20:00.288Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/bay-area-mom-loses-5-400-in-ai-voice-clone-kidnapping-hoax --- # Bay Area Mom Loses $5,400 in AI Voice Clone Kidnapping Hoax **Cite as:** Bay Area Mom Loses $5,400 in AI Voice Clone Kidnapping Hoax, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/bay-area-mom-loses-5-400-in-ai-voice-clone-kidnapping-hoax A Bay Area mother lost $5,400 after scammers called claiming her daughter had been kidnapped by a Mexican drug cartel and played an AI-cloned audio clip of her daughter's panicked voice as proof. Kept on the phone for five hours, the mother wired the money to Mexico before discovering the kidnapping was entirely fabricated. ## Incident facts - **Incident date:** May 2026 - **Location:** Martinez, California, United States - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $5,400 ## Timeline - **The Setup:** Scammers pulled audio of the daughter's voice from her social media profiles and used AI voice-cloning tools to generate a convincing recreation of her sounding distressed. Authorities note that just a few seconds of publicly available audio is enough to produce a usable voice clone. - **The Attack:** Scammers called the Bay Area mother claiming her daughter had been kidnapped by a Mexican drug cartel, then played the AI-cloned audio clip of her daughter screaming and crying as fabricated proof. They kept the mother on the phone for five hours, issuing urgent instructions and demanding she wire money to Mexico immediately. - **The Impact:** Under sustained psychological pressure and convinced she was hearing her daughter's real voice, the mother wired $5,400 to Mexico before she had any opportunity to verify her daughter's whereabouts. - **The Discovery:** The mother eventually learned that her daughter had never been kidnapped. Her daughter was safe and entirely unaware of the hoax carried out in her name using her cloned voice. - **The Fallout:** The $5,400 wired to Mexico was not recovered. Bitdefender documented the incident as part of a broader warning about AI voice cloning in virtual kidnapping scams, which authorities describe as a growing 'scamdemic' targeting families across the country. ## How the attack worked When the Bay Area mother answered the call, scammers told her her daughter had been kidnapped by a Mexican drug cartel, then immediately played a cloned audio clip of her daughter's voice, panicked and pleading, before the mother had a moment to think. AI voice-cloning tools need only a few seconds of source audio, and the scammers had pulled plenty from the daughter's social media. The five-hour call was deliberate. Keeping the mother continuously on the line stopped her from hanging up to call her daughter directly, contact family, or reach the police. The unbroken stream of urgent commands moved her from shock to financial compliance without a break in pressure, and once she wired the money, the call ended. International wire transfers to Mexico are extremely difficult to reverse, and the funds were effectively unrecoverable from the moment they were sent. ## Damage assessment The Bay Area mother wired $5,400 to Mexico before the fraud was discovered, and because the transfer completed first, there was no practical avenue for retrieval. The daughter's voice had been taken from her social media without her knowledge, then used to victimize her mother; neither woman was responsible for the attack, yet both were harmed by it. Beyond the money, the mother spent five hours in acute fear, convinced she was hearing her daughter in genuine distress. Authorities describe AI-assisted virtual kidnapping as a growing 'scamdemic' targeting families across the United States, and this case is precisely the kind of incident they mean. ## How verification helps When the caller played the cloned audio clip, the mother had no tool to cut through it in seconds. A family codeword system would have changed that: if she had reached her daughter and asked 'What are the words?', her daughter would have answered with the current three codewords immediately. A scammer holding a voice clip cannot do that, and the call would have been exposed before a single dollar moved. Note that calling back a number provided by a suspicious caller is not safe on its own, since that number may itself be controlled by the scammer; always reach your family member through a number you already know. Trust Onion's three codewords rotate every 60 seconds and are calculated locally on each family member's device, so there is nothing to breach or steal. The scammers had a convincing audio clip of the daughter's voice, but they did not have her, and a codeword challenge would have made that difference clear before the five-hour pressure campaign had a chance to work. ## Key lessons - AI voice cloning requires only a few seconds of publicly available audio, meaning anyone with a social media presence is a potential source for a fabricated voice. - Keeping the victim on the phone continuously for hours is a deliberate tactic to prevent independent verification. Any caller who refuses to let you hang up and call the person directly is a warning sign. - A shared family verification system where members ask 'What are the words?' and receive the current three rotating codewords in response cannot be defeated by a voice clone, because the clone does not know the current words. ## Key takeaways - A Bay Area mother lost $5,400 to scammers who cloned her daughter's voice from social media and staged a fake kidnapping call lasting five hours. - AI voice-cloning tools need only seconds of source audio, and social media gives scammers all they need to produce a clip convincing enough to deceive a parent under acute stress. - Scammers kept the mother on the phone to stop her from calling her daughter directly; a rotating family codeword challenge would have exposed the fraud before any money was wired. ## Frequently asked questions ### What happened to the Bay Area mother in this incident? Scammers called the mother claiming her daughter had been kidnapped by a Mexican drug cartel, then played an AI-cloned audio clip of her daughter's panicked voice as false proof. After five hours under sustained pressure, the mother wired $5,400 to Mexico. Her daughter was safe and unharmed throughout; the kidnapping was entirely fabricated. ### How much money was lost and was it recovered? The mother lost $5,400, wired to Mexico during the call. Wire transfers of this kind are extremely difficult to reverse once completed, and the funds were not recovered. ### How did the scammers clone the daughter's voice? They pulled audio from the daughter's social media profiles. AI voice-cloning tools can generate a convincing replica from just a few seconds of source material, enough to produce a clip that sounds credible to a parent under acute stress. ### How could this have been prevented? If the family had used rotating three-word codewords, the mother could have asked her daughter 'What are the words?' through a number she already knew. The daughter would have answered instantly; a scammer with a voice clip cannot. The codewords rotate every 60 seconds and are calculated locally, so there is nothing to steal. Never call back a number the suspicious caller provides. ### Why did the scammers keep the mother on the phone for five hours? Keeping the victim continuously on the line is a deliberate tactic in virtual kidnapping fraud. It stops the target from calling the supposed victim directly, contacting family, or reaching law enforcement. Sustained pressure over hours is designed to move someone from shock to financial compliance without a moment to verify independently. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Mimics Sister in Kidnapping Ransom Scam" published: 2026-09-05T20:02:29.961Z updated: 2026-10-11T06:13:07.268Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-mimics-sister-in-kidnapping-ransom-scam --- # AI Voice Clone Mimics Sister in Kidnapping Ransom Scam **Cite as:** AI Voice Clone Mimics Sister in Kidnapping Ransom Scam, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-voice-clone-mimics-sister-in-kidnapping-ransom-scam The mother of Patrick and Ryan Coughlin received a phone call in which an AI-generated voice mimicked her daughter in distress, with a separate caller demanding ransom for her release. The near-miss led the brothers to found Savi Security, which raised $7 million in seed funding and launched in July 2026. ## Incident facts - **Incident date:** 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Prevented - **Financial impact:** undisclosed ## Timeline - **The Setup:** Scammers sourced audio of the Coughlin daughter, likely from public social media content, and used it to train an AI voice model capable of producing a convincing imitation. - **The Attack:** A caller contacted the brothers' mother by phone, playing an AI-generated voice mimicking her daughter in distress while a separate voice demanded a ransom payment for the daughter's safe return. - **The Impact:** The mother experienced severe psychological distress. Hearing what she believed was her daughter's voice in danger was traumatic enough that her sons built a company in response. - **The Discovery:** The scam was identified before any payment was made. The daughter was confirmed to be safe, though specific details of how the family confirmed it was a hoax were not reported. - **The Fallout:** Patrick and Ryan Coughlin founded Savi Security, citing the incident as the direct catalyst, and raised $7 million in seed funding to launch an app offering real-time live-call monitoring. ## How the attack worked Scammers pulled audio of the Coughlin brothers' sister from public sources, most likely social media clips, and used AI voice synthesis to model her speech. That voice played live over a phone call to their mother, creating the impression her daughter was in danger and being held against her will. A separate voice then issued the ransom demand. The operation required no physical access to anyone. A few seconds of audio were enough to build a working voice model, and the call could be placed remotely at low cost. This type of scam exploits a deeply instinctive parental response: hearing a child's voice in apparent distress overrides rational skepticism, leaving little room for verification before the pressure to act takes hold. ## Damage assessment No money was lost. The attack was identified before any payment was made, placing this firmly in the near-miss category. Even so, believing, even briefly, that a child is in danger and in pain is traumatic regardless of whether a payment follows, and the psychological toll on the Coughlin mother was real. The incident also carries a secondary cost measured in redirected lives. Patrick and Ryan Coughlin channeled significant personal and professional resources into founding Savi Security, raising $7 million to build consumer protection tools that did not exist when their mother was targeted. ## How verification helps When the AI-generated voice played, the mother had no ready way to confirm whether it was real. A prior agreement on three rotating codewords through Trust Onion would have given her a direct tool: before fear could take hold, she could have asked the caller to provide the current words. A real family member would know them. An AI voice clone cannot, because the words change every 60 seconds and are never stored on a server that can be accessed or stolen. Families set up Trust Onion together in advance so every member shares the same rotating words at any moment. If a call comes in claiming a loved one is in danger, anyone in the family can ask for the words. A Proofie™, a selfie signed using a passkey in the Trust Onion app, can also let a family member confirm their identity and location in a verifiable, tamper-evident record. Note that a failed callback to the original number does not prove the first caller was legitimate; always use a number from an independent source, and alert authorities if someone may genuinely be in danger. ## Key lessons - AI voice cloning requires only a small amount of publicly available audio to produce a convincing imitation of a family member's voice. - Virtual kidnapping ransom calls are designed to create panic that overrides rational thinking. A pre-agreed verification method, such as Trust Onion's three rotating codewords, gives families a way to pause and check before reacting. - Near-miss incidents carry real psychological costs even when no money is lost, and they demonstrate that these attacks are not hypothetical. ## Key takeaways - AI voice cloning allowed scammers to mimic the Coughlin family's daughter closely enough to convince her mother the voice was real during a fake kidnapping call. - The incident directly inspired the founding of Savi Security, which raised $7 million in seed funding to build real-time scam detection tools for consumers. - A simple pre-agreed verification challenge, asking for Trust Onion's three rotating codewords, can expose a voice clone in seconds before any payment decision is made. ## Frequently asked questions ### What happened in the Coughlin family AI ransom scam? The mother of Patrick and Ryan Coughlin received a call featuring an AI-generated voice mimicking her daughter in distress, while a separate caller demanded ransom. The daughter was safe, and no payment was reported. The incident led the brothers to found Savi Security. ### How much money was lost in this incident? No money was lost. The attack was identified before any payment was made, making it a near-miss. Even so, the psychological impact was severe enough to prompt the brothers to found a consumer security company. ### How could the Coughlin family have verified the call instantly? If the family had set up Trust Onion's three rotating codewords in advance, the mother could have asked the caller to provide the current words. A real family member would know them. An AI voice clone cannot, because the words change every 60 seconds and are never stored on a server that can be accessed or stolen. ### What is a virtual kidnapping ransom scam? A virtual kidnapping ransom scam is a phone-based fraud in which callers falsely claim to have abducted a family member and demand immediate payment. In AI-assisted versions, scammers use voice cloning technology to play audio mimicking the supposed victim, making the claim feel more credible. ### What is Savi Security and why was it founded? Savi Security is a consumer app founded by brothers Patrick and Ryan Coughlin after their mother nearly fell victim to an AI voice clone ransom scam. The app offers real-time live-call monitoring to detect scams as they happen. The company raised $7 million in seed funding and launched in July 2026. --- title: "AI Voice Clone Fools Canadian Mother in Family Emergency Scam" published: 2026-09-05T20:00:54.760Z updated: 2026-10-18T05:19:51.374Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-fools-canadian-mother-in-family-emergency-scam --- # AI Voice Clone Fools Canadian Mother in Family Emergency Scam **Cite as:** AI Voice Clone Fools Canadian Mother in Family Emergency Scam, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/ai-voice-clone-fools-canadian-mother-in-family-emergency-scam A Canadian mother received a phone call in which an AI-generated voice closely mimicked her son's, claiming he was in trouble and demanding money immediately. She noticed red flags and sent nothing, while in 2024 Canadians reported losing nearly C$3 million to family-emergency and grandparent voice-cloning scams. ## Incident facts - **Incident date:** July 2026 - **Victim type:** Elderly individual - **Attack type:** Voice cloning - **Outcome:** Prevented - **Financial impact:** undisclosed ## Timeline - **The Setup:** Scammers harvested voice samples from the Canadian mother's son's social media profiles and trained an AI voice-cloning tool to replicate his voice with convincing accuracy. - **The Attack:** The Canadian mother received a phone call from an AI-generated voice mimicking her son, claiming he was in trouble and pressuring her to send money immediately. - **The Impact:** The Canadian mother was shaken by the realism of the cloned voice and nearly complied, though no money was transferred. The emotional distress of believing a loved one was in danger was real. - **The Discovery:** Inconsistencies in what the voice said and how it responded raised the Canadian mother's suspicion, and she verified the situation before sending any funds. - **The Fallout:** The Canadian mother shared her experience publicly, contributing to reporting on voice-cloning scams across Canada and prompting consumer guidance, including the recommendation to set up a family codeword. ## How the attack worked The call started long before the Canadian mother picked up the phone. Scammers pulled audio from her son's social media, fed it into an AI voice-cloning tool, and produced an imitation close enough to trigger an immediate emotional response. Modern tools need only seconds of source material, and platforms like Instagram, TikTok, Facebook, and YouTube supply it freely. Once the clone was ready, the caller contacted the Canadian mother directly. The AI-generated voice claimed her son was in danger and in urgent need of money, a script designed to compress her decision-making time and prevent any rational evaluation of the situation. She noticed red flags, including inconsistencies in the voice and the demands, and that hesitation was enough. In 2024, not every target was as fortunate: Canadians reported losing nearly C$3 million to family-emergency and grandparent scams that used voice-cloning technology. ## Damage assessment The Canadian mother avoided a direct financial loss by recognizing warning signs before transferring any money. The psychological toll of believing, even briefly, that her son was in serious danger is a real harm that no figure captures. At the national level the losses are concrete: Canadian victims reported losing nearly C$3 million to voice-cloning family emergency scams in 2024, and fraud reporting consistently undercounts actual losses since many victims never come forward. When a parent can no longer rely on the sound of their child's voice as confirmation of identity, a basic assumption of daily life breaks down. ## How verification helps When the caller claimed to be the Canadian mother's son and asked for money, one question could have resolved the situation in seconds: 'What are the words?' A grandparent or older adult using Trust Onion shares three private codewords with their family. Those words rotate every 60 seconds, calculated locally on each device. The real son would know the current words. An AI voice clone would not. If a caller claiming to be a family member cannot answer correctly, the call is not from that person, no matter how familiar the voice sounds. If you then choose to call back, use a number you already have stored for that person, not one the caller provides, and remember that a failed callback alone does not prove the original caller was legitimate. A Proofie™ adds another layer: a selfie signed with a passkey at the moment it is taken, letting a family member verify the exact photo, the signing key, and the time through the Trust Onion app. In a moment of panic, an established verification habit removes the need to rely on emotion alone. ## Key lessons - AI voice-cloning tools can replicate a person's voice from audio samples pulled from public social media, requiring no direct access to the target. - Scammers engineer urgency deliberately to prevent victims from pausing to verify. Any caller who pressures you not to hang up and call back independently should be treated as a red flag. Calling back on a number the original caller provides is not safe; use a number you already have stored or look one up independently, and note that a failed callback alone does not prove the original caller was legitimate. - A pre-arranged rotating verification phrase shared with family is one of the most effective and lowest-cost defenses against voice-cloning impersonation scams. Trust Onion gives grandparents and older adults three codewords that change every 60 seconds, so a cloned voice alone is never enough to pass verification. ## Key takeaways - Canadians reported losing nearly C$3 million to voice-cloning family emergency scams in 2024, and fraud reporting consistently undercounts actual losses. - AI tools can clone a person's voice using only a few seconds of audio sourced from social media posts or videos. - Family emergency scams are specifically designed to trigger panic and compress decision-making time. A pre-established verification habit, like asking 'What are the words?', removes the need to rely on emotional judgment alone. ## Frequently asked questions ### What happened in the Canadian mother's voice-cloning incident? A Canadian mother received a phone call in which an AI-generated voice closely mimicked her son's. The caller claimed he was in trouble and needed money urgently. She noticed inconsistencies during the call, grew suspicious, and did not send any funds. Her experience was reported as part of broader coverage of voice-cloning scams affecting Canadian families. ### How much money have Canadians lost to voice-cloning family scams? In 2024, Canadians reported losing nearly C$3 million to family-emergency and grandparent scams using AI voice-cloning technology. Fraud reporting typically undercounts actual losses, so the real total is likely higher. ### How do scammers clone someone's voice? Scammers use AI voice-cloning tools that generate a convincing imitation from audio samples found on social media, including videos on Instagram, TikTok, Facebook, or YouTube. Even a short clip can provide enough material for the technology to work. ### How could this scam have been stopped? A rotating family verification codeword would have stopped the call immediately. With Trust Onion, grandparents share three codewords with family members; those words change every 60 seconds and are calculated locally on each device. When the caller claimed to be her son, the Canadian mother could have asked 'What are the words?' The real son would know. An AI voice clone cannot. ### What red flags should older adults watch for in voice-cloning scams? Watch for extreme urgency, pressure not to hang up, requests for immediate money transfers or gift card purchases, and emotional appeals designed to prevent clear thinking. Any call asking for money on behalf of a family member should prompt the question 'What are the words?' If you call back, use a stored number, not one the caller provides, and note a failed callback alone does not confirm the original caller was legitimate. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Fakes Daughter's Kidnapping, Pressures Mother for $3,270" published: 2026-09-05T19:59:18.154Z updated: 2026-10-18T05:19:47.323Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-fakes-daughter-s-kidnapping-pressures-mother-for-3-270 --- # AI Voice Clone Fakes Daughter's Kidnapping, Pressures Mother for $3,270 **Cite as:** AI Voice Clone Fakes Daughter's Kidnapping, Pressures Mother for $3,270, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/ai-voice-clone-fakes-daughter-s-kidnapping-pressures-mother-for-3-270 A mother answered a call displaying her college-aged daughter's real phone number, heard an AI-cloned version of her daughter's voice claim she had been in an accident and taken captive, and spent nearly two hours being pressured to wire $3,270 to Mexico. Her real daughter called on a separate line before any money moved, exposing the fraud. ## Incident facts - **Incident date:** January 2026 - **Location:** Missouri, United States - **Victim type:** Organization - **Attack type:** Voice cloning - **Outcome:** Prevented - **Financial impact:** $3,270 ## Timeline - **The Setup:** Scammers harvested audio of the mother's daughter from social media, voicemails, or other public recordings, then spoofed the daughter's real phone number. Cybersecurity experts confirm that as little as two seconds of source audio is enough to generate a convincing voice clone. - **The Attack:** The mother answered a call displaying her daughter's number; the AI-cloned voice claimed her daughter had been in an accident and was being held captive. A second person on the call posed as the captor and demanded a $3,270 wire transfer to Mexico, sustaining pressure for nearly two hours. - **The Impact:** The mother spent close to two hours in acute distress, believing her daughter was in danger, while being guided toward completing an international wire transfer. - **The Discovery:** While still on the scam call, the mother's real daughter reached her on a separate line. Hearing her daughter's actual voice confirmed the call was fraudulent and stopped the wire transfer before any money left the mother's account. - **The Fallout:** No funds were lost, but cybersecurity experts cited the incident publicly to warn other families. Investigators noted that scammers need as little as two seconds of voice audio from social media or voicemails to produce convincing fakes. ## How the attack worked Scammers collected a short voice sample from publicly available sources, most likely social media videos or voicemail greetings, then used number spoofing to make the mother's phone display her daughter's real mobile number. That detail alone bypassed her initial skepticism. When she answered, the cloned voice delivered an urgent message: her daughter had been in an accident and was in the hands of captors demanding money for her release. A second actor then took over as the supposed kidnapper, a known two-person structure in virtual kidnapping scams. One voice supplies the emotional hook; the other applies sustained pressure toward payment. The mother stayed on the call for nearly two hours while being directed to wire $3,270 to an account in Mexico. The attack collapsed only because her real daughter happened to call on a separate line during the extortion call. ## Damage assessment The mother did not lose money. Her daughter's unexpected call intervened before the wire transfer completed, making this a near-miss. International wire transfers to destinations like Mexico are very difficult to reverse and law enforcement recovery rates are low, so the timing of that call was the only thing standing between the mother and a total loss. Cybersecurity experts who commented on the case noted that the barrier to this type of fraud keeps dropping. Voice cloning tools are cheap and widely available, and the raw material for a convincing clone exists for most people through their public social media presence. The $3,270 demand matches amounts reported in similar incidents, calibrated to be profitable while staying within the range many families can access quickly without triggering bank scrutiny. ## How verification helps When the cloned voice claimed to be the mother's daughter, one question would have ended the call immediately: 'What are the words?' Trust Onion generates three rotating codewords that change every 60 seconds, calculated locally on each device. The real daughter would know the current words; an AI voice clone cannot answer that question. Note that a failed callback on its own does not prove the original caller was legitimate, and the caller must still know the family's private Trust Onion Three Words. For security and finance teams, the same three-word challenge applies to high-risk scenarios: executive wire requests, vendor payment changes, and urgent approval calls where voice alone is being used to authorize action. A caller claiming to be a CFO or known vendor contact can be challenged for the current words before any transfer proceeds. The mother's nearly two-hour ordeal depended entirely on having no reliable way to verify she was speaking to her real daughter; the three-word check closes that gap for both families and organizations. ## Key lessons - AI voice cloning requires as little as two seconds of audio, meaning anyone with a public social media presence, including executives, employees, and family members, is a potential impersonation target. - Phone number spoofing makes caller ID unreliable as a verification method. A familiar number on screen is not proof of who is calling, whether the target is a worried parent or a finance team processing a wire request. - A pre-established verification challenge gives individuals, families, and security teams a concrete, testable way to confirm identity under pressure before any money moves. ## Key takeaways - A mother was kept on a fake kidnapping call for nearly two hours using an AI clone of her college-aged daughter's voice, then pressured to wire $3,270 to Mexico. - Scammers spoofed the daughter's real phone number to defeat caller ID; the fraud was discovered only because the real daughter called on a separate line. - AI voice cloning tools can generate convincing fakes from as little as two seconds of audio sourced from social media or voicemail, making any public voice a potential target for both family scams and corporate social engineering. ## Frequently asked questions ### What happened in the kidnapping ransom hoax? A mother received a call displaying her college-aged daughter's real number. An AI-cloned voice claimed her daughter had been in an accident and taken captive, while a second scammer posed as the kidnapper and demanded $3,270 wired to Mexico. The mother was kept on the call for nearly two hours before her real daughter reached her on a separate line, revealing the fraud. ### How much money was lost in this scam? No money was lost. The real daughter called the mother on a separate line before the wire transfer was completed, stopping the fraud in progress. The demanded amount was $3,270 to be sent to Mexico. ### How did scammers clone the daughter's voice so convincingly? Cybersecurity experts explain that current AI voice synthesis tools require as little as two seconds of source audio to produce a convincing voice clone. That audio can be harvested from social media videos, voicemail greetings, podcasts, or any other public recording. No technical expertise beyond access to the software is required. ### How could a family have caught this scam before it went on for two hours? A pre-established verification challenge would have exposed the fake immediately. With Trust Onion, each person shares three rotating codewords that change every 60 seconds and work offline with no server required. When the caller claimed to be the daughter, the mother could have asked for the words; the real daughter would know, and an AI voice clone cannot answer. ### Why didn't caller ID protect the mother from this scam? Scammers used phone number spoofing technology to make the call display the daughter's real mobile number. Caller ID shows the number a caller presents, not the number they are actually calling from. Spoofing that information is technically straightforward, which is why caller ID alone is not a reliable identity verification method. ### Can the same voice-cloning threat affect businesses and security teams, not just families? Yes. Voice cloning is used in business email compromise and phone-based social engineering to impersonate executives or vendors and authorize payments. Security and finance teams can use Trust Onion's three rotating codewords as a practical second factor for any urgent voice request, including wire transfers or sensitive approvals. The codewords rotate every 60 seconds and work offline. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone of Daughter Used in Fake Kidnapping Ransom Call" published: 2026-09-05T19:57:33.061Z updated: 2026-10-11T06:13:08.227Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-of-daughter-used-in-fake-kidnapping-ransom-call --- # AI Voice Clone of Daughter Used in Fake Kidnapping Ransom Call **Cite as:** AI Voice Clone of Daughter Used in Fake Kidnapping Ransom Call, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-voice-clone-of-daughter-used-in-fake-kidnapping-ransom-call Scammers used an AI-cloned voice of a woman's daughter, delivered from the daughter's spoofed phone number, to stage a fake kidnapping and demand ransom. The hoax was uncovered before the outcome was disclosed, and the incident drove brothers Patrick and Ryan Coughlin to found Savi Security, raising $7 million in seed funding. ## Incident facts - **Incident date:** 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Resolved - **Financial impact:** undisclosed ## Timeline - **The Setup:** Scammers generated a convincing AI voice clone of the daughter using available audio and spoofed her real phone number so any call would appear to come from her own device. - **The Attack:** The mother answered a call that showed her daughter's number and heard what sounded like her daughter's voice in distress, while the callers demanded money for her safe return. - **The Impact:** The mother believed her daughter was in genuine danger. Hearing what sounded exactly like her child's voice in apparent distress caused immediate and severe psychological harm. - **The Discovery:** The hoax was uncovered, though the precise method of discovery was not disclosed in reporting. The daughter was safe and unharmed. - **The Fallout:** Brothers Patrick and Ryan Coughlin, motivated by their mother's experience, launched Savi Security, a consumer scam-protection app with real-time call monitoring and text filtering, and secured $7 million in seed funding. ## How the attack worked The call showed the daughter's real phone number on her mother's screen. When she answered, she heard what sounded like her daughter's voice in distress. The scammers had generated an AI clone of that voice, likely from audio pulled from social media or other publicly accessible sources, and spoofed the daughter's number so caller ID confirmed exactly who the mother expected. With a familiar voice and a trusted number working together, the callers made ransom demands and pressed for payment before the mother could verify anything through other means. Modern voice-cloning tools can produce convincing replicas from only a few seconds of audio, and that clone combined with spoofed caller ID removed the two most natural reasons to push back. ## Damage assessment Whether any money changed hands before the hoax was uncovered was not disclosed in reporting. That uncertainty does not reduce the severity: virtual kidnapping hoaxes are designed to extract payment within minutes, before the target has time to think or verify. The psychological toll on the mother was real. Believing a child is in immediate danger while hearing what sounds like that child's voice in distress is acute trauma, regardless of how quickly the situation resolves. The Coughlin brothers turned that experience into action, founding Savi Security and attracting $7 million in seed funding from investors who see growing demand for AI scam-protection tools. ## How verification helps If this family had used Trust Onion, the mother could have asked one question the moment something felt wrong: 'What are the words?' Her real daughter would have known the current three codewords, generated on her device and rotating every 60 seconds. An AI voice clone cannot know those words because they are never transmitted over a phone call and never stored on any server. Phone number spoofing was central to why this attack worked. Caller ID showed the daughter's number, which removed the most natural reason to distrust the call. Trust Onion removes that dependency entirely: the three rotating codewords verify the person, not the number, so spoofing gives an attacker no advantage. Any caller who cannot answer 'What are the words?' has exposed themselves, regardless of how realistic the voice sounds. ## Key lessons - Phone number spoofing and AI voice cloning are frequently combined in virtual kidnapping hoaxes, making caller ID completely unreliable as a trust signal. - The psychological pressure of a fake emergency is specifically designed to stop victims from pausing to verify. A pre-agreed verification ritual, such as Trust Onion's three rotating codewords, gives families a script for exactly that moment. - AI-cloned voices can be generated from publicly available audio such as social media videos, meaning almost anyone with a public online presence is a potential target for voice impersonation. ## Key takeaways - Scammers cloned a daughter's voice and spoofed her real phone number to stage a fake kidnapping call to her mother, making caller ID useless as a verification method. - AI voice cloning requires only a small amount of source audio, often freely available on social media, and virtual kidnapping hoaxes are designed to create panic and rush victims into sending money before they can verify. - The incident led brothers Patrick and Ryan Coughlin to found Savi Security, which raised $7 million in seed funding, reflecting investor demand for AI scam-protection tools. ## Frequently asked questions ### What happened in the Coughlin family voice-cloning incident? Scammers used an AI-generated clone of a woman's daughter's voice, delivered from the daughter's spoofed phone number, to stage a fake kidnapping and demand ransom. The mother initially believed her daughter was in real danger before the hoax was uncovered. ### How much money was lost in this scam? The financial impact was not disclosed in reporting. It is unclear whether any payment was made before the ruse was discovered. ### What did the Coughlin brothers do after their mother was targeted? Brothers Patrick and Ryan Coughlin founded Savi Security, a consumer scam-protection app with real-time call monitoring and text filtering. The company raised $7 million in seed funding. ### How could a family protect themselves from a voice-cloning kidnapping hoax? Trust Onion's three rotating codewords give families a simple verification ritual that AI voice cloning cannot defeat. When a caller claims to be a family member in distress, asking 'What are the words?' immediately exposes any impersonator. The real family member knows the current codewords, which rotate every 60 seconds and work offline. A scammer using a cloned voice does not know those words and cannot fake them. ### Why did phone number spoofing make this attack so effective? Spoofing made the call appear to come from the daughter's real phone number, so the mother's caller ID confirmed the caller's claimed identity, removing one of the most natural reasons to be suspicious. Trust Onion's codewords verify the person, not the number, so spoofing gives an attacker no advantage. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Fakes Kidnapping to Demand $2,500 Ransom" published: 2026-09-05T19:56:01.069Z updated: 2026-10-18T05:19:50.014Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-fakes-kidnapping-to-demand-2-500-ransom --- # AI Voice Clone Fakes Kidnapping to Demand $2,500 Ransom **Cite as:** AI Voice Clone Fakes Kidnapping to Demand $2,500 Ransom, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/ai-voice-clone-fakes-kidnapping-to-demand-2-500-ransom CBS News Bay Area anchor Juliette Goodrich answered a call that appeared to come from her daughter's phone and heard an AI-generated replica of her daughter's voice before a scammer demanded $2,500 in ransom. Her case and another victim's, which involved a bitcoin demand, show how AI voice cloning has made virtual kidnapping calls nearly impossible to dismiss on instinct alone. ## Incident facts - **Incident date:** February 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Resolved - **Financial impact:** $2,500 demanded ## Timeline - **The Setup:** Scammers spoofed Juliette Goodrich's daughter's phone number and collected enough audio of her voice, likely from social media or other public sources, to generate a convincing AI voice replica. The same method was used against another victim in a separate incident. - **The Attack:** Goodrich received a call that looked on caller ID as though it came from her daughter's own number. When she answered, she heard what sounded like her daughter's voice, followed by a scammer claiming to have kidnapped her and demanding $2,500. The other victim received a comparable call with an AI-cloned voice and a bitcoin ransom demand. - **The Impact:** Both women experienced acute fear and disorientation. A spoofed caller ID combined with a voice that sounded genuinely like a family member created real terror before either could question whether the call was legitimate. - **The Discovery:** Both scams were identified as hoaxes. Contact with Goodrich's real daughter confirmed she was safe, and Goodrich's role at CBS News Bay Area meant the incident became a public warning rather than a private ordeal. - **The Fallout:** CBS News Bay Area aired the story on February 14, 2026, detailing both incidents and urging families to establish verification methods with each other before a crisis call ever arrives. ## How the attack worked When Juliette Goodrich picked up the call, two deceptions hit at once: the incoming number matched her daughter's, and the voice on the line sounded like her daughter. Scammers had combined caller ID spoofing with an AI voice replica built from a small sample of publicly available audio, then followed it with a demand for $2,500. A trusted number paired with a familiar voice is designed to cut through the skepticism most people would apply to a stranger's ransom demand. The other victim's case followed the same pattern, ending in a bitcoin demand instead of a fixed dollar figure. The emotional structure of these calls is deliberate: a parent who hears what sounds like their child pleading is in no state to think clearly. Scammers count on panic to compress the time between the demand and payment, and every second a victim spends trying to reach their child through another channel is a second the fraud risks unraveling. ## Damage assessment Neither Goodrich nor the other victim is confirmed to have made a payment, and Goodrich's public platform turned her experience into a warning rather than a private loss. The psychological toll of believing, even briefly, that a family member has been kidnapped is real: victims of these calls report lasting anxiety and a disrupted sense of safety around their family members' communications. The broader damage is structural. Commercial AI voice tools require no specialized knowledge, which means the barrier to running a convincing virtual kidnapping scheme has dropped to near zero. For any family with a member whose voice appears in social media videos, voicemail greetings, or recorded interviews, the attack requires only seconds of that audio. ## How verification helps When Goodrich heard what sounded like her daughter's voice, a single question could have cut through the panic immediately: 'What are the words?' Families using Trust Onion share three rotating codewords in a private group; an AI-generated voice replica, no matter how accurate it sounds, cannot produce them. The impersonation would have been exposed before the ransom demand was ever taken seriously. Note that a failed attempt to reach your real family member through another channel does not, by itself, prove the original caller was legitimate; the codewords remain the clearest test. The words rotate every 60 seconds, are calculated locally on each family member's device, and require no internet connection. There is no server to compromise and no database a scammer could breach. A family that has agreed in advance on a Trust Onion group holds a shared secret that AI voice cloning cannot replicate. ## Key lessons - AI voice cloning requires only seconds of audio to produce a convincing replica, and that audio is often freely available on social media, voicemail, or public recordings. - Spoofed caller ID combined with a cloned voice creates a compounding deception that bypasses normal skepticism, especially in emotionally charged scenarios like a kidnapping claim. - Families need a pre-agreed verification method established before a crisis call arrives, because the emotional pressure of the moment makes in-the-moment judgment unreliable. Trust Onion's three rotating codewords give every family member a simple challenge to ask: 'What are the words?' An AI voice clone cannot answer. ## Key takeaways - Scammers combined caller ID spoofing and AI voice cloning to impersonate a family member and demand a $2,500 kidnapping ransom from CBS News Bay Area anchor Juliette Goodrich. - AI voice cloning tools can generate convincing voice replicas from small amounts of publicly available audio, making anyone with a social media presence a potential target. - A pre-agreed family verification code using Trust Onion's three rotating codewords is the most direct countermeasure against voice impersonation in emergency scenarios; asking 'What are the words?' immediately exposes any caller an AI clone cannot answer. ## Frequently asked questions ### What happened in the Juliette Goodrich kidnapping scam call? CBS News Bay Area anchor Juliette Goodrich received a call that appeared on her caller ID to come from her daughter's phone number. When she answered, she heard what sounded like her daughter's voice before a scammer claimed to have kidnapped her and demanded $2,500 in ransom, using AI-generated voice cloning to make the impersonation convincing. ### Who is the other victim and what happened to her? The other victim is another woman referenced in the CBS News Bay Area report, targeted by a similar AI-assisted virtual kidnapping scam. Scammers used a cloned voice replica of a family member and demanded a bitcoin ransom. Her case was highlighted alongside Goodrich's to show how widespread this attack pattern has become. ### How much money was demanded in these scams? Scammers demanded $2,500 in Juliette Goodrich's case. In the other victim's case, the ransom was demanded in bitcoin. Neither victim is confirmed to have made a payment. ### How do AI virtual kidnapping scams work? Scammers collect a small audio sample of a family member's voice from social media or public recordings, clone it with AI tools, then spoof that person's phone number. When the victim answers, the cloned voice plays before a ransom demand follows. The familiar number and familiar-sounding voice are designed to trigger panic before the victim can think critically. ### How could a family protect themselves from AI voice cloning ransom scams? Families can establish Trust Onion's three rotating codewords before any crisis call arrives. Asking 'What are the words?' immediately exposes an AI impersonation; the real person knows the current codewords, and an AI voice clone cannot produce them. The words rotate every 60 seconds and are calculated locally on each device, with no server a scammer could access. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Cloning Scams Cost Georgia Couple $800,000" published: 2026-09-05T19:54:06.864Z updated: 2026-10-11T06:13:08.719Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-cloning-scams-cost-georgia-couple-800-000 --- # AI Voice Cloning Scams Cost Georgia Couple $800,000 **Cite as:** AI Voice Cloning Scams Cost Georgia Couple $800,000, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-voice-cloning-scams-cost-georgia-couple-800-000 A metro Atlanta couple lost $800,000 to scammers using AI-cloned voices, one of the largest individual losses in a wave of regional fraud cases reported by CBS News in July 2026. Nationally, AI-powered scam losses reached nearly $900 million, with Georgia and South Florida identified as hotspots. ## Incident facts - **Incident date:** July 2026 - **Location:** Cobb County, Georgia, United States - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $800,000 ## Timeline - **The Setup:** Scammers collected publicly available audio to clone real individuals' voices, including that of a South Florida attorney, building convincing impersonations of people their targets knew and trusted. - **The Attack:** Using AI-cloned voices, scammers called victims and manufactured urgency that persuaded the metro Atlanta couple to transfer funds. - **The Impact:** The metro Atlanta couple lost $800,000. The South Florida attorney later discovered his cloned voice had been used against others without his knowledge or consent. - **The Discovery:** Victims and their families realized the calls had been fake and the transfers irreversible, prompting media coverage and law enforcement reports. - **The Fallout:** CBS News reported both cases as part of a national pattern, with AI scam losses approaching $900 million and law enforcement using the incidents to warn the public about voice cloning fraud. ## How the attack worked A metro Atlanta couple transferred $800,000 to scammers who called using AI-cloned voices that mimicked people the couple knew and trusted. The callers manufactured enough urgency to bypass normal skepticism, and the synthetic voices closely replicated pitch, cadence, and accent from short audio samples drawn from voicemail greetings, social media videos, or public recordings. In a separate South Florida incident, scammers cloned a practicing attorney's voice and used it to deceive others, leaving him tied to fraud he had no part in. CBS News reported both cases in July 2026 as part of a national trend in which AI-powered scam losses reached nearly $900 million, with Georgia and South Florida among the hardest-hit regions. ## Damage assessment For most families, $800,000 is retirement savings, home equity, or generational wealth. Once wire transfers move under fraudulent pretenses, financial institutions and law enforcement have few tools to reverse them, especially as funds pass quickly through multiple accounts. The South Florida attorney faced a different problem: his voice had been cloned and used against others, leaving clients, colleagues, and courts to question the authenticity of legitimate recordings going forward. The nearly $900 million national figure shows how far consumer protection frameworks lag behind the technology that made both cases possible. ## How verification helps When the metro Atlanta couple received calls from voices they trusted, they had no way to confirm the callers were real. Trust Onion gives families a direct fix: share three private codewords in advance, then ask "What are the words?" the moment any call or message feels urgent or suspicious. A cloned voice cannot answer correctly because the words rotate every 60 seconds and exist only on trusted devices inside the group. If the caller hesitates or gives the wrong answer, that is a clear signal to stop before any money moves. Hanging up and calling back on a known number is a reasonable step, but a successful callback alone does not prove the original caller was legitimate; the caller must still know the family's private Trust Onion codewords. For families who want an additional layer, a Proofie™ is a selfie signed by your passkey the moment you take it. Share the link and anyone can verify in the Trust Onion app that your key signed that exact photo and that nothing has changed since. Codewords are generated on your device and never touch Trust Onion's servers, so there is no database to steal and no way for a scammer to intercept the current words. ## Key lessons - AI voice cloning tools can replicate a person's voice from a small audio sample, making phone-based impersonation accessible to scammers at scale. - Financial losses from voice cloning fraud can be catastrophic and are rarely recovered once funds are transferred. - Families who agree on three private Trust Onion codewords in advance have a zero-cost challenge that a cloned voice can never pass, because the words rotate every 60 seconds and exist only on trusted devices. ## Key takeaways - A metro Atlanta couple lost $800,000 to AI voice cloning scammers in a case reported by CBS News in July 2026. - A South Florida attorney's voice was cloned without his knowledge and used to defraud others, showing that anyone with a public presence is a potential source for scammers. - National AI scam losses reached nearly $900 million; families who set up Trust Onion's three rotating codewords can ask "What are the words?" before acting on any urgent request, exposing a cloned voice before any money changes hands. ## Frequently asked questions ### What happened in the Georgia and South Florida AI voice cloning scams? Scammers used AI voice cloning to impersonate trusted individuals and defraud victims in both states. A metro Atlanta couple lost $800,000, and a South Florida attorney discovered his cloned voice had been used to deceive others. CBS News reported both cases in July 2026 as part of a national pattern of AI scam losses approaching $900 million. ### How much money was lost in these AI voice cloning incidents? The metro Atlanta couple lost $800,000 in a single incident. Nationally, AI-powered scam losses reached nearly $900 million, reflecting how widespread this type of fraud has become. ### How could the Atlanta couple have protected themselves from this voice cloning scam? Asking "What are the words?" before responding to any urgent request would have exposed the AI-generated voice immediately. Trust Onion's three rotating codewords change every 60 seconds and are known only to people inside the trusted group. A scammer using a cloned voice cannot provide the current words, making the fraud detectable before any money changes hands. Trust Onion is free at trustonion.io. ### How do scammers clone someone's voice? AI voice cloning tools replicate a person's voice from a short audio sample, sometimes just seconds of publicly available recordings. Voicemail greetings, social media videos, and professional recordings are common sources. The resulting synthetic voice closely mimics the real person's pitch, cadence, and speech patterns. ### What should families do if they receive an urgent call from someone they know asking for money? Ask "What are the words?" before taking any action. Trust Onion's three private codewords rotate every 60 seconds; a caller who cannot supply the current words should not be trusted, no matter how convincing the voice sounds. Trust Onion is free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Toronto Man Charged After $7,500 Grandparent Scam Targeting Elderly Woman" published: 2026-09-05T19:50:27.028Z updated: 2026-10-18T05:20:11.219Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/toronto-man-charged-after-7-500-grandparent-scam-targeting-elderly-woman --- # Toronto Man Charged After $7,500 Grandparent Scam Targeting Elderly Woman **Cite as:** Toronto Man Charged After $7,500 Grandparent Scam Targeting Elderly Woman, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/toronto-man-charged-after-7-500-grandparent-scam-targeting-elderly-woman A 27-year-old Toronto man was arrested and charged after calling an elderly woman while posing as her grandson and persuading her to hand over $7,500 in cash for bail money. Police say he also attempted a second grandparent scam targeting another senior for $15,000, which failed. ## Incident facts - **Incident date:** August 2026 - **Location:** Toronto, Ontario, Canada - **Victim type:** Elderly individual - **Attack type:** Voice cloning - **Outcome:** Resolved - **Financial impact:** $7,500 ## Timeline - **The Setup:** The defendant identified elderly targets and prepared to impersonate a distressed family member, counting on the concern grandparents feel for their grandchildren. - **The Attack:** He called the elderly woman posing as her grandson, claiming he was in legal trouble and urgently needed bail money. A second call targeted another senior for $15,000 using the same script. - **The Impact:** The first victim handed over $7,500 in cash, believing she was helping her grandson through a crisis. The second attempted fraud produced no payment. - **The Discovery:** Police identified and arrested the 27-year-old Toronto man and charged him in connection with both the completed fraud and the attempted second scam. - **The Fallout:** The defendant was charged following his arrest. CTV News reported the case, drawing attention to the continued prevalence of grandparent scams targeting seniors in Canada. ## How the attack worked An elderly woman received a call from a man claiming to be her grandson. He said he was in legal trouble and needed bail money fast. She handed over $7,500 in cash. The emotional urgency of the call, a loved one supposedly in danger and too embarrassed to tell the parents, is a deliberate pressure tactic designed to bypass skepticism and push the victim toward fast action. Cash payments leave almost no traceable record and cannot be reversed once handed over. The defendant is also alleged to have attempted a second, larger grandparent scam targeting another senior for $15,000, following the same pattern of family impersonation and fabricated emergency. Scammers typically instruct victims to tell no one, framing secrecy as a condition of helping their family member. Victims are not naive. They are responding to what sounds and feels like a genuine family emergency, with the scammer controlling the entire narrative and leaving no easy way to verify who is actually on the line. ## Damage assessment The confirmed financial loss is $7,500, cash paid by an elderly woman who believed she was keeping her grandson out of jail. For many seniors on fixed incomes, a loss that size represents weeks or months of living expenses and is not easily recovered. The attempted second fraud, targeting another senior for $15,000, confirms this was not an isolated act. Had that attempt succeeded, total harm would have exceeded $22,500 across two victims. Beyond the money, victims of grandparent scams often carry lasting distress, anxiety about future phone calls, and a loss of confidence in their own judgment, damage that never appears in any financial loss figure. ## How verification helps When the caller claimed to be her grandson and spun a story about needing bail money, the elderly victim had no fast, reliable way to confirm who was really on the line. Trust Onion gives families a simple habit to build before any emergency happens: share three private codewords, and agree that anyone asking for money must answer 'What are the words?' first. The three codewords rotate every 60 seconds and are calculated locally on each person's device, with no server to hack and no way for a scammer to look up or guess the current words. A fraudster can clone a voice, mimic a tone, and invent a convincing story, but without the current three words, the call fails verification and no money should move. For grandparents who are primary targets of this fraud type, that one question could be the difference between a safe call and a $7,500 loss. ## Key lessons - Grandparent scams rely on the victim having no fast way to verify the caller's identity. Trust Onion's three rotating codewords close that gap with a single question asked before any money moves. - Cash payment demands are a reliable warning sign. Legitimate family members in genuine emergencies can verify their identity using Trust Onion's current three words before any money is sent. - Scammers instruct victims to keep the transaction secret, blocking family intervention. Trust Onion gives seniors an independent verification tool they can use alone: if the caller cannot answer 'What are the words?', the call fails verification. ## Key takeaways - A 27-year-old Toronto man was charged with defrauding an elderly woman of $7,500 by impersonating her grandson on the phone. - The same suspect attempted a second grandparent scam targeting another senior for $15,000, following the identical script of family impersonation and fabricated emergency. - Grandparent scams exploit emotional urgency and the absence of any quick identity check; a shared three-word codeword through Trust Onion, rotating every 60 seconds, can expose a voice impersonator before any cash changes hands. ## Frequently asked questions ### What happened in this incident? A 27-year-old Toronto man was arrested and charged after allegedly calling an elderly woman while posing as her grandson and convincing her to hand over $7,500 in cash for bail money. He is also alleged to have attempted the same scam against a second senior for $15,000. ### How much money was lost? The confirmed loss is $7,500, paid in cash by the first victim. The second attempted fraud, targeting another senior for $15,000, did not result in a payment. ### How could this have been prevented? If the victim had asked 'What are the words?' using Trust Onion's three rotating codewords, the impersonator could not have answered. The real grandson would know the current words; a fraudster cannot look them up, guess them, or clone them from a voice. That single question, asked before any cash is handed over, would have caught this scam before the $7,500 was lost. --- title: "AI Voice Clone of Her Brother Costs Ontario Woman $12,000" published: 2026-09-05T19:48:45.793Z updated: 2026-10-18T05:19:54.319Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-of-her-brother-costs-ontario-woman-12-000 --- # AI Voice Clone of Her Brother Costs Ontario Woman $12,000 **Cite as:** AI Voice Clone of Her Brother Costs Ontario Woman $12,000, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/ai-voice-clone-of-her-brother-costs-ontario-woman-12-000 A woman from Smiths Falls, Ontario transferred more than $12,000 to a scammer using an AI clone of her brother's voice, believing he had been in a car accident. She discovered the fraud only after reaching her real brother, who knew nothing about the call. ## Incident facts - **Incident date:** August 2026 - **Location:** Smiths Falls, Ontario, Canada - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $12,000+ ## Timeline - **The Setup:** Scammers gathered audio of her brother's voice, likely from social media videos, voicemails, or other public recordings. Current AI cloning tools need as little as 10 seconds of audio to produce a working voice clone. - **The Attack:** The woman received a call from someone who sounded exactly like her brother, claiming he had been in a car accident and needed money right away. The familiar voice and a time-pressured emergency pushed her to act before she could verify anything. - **The Impact:** The woman transferred more than $12,000 to the scammers, believing she was helping her brother through a real emergency. The money was gone before she had a chance to call her brother on his actual number. - **The Discovery:** The woman reached her real brother, who told her he had not been in an accident and had never called asking for money. That was when she understood the voice on the call had been AI-generated. - **The Fallout:** CP24 reported the incident, bringing public attention to how accessible AI voice cloning has become. Journalists and security advisors used her case to promote family verification habits, including shared code words and calling family members back on saved, trusted numbers. ## How the attack worked The call that reached the woman sounded like her brother. A scammer using an AI-generated clone of his voice told her he had been in a car accident and needed money urgently. Modern AI cloning tools need as little as 10 seconds of sample audio, pulled from social media videos, voice messages, or other public recordings, to produce a replica convincing enough to fool a sibling. The scenario was built to cut off careful thinking. A familiar, trusted voice paired with a time-pressured crisis creates exactly the conditions where people act before they verify. The scammer needed no detailed knowledge of the woman or her brother. A convincing voice and a plausible emergency were enough. ## Damage assessment The woman lost more than $12,000 in a single fraudulent transfer. In most scams of this type, money sent to fraudsters cannot be recovered once the transfer is complete. Victims often describe embarrassment, self-doubt, and distress, not because they acted carelessly, but because they responded with love and urgency to what they believed was a family member in crisis. Her case shows that these scams don't exploit ignorance. They exploit trust. ## How verification helps If the woman had been using Trust Onion with her brother before that call arrived, one question would have changed everything. Asking "What are the words?" would have exposed the AI-generated voice immediately. The real brother would know the current three codewords. An AI clone of his voice would not. The call would have ended before a single dollar moved. Trust Onion's three codewords rotate every 60 seconds and are calculated locally on each family member's device. Families can also share a Proofie™, a selfie signed using your passkey in the Trust Onion app, to confirm identity when a voice alone is not enough. Calling her brother back on a saved, trusted number is also sound practice, though a failed callback does not prove the original caller was legitimate; the caller must still know the family's private Trust Onion codewords to pass the real test. ## Key lessons - AI voice cloning requires as little as 10 seconds of audio and is accessible to low-level fraudsters, meaning any person with a public social media presence is a potential impersonation target. - Emergency scenarios are built to bypass rational thinking. A verification protocol agreed upon before a crisis occurs is the only reliable defense. - Calling back a family member on a saved, trusted number is a sound practice, but a failed callback does not prove the original caller was legitimate. Trust Onion's three rotating codewords close that gap instantly, even within the original call, because only the real person can answer "What are the words?" correctly. ## Key takeaways - A woman from Smiths Falls, Ontario lost more than $12,000 to a scammer using an AI clone of her brother's voice, believing he had been in a car accident. - AI voice cloning tools can replicate a familiar voice from as little as 10 seconds of sample audio, sourced from social media or other public recordings, making family impersonation scams highly convincing. - A pre-agreed family verification challenge using Trust Onion's three rotating codewords would have exposed the fake voice before any funds transferred. The AI clone could not have answered "What are the words?" ## Frequently asked questions ### What happened to the woman in this incident? A woman from Smiths Falls, Ontario received a call from a scammer using an AI-generated clone of her brother's voice, claiming he had been in a car accident and needed urgent financial help. Believing the voice was genuine, she transferred more than $12,000. She later discovered her real brother knew nothing about the call. ### How much money did the woman lose in this AI voice cloning scam? The woman lost more than $12,000 in a single fraudulent transfer made in response to the fabricated emergency. In most scams of this type, money sent to fraudsters cannot be recovered once the transfer is complete. ### How did the scammers clone her brother's voice so convincingly? Modern AI voice cloning tools need as little as 10 seconds of audio to replicate a person's voice. Scammers typically pull that material from social media videos, voice messages, or other public recordings. The resulting clone is convincing enough to deceive family members, especially during an emotionally charged call. ### How could this scam have been prevented? A pre-agreed family verification protocol would have stopped this fraud before any money moved. Trust Onion gives families three rotating codewords that change every 60 seconds. Asking "What are the words?" would have exposed the AI-generated voice immediately. Only the real brother would know the current codewords. The app is free and requires no technical setup beyond installing it and sharing it with family. ### Is AI voice cloning fraud becoming more common? Yes. As AI voice synthesis tools have become cheaper and easier to access, family impersonation scams using cloned voices have increased. Fraudsters no longer need technical expertise, only a brief audio sample and a believable story. Consumer protection agencies across North America have flagged this as a rising threat to people of all ages. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Mimics Teen's Voice in $7,500 Ransom Hoax" published: 2026-09-05T19:47:00.897Z updated: 2026-10-11T06:13:10.024Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-mimics-teen-s-voice-in-7-500-ransom-hoax --- # AI Voice Clone Mimics Teen's Voice in $7,500 Ransom Hoax **Cite as:** AI Voice Clone Mimics Teen's Voice in $7,500 Ransom Hoax, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-voice-clone-mimics-teen-s-voice-in-7-500-ransom-hoax A mother in Buffalo, New York received a call in which an AI-generated voice mimicked her 16-year-old son, while a second caller threatened to kill him unless she paid $7,500 in cash. The BBC reported the August 2026 incident to show why families need a shared secret codeword: scammers can clone a voice, but they cannot know a private family password. ## Incident facts - **Incident date:** August 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Resolved - **Financial impact:** $7,500 demanded ## Timeline - **The Setup:** Scammers sourced audio of the teenage son's voice, most likely from social media, and used it to train an AI voice cloning model capable of producing a convincing imitation. - **The Attack:** The mother received a call in which the AI-cloned voice pleaded for help while an accomplice threatened to kill him unless she paid $7,500 in cash immediately. - **The Impact:** The demand for untraceable cash and the sound of her son's cloned voice created a high-pressure crisis designed to override rational judgment before she could verify anything. - **The Discovery:** The scam was identified before payment was made, either through contact with the real son or through recognition of the red flags common to virtual kidnapping hoaxes: urgency, cash demands, and instructions to stay on the line. - **The Fallout:** The BBC documented the incident as part of a broader investigation into AI voice cloning scams, and security experts used it to illustrate why codeword strategies are now a practical necessity for families. ## How the attack worked The call was built to hit hard and fast. The mother heard what sounded like her son's voice, distressed and pleading, then a second caller came on and threatened his life unless she produced $7,500 in cash. Scammers had built the voice model from audio samples almost certainly pulled from social media, where teenagers routinely post enough material to train a convincing clone. Three tactics ran through the call in sequence. Extreme urgency gave the mother no time to pause or verify. Isolation instructions told her not to hang up or contact anyone else. The cash demand was deliberate: physical currency is untraceable and irreversible once handed over. A parent who believes her child is in mortal danger operates under acute stress, and the AI-cloned voice was precisely the trigger the scammers needed to sustain it. ## Damage assessment Financial loss was avoided, but the psychological toll was real. Hearing what sounds like your child's voice in apparent terror, followed by a death threat, is a serious trauma regardless of whether money changes hands. The $7,500 demand sits within the typical range for these scams, calibrated to be large enough to be profitable but small enough that a panicked parent might believe she can gather the cash quickly without involving a bank. Had she complied, recovering the funds would have been unlikely. As the BBC reported, incidents like this one are eroding trust in phone calls as a reliable channel between family members. ## How verification helps When the caller sounded like her son, one question would have changed the outcome: 'What are the words?' Trust Onion lets families share three private codewords that rotate every 60 seconds. Those words are known only to people inside the family group, set up in advance, and never spoken outside the household. An AI model can clone a voice, but it cannot know a private codeword, and that silence would have exposed the fraud before any cash changed hands. Note that a failed callback to your son's number does not by itself prove the original caller was a scammer; the codewords are the reliable test. The codeword challenge sidesteps the emotional manipulation entirely. It does not require the mother to stay calm, assess vocal quality, or resist panic. It requires only one simple question, and the answer either matches or it does not. For families who want a second layer, a Proofie™ is a selfie signed by your passkey the moment you take it; use the Trust Onion app to verify that the full signing key matches the person's public key in your shared group and that the original photo has not changed since it was signed. ## Key lessons - AI voice cloning tools can replicate a teenager's voice from publicly available social media audio, making impersonation calls indistinguishable from the real person without a pre-established verification method. - Virtual kidnapping hoaxes are designed to eliminate thinking time. Urgency, isolation, and untraceable cash demands are deliberate tactics to prevent the target from pausing long enough to verify the call. - A shared family codeword creates a verification layer that voice cloning cannot defeat, because the words are private, not vocal, and unknown to anyone outside the trusted group. Trust Onion's three rotating codewords change every 60 seconds and work offline, providing exactly this layer at no cost. ## Key takeaways - A Buffalo mother was targeted by scammers using an AI clone of her 16-year-old son's voice in a $7,500 cash ransom demand. - AI voice cloning scams require only a small amount of publicly available audio to generate a convincing family member impersonation. - A pre-established family codeword is the most effective defense because it tests knowledge, not voice, and AI cannot know a private password. ## Frequently asked questions ### What happened in the Buffalo voice cloning incident? A mother in Buffalo, New York received a call in which an AI-generated voice mimicked her 16-year-old son. A second caller threatened to kill him unless she paid $7,500 in cash. The scam was identified before any payment was made. ### How did scammers clone the teenager's voice? Scammers used AI voice cloning tools trained on audio samples of the son's voice, most likely sourced from publicly accessible social media. Modern cloning tools require only a short sample to generate a convincing imitation. ### How much money did the scammers demand? The scammers demanded $7,500 in cash. Cash was specified because it is untraceable and cannot be recovered once handed over. The fraud was identified before any payment was made. ### How could a family codeword have stopped this scam? Asking 'What are the words?' would have exposed the fraud immediately: the scammer would have had no answer. Trust Onion's three rotating codewords are known only to people inside the family group. An AI can clone a voice but cannot know a private codeword. The words rotate every 60 seconds and work offline, so there is no way to intercept or predict them. ### What are the warning signs of a virtual kidnapping voice cloning scam? Security experts identify three consistent red flags: extreme urgency with no time allowed to verify, isolation instructions telling the victim not to hang up or contact anyone else, and demands for untraceable payment such as cash, gift cards, or wire transfers. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Scam Costs California Mother Thousands" published: 2026-09-05T19:45:18.767Z updated: 2026-10-11T06:13:10.369Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-scam-costs-california-mother-thousands --- # AI Voice Clone Scam Costs California Mother Thousands **Cite as:** AI Voice Clone Scam Costs California Mother Thousands, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-voice-clone-scam-costs-california-mother-thousands A California mother transferred thousands of dollars to scammers after a phone call made her believe her daughter was in distress, the voice an AI-generated clone. The FBI reported Americans lost over $893 million to AI-related scams in a single year, with family impersonation calls among the most common methods. ## Incident facts - **Incident date:** May 2026 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** undisclosed thousands ## Timeline - **The Setup:** Scammers gathered audio of the victim's daughter, likely from social media or other publicly available recordings, and used AI voice cloning software to build a convincing replica of her voice. Caller ID spoofing tools were prepared to make the incoming call appear legitimate. - **The Attack:** The mother received a call featuring what sounded like her daughter's voice in distress. Real-time voice skinning technology let scammers respond naturally to her questions and escalate the apparent emergency. - **The Impact:** Believing her daughter was in genuine danger, the mother transferred thousands of dollars before any verification could take place. The caller ID had appeared plausible, and the voice raised no immediate suspicion. - **The Discovery:** The mother contacted her real daughter through a separate channel and confirmed no emergency had occurred. The call she had received was identified as AI-generated. - **The Fallout:** The incident became part of CNN's broader investigation into AI voice cloning scams. Federal data cited in the report shows Americans lost over $893 million to AI-related scams in the prior year, with family impersonation calls among the most common methods used. ## How the attack worked Scammers obtained audio of the victim's daughter, almost certainly from social media videos or voice messages available online. Even a few seconds of audio is enough for modern AI voice cloning tools to construct a convincing vocal replica. Unlike earlier versions of this scam that relied on pre-recorded clips, the attackers used real-time voice skinning technology: a live operator speaking through a voice filter that transformed their voice into the daughter's in real time, letting them respond naturally to questions and adapt the story as the conversation unfolded. Caller ID spoofing compounded the deception, making the incoming call display a number that appeared familiar or at least non-suspicious. The manufactured scenario almost certainly involved an urgent crisis, a standard tactic that relies on the emotional shock of hearing a loved one in distress to override critical thinking and push the target toward immediate action before doubt can take hold. ## Damage assessment The California mother lost thousands of dollars in a single call. The precise figure has not been publicly disclosed, but the loss was extracted in minutes through the manipulation of a parent's instinct to protect her child. Victims of such scams frequently report shame, a sense of violation, and diminished trust in ordinary phone communication long after the fraud is resolved. The FBI's figure of over $893 million lost to AI-related scams in a single year shows this is no longer an edge case. Voice cloning tools are cheaper, faster, and more accessible than they have ever been, and knowing that a loved one's voice can be turned against you is a difficult thing to set aside. ## How verification helps When the caller claimed to be her distressed daughter, one question could have changed the outcome: 'What are the words?' Trust Onion gives families three private rotating codewords shared only among the people they choose to trust. A real family member knows them immediately; an AI impersonator cannot, because the words are calculated locally on each person's device and rotate every 60 seconds, with no server to breach and no database to steal from. Calling back on a known number is a useful additional step, but caller ID spoofing means a returned call can also be manipulated, and a successful callback does not prove the original caller was legitimate. The codeword challenge works offline and in real time, so a family that has agreed in advance to use it does not need to judge whether a voice sounds right under pressure. Either the caller knows the words, or they do not. ## Key lessons - A voice that sounds familiar is no longer sufficient proof of identity. Real-time AI voice skinning can replicate a loved one's voice and respond naturally to questions during a live call, making the impersonation far more convincing than any static recording. - Caller ID cannot be trusted. Spoofing tools let scammers display any number they choose, and a successful callback does not prove the original caller was legitimate. - Families need a pre-agreed verification method that holds up under emotional pressure. Trust Onion's three rotating codewords can be invoked in seconds with a simple 'What are the words?' challenge, and because the words rotate every 60 seconds and are calculated locally, an AI voice clone has no way to produce them. ## Key takeaways - A California mother lost thousands of dollars after an AI voice clone of her daughter convinced her a family emergency was real. Real-time voice skinning let scammers respond naturally to her questions rather than playing a static recording. - The FBI reported Americans lost over $893 million to AI-related scams in a single year, with voice cloning family impersonation among the fastest-growing methods, fueled by AI tools that need only a few seconds of publicly available audio to clone a voice. - Families who set up Trust Onion in advance can ask 'What are the words?' the moment any call feels suspicious. The three rotating codewords change every 60 seconds, are known only to people who share the app, and cannot be guessed or stolen by an impersonator. ## Frequently asked questions ### What happened in this voice cloning scam incident? A California mother received a call that sounded like her daughter's voice in distress, produced using AI voice cloning and real-time voice skinning. She transferred thousands of dollars before calling her real daughter through a separate channel and discovering no emergency had occurred. ### How much money was lost in this scam? The mother lost thousands of dollars; the exact amount has not been publicly disclosed. The FBI reported Americans lost over $893 million to AI-related scams in a single year, with family impersonation calls among the most common methods. ### What made this scam so difficult to detect? Real-time voice skinning let scammers speak live in the daughter's voice and respond naturally to questions, while caller ID spoofing made the call appear legitimate. Together, these removed the two most common checks people use to evaluate an unexpected call. ### How could a family protect themselves from this type of scam? Trust Onion gives families three private rotating codewords as an instant identity check. Asking 'What are the words?' exposes an impersonator immediately, since the words rotate every 60 seconds and are calculated locally with no server to breach. Calling back on a known number is also useful, but a successful callback does not prove the original caller was legitimate. ### How do scammers get enough audio to clone someone's voice? Modern AI voice cloning tools need only a few seconds of audio to build a convincing vocal replica. Scammers typically gather this from social media videos, voice notes, or other online content where the target's voice appears, meaning most people have unknowingly published more than enough audio for this purpose. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Used in Fake Kidnapping Ransom Call in Lawrence, Kansas" published: 2026-09-05T19:14:31.414Z updated: 2026-10-11T06:13:10.367Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-used-in-fake-kidnapping-ransom-call-in-lawrence-kansas --- # AI Voice Clone Used in Fake Kidnapping Ransom Call in Lawrence, Kansas **Cite as:** AI Voice Clone Used in Fake Kidnapping Ransom Call in Lawrence, Kansas, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-voice-clone-used-in-fake-kidnapping-ransom-call-in-lawrence-kansas A Lawrence, Kansas woman answered a call showing her mother's real phone number and heard an AI-cloned version of her mother's voice while a scammer demanded ransom at gunpoint. She called police instead of paying; officers located her mother safe after a high-risk felony traffic stop. ## Incident facts - **Incident date:** October 2025 - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Prevented - **Financial impact:** undisclosed ## Timeline - **The Setup:** Scammers harvested audio of the mother from social media posts and voicemail recordings to build an AI-generated clone of her voice, and obtained or spoofed her real phone number. - **The Attack:** The daughter received a call showing her mother's number on caller ID. An AI-cloned voice resembling her mother played in the background while a scammer claimed the mother was being held at gunpoint and demanded payment for her release. - **The Impact:** The daughter believed her mother's life was in immediate danger. Scammers counted on that fear to pressure payment before she could verify the situation. - **The Discovery:** The daughter called Lawrence Police instead of paying. Officers traced the mother's phone to her workplace and then to a moving vehicle, conducted a high-risk felony traffic stop, and confirmed the mother was safe and the call a scam. - **The Fallout:** The City of Lawrence published the incident on its official website as a public warning, explaining how scammers harvest voice audio from social media and voicemails to build convincing clones and combine them with caller ID spoofing to extort families. ## How the attack worked The call looked right and sounded right. The daughter's phone showed her mother's real number, and when she answered, her mother's voice was audible in the background, apparently in distress. A second voice claimed to be holding the mother at gunpoint and demanded money for her release. Scammers had assembled that clone from audio samples pulled from social media videos, voicemail greetings, or other publicly accessible recordings and fed them into an AI voice cloning tool. The result was realistic enough to be recognizable to a close family member under acute stress. The layered deception was deliberate. Seeing a trusted number and hearing a familiar voice at the same moment collapses the window for critical thinking before a payment demand lands. The mother had no idea her voice had been used this way. Once the daughter called police, officers tracked the mother's phone to her workplace and then to a moving vehicle, where a high-risk felony traffic stop confirmed she was unharmed. ## Damage assessment No financial loss was confirmed. The daughter contacted police before sending any money, and officers verified the mother was safe before any payment could be extracted. The emotional toll was real: the daughter was made to believe, even briefly, that her mother was being held at gunpoint. Law enforcement also committed resources to a high-risk felony traffic stop, with real operational costs and risk to officers and the public. The City of Lawrence treated the incident seriously enough to publish it as an official public warning, confirming that AI-powered virtual kidnapping scams are an active threat to families in the region. ## How verification helps When the scammer's voice claimed the mother was captive, the daughter had no tool to challenge the clone in the background. Families using Trust Onion agree in advance to ask "What are the words?" the moment a call feels wrong. An AI trained on old recordings cannot supply three codewords that rotate every 60 seconds and were never spoken outside the family's trusted group, so that single question would have exposed the fraud before fear could take hold. The codewords are calculated locally on each family member's device, so there is no server to breach and no way for a scammer to intercept or predict the current words. A failed callback does not prove the original caller was legitimate, so a pre-agreed challenge word remains the fastest independent check. If a voice in the background cannot answer, the call is not real. ## Key lessons - A spoofed caller ID showing a known phone number is not proof of who is calling. Number spoofing is trivial for scammers, and a familiar voice in the background adds a second layer of false trust. - AI voice clones are built from audio people share publicly. Social media videos, voicemail greetings, and recorded calls all provide usable material, and only a small sample is needed for a convincing imitation. - Do not pay a ransom demand. Call the person supposedly in danger on a known number, or contact police immediately. Law enforcement can quickly verify location, as this Lawrence case shows. ## Key takeaways - A Lawrence, Kansas woman received a ransom demand backed by an AI clone of her mother's voice layered over a spoofed call from her mother's real phone number. - Lawrence Police located the mother safely after tracking her phone to her workplace and conducting a felony traffic stop, confirming the call was a scam. - A pre-shared rotating codeword system would have allowed the daughter to ask "What are the words?" and expose the fraud immediately, without waiting for police intervention. ## Frequently asked questions ### What happened in the Lawrence, Kansas AI voice cloning scam? A woman received a call showing her mother's real phone number. An AI-cloned version of her mother's voice played in the background while a scammer claimed the mother was held at gunpoint and demanded money. She called police instead of paying; officers located the mother safe after a high-risk felony traffic stop. ### How much money was lost in this incident? No financial loss was confirmed. The daughter contacted law enforcement rather than complying with the ransom demand, and police verified the mother's safety before any payment was made. ### How do scammers clone someone's voice for these calls? Scammers collect short audio samples from social media videos, voicemail greetings, and recorded calls. AI voice cloning tools produce a convincing imitation from even a small amount of source audio. The cloned voice is then played during the call while a second scammer delivers the ransom demand. ### How could this type of scam have been stopped? A shared family verification system using rotating codewords could have exposed the fake voice immediately. Asking "What are the words?" to the voice in the background would have revealed the clone, since an AI trained on old recordings cannot know codewords that rotate every 60 seconds and were never spoken outside the family's trusted group. ### What should someone do if they receive a virtual kidnapping call? Do not pay. Call the person supposedly in danger on their known number, or contact police. Law enforcement can quickly verify location using phone tracking. As this Lawrence case shows, the alleged victim may be safely at work with no knowledge their voice was used this way. A failed callback alone does not prove the original caller was legitimate. ### How does a family set up a codeword system before a scam like this happens? Families can use Trust Onion to share three rotating codewords across their devices. Setup takes only a few minutes, and the words work offline. Any family member can ask "What are the words?" the moment a call feels suspicious. Because the words rotate every 60 seconds, a scammer using a cloned voice built from old recordings cannot supply the correct answer. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Clone Convinced California Mom Her Daughter Was Kidnapped" published: 2026-09-05T19:12:42.659Z updated: 2026-10-18T05:19:45.916Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-clone-convinced-california-mom-her-daughter-was-kidnapped --- # AI Voice Clone Convinced California Mom Her Daughter Was Kidnapped **Cite as:** AI Voice Clone Convinced California Mom Her Daughter Was Kidnapped, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/ai-voice-clone-convinced-california-mom-her-daughter-was-kidnapped A California resident lost more than $5,000 to scammers after an AI-cloned version of her daughter's voice convinced her the girl had been kidnapped in Mexico. She discovered the fraud only after reaching her daughter through another channel and confirming she was safe. ## Incident facts - **Incident date:** May 2026 - **Location:** Martinez, California, United States - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $5,000 ## Timeline - **The Setup:** Scammers harvested publicly available audio of the California mother's daughter, most likely from social media, and used it to build a voice clone. Modern AI voice synthesis tools need only seconds of sample audio to produce a convincing replica. - **The Attack:** The California mother received a call in which the cloned voice screamed and cried, claiming her daughter had been kidnapped in Mexico. Scammers kept the pressure constant throughout, giving her no room to question what she was hearing. - **The Impact:** The California mother wired more than $5,000, believing her daughter's life was at stake. The fabricated crisis gave her no space to pause or verify. - **The Discovery:** After reaching her actual daughter through another channel, the California mother learned she was safe and had no knowledge of any kidnapping. The call was entirely fraudulent. - **The Fallout:** The California mother spoke publicly in a CNN interview with Kate Bolduan, describing how convincing the cloned voice was and confirming the $5,000 was not recovered. Her account became a widely circulated warning about accessible AI voice cloning tools. ## How the attack worked Scammers built a voice clone of the California mother's daughter from audio almost certainly pulled from social media, where short clips are easy to find and free to copy. Current AI voice synthesis tools require only a few seconds of sample audio, are commercially available, and demand no technical expertise. When the California mother answered the call, she heard what sounded exactly like her daughter screaming and crying, claiming she had been taken in Mexico. The scammers kept the pressure unrelenting, giving her no room to pause, call her daughter separately, or question what she was hearing. The California mother wired more than $5,000 before the fraud unraveled. As she told CNN: "I was totally taken by it." ## Damage assessment The California mother wired more than $5,000 to the scammers, a payment method favored precisely because it moves fast and is nearly impossible to reverse. The funds are presumed unrecovered. Beyond the money, the California mother spent time genuinely believing her daughter was in pain and in danger. That kind of acute fear does not simply stop when the fraud is discovered, and her willingness to describe it on national television shows how thoroughly the cloned voice erased every instinct she had to stop and check. ## How verification helps One question would have changed the outcome. If the California mother and her daughter had set up Trust Onion beforehand, she could have asked "What are the words?" during the call. Her real daughter, wherever she was, could have opened the app and read the current three codewords. A scammer holding only a voice clone cannot do that. Trust Onion's three codewords rotate every 60 seconds and are calculated locally on each device, so there is nothing to hack or intercept. If the caller cannot answer, the call is fraudulent. Note that a failed callback on its own does not confirm the original caller was legitimate; the codewords provide an immediate on-call test that requires no second channel and no time to think. ## Key lessons - AI voice cloning tools can replicate a person's voice from just seconds of publicly available audio, making a familiar voice no longer a reliable proof of identity. - Virtual kidnapping hoaxes are engineered to trigger panic and prevent victims from pausing to verify the situation through independent contact with the supposed victim. - Families who share three private Trust Onion codewords in advance have a simple, immediate way to challenge any suspicious call: ask "What are the words?" A scammer holding only a voice clone cannot answer. ## Key takeaways - A California mother lost $5,000 to an AI voice cloning scam that faked her daughter's kidnapping using audio harvested from public sources. - Modern AI tools can clone a convincing voice from just a few seconds of sample audio, requiring no technical expertise from the attacker. - Families can set up Trust Onion so that any member can ask "What are the words?" during a suspicious call; the three rotating codewords change every 60 seconds and are known only to the trusted group, exposing a voice clone before any payment is made. ## Frequently asked questions ### What happened to the California mother? The California mother received a call in which scammers played an AI-cloned version of her daughter's voice, simulating a kidnapping in Mexico. Believing her daughter was in genuine danger, she wired more than $5,000 before discovering the fraud. Her daughter was safe and had no knowledge of any kidnapping. ### How much money did the California mother lose? The California mother wired more than $5,000 to the scammers. Wire transfers are extremely difficult to reverse, and the funds are presumed unrecovered. ### How did scammers clone her daughter's voice? Scammers used AI voice synthesis tools to generate a replica from publicly available audio, most likely sourced from social media. Current technology requires only a few seconds of sample audio, and the tools are widely accessible and inexpensive. ### How could this scam have been prevented? If the California mother and her daughter had set up Trust Onion in advance, asking "What are the words?" would have exposed the fraud instantly. The real daughter could read the current three rotating codewords from her device; a scammer with only a voice clone cannot answer. The codewords change every 60 seconds and are calculated locally, so there is nothing to intercept. ### Is the virtual kidnapping scam common? Yes. Virtual kidnapping hoaxes have been reported across the United States for years, and AI voice cloning has made them considerably more convincing. The FBI and FTC have both issued public warnings about this scam type, and the accessibility of voice cloning tools means incidents are expected to increase. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Capillary Tech Loses €3 Million in Deepfake Banking Fraud" published: 2026-08-26T19:47:30.014Z updated: 2026-10-11T06:13:11.174Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/capillary-tech-loses-3-million-in-deepfake-banking-fraud --- # Capillary Tech Loses €3 Million in Deepfake Banking Fraud **Cite as:** Capillary Tech Loses €3 Million in Deepfake Banking Fraud, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/capillary-tech-loses-3-million-in-deepfake-banking-fraud Capillary Technologies, a Bengaluru-based SaaS company, lost approximately €3 million (₹32.7 crore) after fraudsters used deepfake voice cloning, forged signatures, and social engineering to impersonate key managerial personnel at a recently acquired overseas subsidiary. Of that amount, €0.45 million has been recovered; the company continues working with law enforcement and banks to pursue the remaining €2.55 million. ## Incident facts - **Incident date:** July 2026 - **Location:** Bengaluru, India - **Victim type:** Organization - **Attack type:** Voice cloning - **Outcome:** Resolved - **Financial impact:** €3 million (₹32.7 crore) ## Timeline - **The Setup:** Capillary Technologies had recently completed the acquisition of an overseas step-down subsidiary, leaving staff there still learning to recognize unfamiliar leadership voices and authority figures. That familiarity gap gave the attackers their opening. - **The Attack:** Attackers combined deepfake voice cloning, forged signatures, and social engineering to impersonate key managerial personnel and instruct staff at the overseas subsidiary to transfer funds to unauthorized third-party bank accounts. - **The Impact:** Approximately €3 million (₹32.7 crore) moved out of the overseas subsidiary's accounts to unauthorized third parties before the fraud was detected. - **The Discovery:** Capillary Technologies detected the fraud and disclosed it publicly, then engaged law enforcement, cybercrime authorities, and banking institutions to investigate and begin recovery efforts. - **The Fallout:** Capillary Technologies recovered €0.45 million of the stolen funds and continues working with cybercrime authorities and banks to freeze additional accounts and pursue the remaining approximately €2.55 million. ## How the attack worked Fraudsters targeted a recently acquired overseas step-down subsidiary of Capillary Technologies at the worst possible moment: post-acquisition integration, when employees are still learning what new leadership sounds like and how it communicates. AI-generated voice cloning let them impersonate key managerial personnel convincingly over the phone. Forged signatures added a documentary layer that made the instructions look legitimate on paper. Social engineering stitched it together, making the scenario feel routine rather than alarming. Because each element reinforced the others, no single verification failure caused the breach. Staff at the overseas unit received what appeared to be authorized instructions from executives they recognized by voice and by name, directing them to transfer funds to what turned out to be unauthorized third-party accounts. A cloned voice alone might have raised doubt; paired with forged documents and a plausible narrative, it did not. ## Damage assessment The direct loss totaled approximately €3 million, equivalent to roughly ₹32.7 crore, taken from accounts held by Capillary Technologies' overseas subsidiary. Of that amount, €0.45 million has been recovered through coordination with banks and law enforcement, leaving an outstanding loss of approximately €2.55 million at the time of disclosure. The incident forced Capillary Technologies to engage law enforcement agencies, cybercrime authorities, and multiple banking institutions across jurisdictions at once, consuming management attention and legal resources. The public disclosure places the incident in the permanent record, and the company will have to answer questions about internal controls and verification protocols at acquired entities. ## How verification helps When a caller claims to be a company executive and instructs staff to move funds, one question stops the attack: "What are the words?" A real executive knows the current three codewords. A fraudster with a cloned voice does not, and has no way to find out. No forged document and no amount of social engineering can produce the correct answer. Note that calling back on a number provided by the requester is not a safe substitute, because attackers can control those numbers; always use a contact sourced independently from a known directory or official record. In a post-acquisition environment like the one Capillary Technologies was navigating, codeword verification matters most precisely because voice recognition is least reliable. Trust Onion's three rotating codewords are calculated locally on each authorized device, rotate every 60 seconds, and have no server to hack. For teams that also need to verify identity visually, a Proofie™ is a selfie signed by your passkey at the moment you take it; use the Trust Onion app to verify the signature and compare the full signing key against the person's public key in your shared group. Building the codeword challenge into the fund transfer approval process costs nothing and takes seconds. ## Key lessons - Newly acquired subsidiaries are high-value targets during integration periods, when employees are still learning to recognize unfamiliar leadership voices and are less likely to question instructions from executives they have not yet worked with directly. - AI voice cloning combined with forged documents and social engineering creates a layered deception that cannot be defeated by any single check, only by a pre-established challenge that a cloned voice cannot satisfy. - Any process that authorizes fund transfers over the phone needs a challenge-based identity step: Trust Onion's three rotating codewords, shared only among authorized team members, stop the attack before a single euro moves. ## Key takeaways - Capillary Technologies lost €3 million (₹32.7 crore) after attackers combined AI voice cloning, forged signatures, and social engineering to impersonate executives at a recently acquired overseas subsidiary. - Only €0.45 million of the stolen funds has been recovered despite coordination with law enforcement, cybercrime authorities, and banks across jurisdictions. - A codeword verification step applied before any fund transfer authorization would have exposed the cloned voice on the first call; staff simply ask "What are the words?" and a fraudster cannot answer. ## Frequently asked questions ### What happened in the Capillary Technologies deepfake fraud incident? Fraudsters used AI-generated voice cloning, forged signatures, and social engineering to impersonate key managerial personnel at a recently acquired overseas subsidiary of Capillary Technologies, deceiving staff into authorizing fund transfers totaling approximately €3 million to unauthorized third-party bank accounts. ### How much money did Capillary Technologies lose? Capillary Technologies lost approximately €3 million, equivalent to roughly ₹32.7 crore. As of disclosure, €0.45 million had been recovered, leaving an outstanding loss of approximately €2.55 million. ### How could this deepfake banking fraud have been prevented? A codeword verification protocol would have stopped it. Staff ask any caller authorizing a transfer, "What are the words?" A cloned voice cannot answer. Trust Onion's three codewords rotate every 60 seconds and are calculated locally with no server to hack. Calling back on a requester-supplied number is not a safe alternative; attackers can control those numbers. ### Why was the overseas subsidiary especially vulnerable? The subsidiary had been recently acquired, placing staff in an integration period where they were still learning to recognize the voices and communication styles of new leadership. Fraudsters exploited that familiarity gap, knowing employees would be less confident questioning instructions from executives they had not yet worked with directly. ### What methods did the attackers use beyond voice cloning? Attackers used forged signatures to add documentary legitimacy to their instructions, and applied social engineering to make the scenario feel routine and authorized. The combination of all three methods made the fraud harder to detect than any single method alone would have been. ### How does Trust Onion work for a business team? Trust Onion gives a team three private codewords that rotate every 60 seconds. Before approving a wire, changing vendor details, or acting on an executive instruction by phone, a staff member asks, "What are the words?" Only someone with an authorized device can answer. The words work offline and cannot be cloned or guessed. Trust Onion is free at trustonion.io. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI-Powered Farm Equipment Scams Target Georgia Farmers" published: 2026-08-17T12:58:32.153Z updated: 2026-10-11T06:13:11.555Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-powered-farm-equipment-scams-target-georgia-farmers --- # AI-Powered Farm Equipment Scams Target Georgia Farmers **Cite as:** AI-Powered Farm Equipment Scams Target Georgia Farmers, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-powered-farm-equipment-scams-target-georgia-farmers In July 2026, the Georgia Department of Agriculture warned that criminals were using AI tools to build fake farm equipment dealership websites and pressure farmers into wiring money for equipment that never arrived. A Bulloch County farmer shared a firsthand account of being targeted in coverage by Savannah's WTOC. ## Incident facts - **Incident date:** July 2026 - **Location:** Georgia, United States - **Victim type:** Organization - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** undisclosed ## Timeline - **The Setup:** Scammers used AI tools to build realistic fake websites impersonating legitimate farm equipment dealerships, complete with inventory listings, logos, and contact details designed to pass casual inspection by rural buyers. - **The Attack:** After farmers submitted inquiries through the fraudulent sites, scammers called or texted posing as dealership sales representatives, directing buyers to wire payment and citing delivery fees, inventory holds, or limited-time pricing. - **The Impact:** Victims wired funds and received no equipment. Wire transfers are difficult to reverse, so most losses were unrecoverable, placing direct financial and operational pressure on working farms. - **The Discovery:** Victims typically discovered the fraud when equipment failed to arrive and follow-up calls went unanswered. Some farmers reached the legitimate dealership being impersonated and learned it had no record of the transaction. - **The Fallout:** The Georgia Department of Agriculture issued a public warning urging farmers to verify dealerships independently before sending any payment, and local news coverage spread the alert across rural communities statewide. ## How the attack worked Scammers built their credibility before ever speaking to a victim. Using AI tools, they created fake farm equipment dealership websites that closely mimicked legitimate businesses, including branding, equipment photos, pricing pages, and contact forms, convincing enough to fool buyers shopping for tractors, combines, and other high-value machinery. When a farmer submitted an inquiry, scammers responded quickly by phone or text, presenting themselves as dealership sales staff and using industry-appropriate language to push urgency around inventory availability. The payment method was always a wire transfer, chosen because it is fast, crosses jurisdictions, and is nearly impossible to reverse once sent. Scammers sometimes framed the transfer as a deposit or delivery fee rather than full payment to lower a buyer's guard. Once payment cleared, contact stopped, phone numbers went silent, and the equipment never arrived. ## Damage assessment Farm equipment is one of the largest capital expenses a working farm faces, and losses in this category of scam frequently run from several thousand to tens of thousands of dollars per victim. A farmer who wired money for a tractor that never arrived may face planting delays, lost crop yield, and the need to source replacement equipment at full market price. Wire-transfer victims have limited legal recourse; domestic fraud can sometimes be addressed through bank fraud departments if reported quickly, but recovered funds are rare. Buyers in these scams are not making impulsive decisions. They research equipment, compare prices, and ask questions before committing. Finding out that careful due diligence was defeated by an AI-generated fake creates lasting distrust of online commerce that changes how rural buyers operate going forward. ## How verification helps The critical moment of vulnerability in this scam was not the website visit. It was the follow-up phone call or text from someone claiming to represent a legitimate dealership. For farm businesses with staff who handle purchasing, Trust Onion works as a real two-factor check at exactly that moment: before approving a wire, a staff member asks the caller "What are the words?" The three rotating codewords are calculated locally on each device, change every 60 seconds, and are known only by authorized team members. A scammer sustaining a fake sales identity across multiple calls cannot pass that challenge. A Proofie™ adds a further layer for visual confirmation: a selfie signed by your passkey at the moment it is taken, verifiable through the Trust Onion app by comparing the full signing key against the person's public key in your shared group. Neither tool replaces independent verification of a dealership through official channels, but together they stop impersonation fraud before a single dollar moves. ## Key lessons - AI tools allow scammers to build convincing fake business websites quickly and cheaply, making visual credibility alone an unreliable signal of legitimacy. - Wire transfer instructions from any online or phone contact should be treated as a red flag until the recipient's identity is verified through a channel independent of the transaction itself. - A team-based verbal verification step, such as Trust Onion's three rotating codewords shared only among authorized staff, can stop impersonation fraud before payment is made. Any caller who cannot answer "What are the words?" should not be trusted with payment instructions. ## Key takeaways - Georgia's Department of Agriculture issued a formal warning in July 2026 about AI-generated fake farm equipment dealership websites targeting buyers statewide. - Scammers follow up fake website inquiries with phone or text contact to impersonate dealership staff and pressure buyers into wiring funds. - Wire transfers are the preferred payment method in these scams because they are fast and nearly impossible to reverse after completion. ## Frequently asked questions ### What happened in the Georgia farm equipment scam reported in July 2026? Criminals used AI tools to create fake websites impersonating legitimate farm equipment dealerships. When farmers submitted inquiries, scammers followed up by phone or text posing as sales representatives and instructed buyers to wire money for equipment that was never delivered. The Georgia Department of Agriculture issued a public warning, and a Bulloch County farmer shared a firsthand account with WTOC. ### How much money did victims lose in these farm equipment scams? Specific losses in the Bulloch County case were not disclosed. Wire-transfer fraud in this category commonly results in losses ranging from several thousand to tens of thousands of dollars per victim, and recovered funds from completed wire transfers are rare. ### How could a farmer have protected themselves from this type of scam? The Georgia Department of Agriculture recommends verifying any dealership independently before sending payment. For farm businesses, Trust Onion adds a two-factor check: before any wire is approved, staff ask the caller "What are the words?" Only authorized team members know the three rotating codewords. Note that calling back a number provided by the caller is not safe on its own, since scammers can control those numbers. ### Why do scammers in these schemes always ask for wire transfers? Wire transfers process quickly, cross state and national borders easily, and are extremely difficult to reverse once completed. Unlike credit card payments or checks, wired funds offer victims little recourse through their bank after the transfer clears. ### How can farmers tell if a farm equipment website is fake? The Georgia Department of Agriculture advises independently verifying any dealership found online: search the business name directly rather than clicking ads, call a number found through an independent search, check state business registrations, and contact manufacturers to confirm authorized dealer lists. Pressure to pay quickly by wire should always prompt additional verification before funds are released. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI-Powered 'Hi Mum' Scam Targets Australian Families" published: 2026-07-20T19:59:14.003Z updated: 2026-10-09T00:17:15.834Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-powered-hi-mum-scam-targets-australian-families --- # AI-Powered 'Hi Mum' Scam Targets Australian Families **Cite as:** AI-Powered 'Hi Mum' Scam Targets Australian Families, Trust Onion, 2026-10-09. https://trustonion.io/case-studies/ai-powered-hi-mum-scam-targets-australian-families Australian scammers have added AI voice cloning and message impersonation to the long-running 'Hi Mum' text scam, making fake family emergencies much harder to spot. Victims reported that the voices and messages were indistinguishable from their actual children or relatives. The Daily Telegraph documented multiple victim accounts showing how AI has pushed this scam into a new level of deception. ## Incident facts - **Incident date:** July 2026 - **Location:** Australia - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** undisclosed ## Timeline - **The Setup:** Scammers gathered voice samples and personal details from social media profiles of Australian families, collecting enough material for AI tools to clone voices or craft convincing impersonation messages. - **The Attack:** Fraudsters contacted parents and grandparents by phone or text, posing as a child or close family member who claimed to have a new number, a financial emergency, or an urgent need for an immediate transfer. - **The Impact:** Multiple victims transferred funds, believing they were helping a family member in crisis. The AI-generated voices and messages sounded completely real, removing the usual signs that something was wrong. - **The Discovery:** Victims discovered the fraud only after contacting their actual family member through a known number or in person, at which point it became clear the emergency had never happened. - **The Fallout:** The Daily Telegraph published its report in July 2026, prompting renewed warnings from Australian consumer protection authorities about how AI has turned a familiar scam into a far more dangerous one. ## How the attack worked The original 'Hi Mum' scam has circulated in Australia since at least 2022, relying on simple text messages from an unknown number claiming to be a family member with a lost or broken phone. It worked because of emotional simplicity: a parent receives a message that appears to be from their child, and their instinct is to help first and verify later. By 2026, scammers had layered AI tools on top of this foundation. Using voice samples taken from social media videos, phone recordings, or other public sources, fraudsters can generate audio that mimics a specific person's speech patterns, tone, and cadence. When a parent answers the phone and hears what sounds like their child's voice describing an emergency, the psychological resistance to handing over money drops sharply. In text-based versions of the upgraded scam, AI language tools craft messages that reflect the target's writing style, use nicknames only family members would know, and reference personal details scraped from social media. Familiar phrasing combined with emotional urgency pushes victims toward compliance before they have time to think. Scammers typically claim the family member is in legal trouble, involved in a minor accident, stranded without access to their usual accounts, or facing a payment deadline. The request is framed as temporary, with a promise to repay quickly, which lowers the perceived risk in the victim's mind. The Daily Telegraph's reporting, drawing on victim accounts and expert commentary, shows that the barrier to running this kind of AI-enhanced impersonation has dropped considerably. Tools capable of producing convincing voice clones are now widely accessible, and scammers are applying them at scale across Australian families. ## Damage assessment Victims of the AI-enhanced 'Hi Mum' scam face immediate financial losses ranging from a few hundred to several thousand Australian dollars per incident. Because the transfers are made via bank transfer or digital payment platforms at the victim's own initiative, recovering funds is difficult and often impossible once the money has moved through multiple accounts. Beyond the financial loss, victims report serious emotional harm. Knowing that their trust in their own child's voice was exploited leaves many feeling violated and shaken. For older Australians, the experience can erode confidence in digital communication tools, creating social isolation at a time when staying connected to family matters most. The broader cost is a general erosion of trust in family communication. When parents and grandparents start doubting whether the voice on the phone or the message on the screen is genuinely from their loved one, it introduces anxiety into relationships that should feel secure. Consumer protection experts warn that as AI impersonation tools become more accessible, incidents of this type will grow in both frequency and financial scale. ## How verification helps Every variation of the 'Hi Mum' scam depends on the victim accepting, without question, that the person contacting them is who they claim to be. Trust Onion's three rotating codewords break that dependency directly. When a caller or message sender claims to be a family member, the recipient simply asks: 'What are the words?' No AI clone, however acoustically accurate, can answer that question. The current words exist only on the devices of real family members, calculated locally and never stored on a server. In the scenario documented here, a parent receiving a call from what sounds exactly like their child's voice would have one reliable tool the scammer cannot defeat. The three codewords rotate every 60 seconds and are never transmitted over the same channel the scammer is using. Even if a fraudster intercepts a call, reads messages, or produces a flawless voice clone, they have no way to know the current words. A single question would have exposed the impersonation before any money changed hands. A Proofie™ is a selfie signed by your passkey the moment you take it. Share the link, and anyone can check in their own browser that your key signed this exact photo, after a known moment, and that nothing has changed since. A standard P-256 WebAuthn passkey signs after Face ID, fingerprint or device-passcode unlock. The signature must carry both user-presence and user-verification flags. This is not a crypto-wallet signature. Identity is the full signing public key, not its shortened label. Save a previously trusted key to recognize later Proofies from the same key. This does not automatically verify a real-world identity or detect AI-generated images. Signed time and place cannot be changed undetected; they are not independent proof of physical whereabouts or exact capture time. Family codewords work alongside Proofies, not as an overlay or signed field. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved. Note: calling back on a number you already have saved is a useful extra step, but it is not a substitute for the three-word challenge. A scammer may be able to intercept or spoof a return call. The codewords are the layer that cannot be faked. ## Key lessons - AI voice cloning has made audio verification alone unreliable. Hearing a familiar voice is no longer sufficient proof of identity when someone makes an unexpected request for money. - Scammers create urgency deliberately. A request that feels too pressing to pause and verify is a signal to slow down, not speed up. - Families need a shared verification method that works offline, cannot be intercepted, and does not rely on any single communication channel a scammer may already control. Trust Onion's three rotating codewords, shared privately among family members, provide exactly that layer. Asking 'What are the words?' takes seconds and exposes any impersonation instantly. ## Key takeaways - Australian 'Hi Mum' scams now use AI voice cloning, making impersonations acoustically indistinguishable from real family members. - Scammers use social media voice samples and personal details to train AI tools targeting specific individuals within a family. - Financial losses from individual incidents typically range from hundreds to thousands of dollars, with low recovery rates due to fast-moving digital transfers. - Families who share Trust Onion's three private rotating codewords can expose AI voice impersonation instantly. Asking 'What are the words?' requires no technology beyond the free Trust Onion app and takes only seconds. - The emotional impact of voice clone scams extends beyond financial loss, eroding trust in digital family communication more broadly. - AI impersonation tools are now widely accessible, meaning the 'Hi Mum' scam model is likely to become more common and more convincing over time. A pre-arranged codeword system is the most reliable defence families can put in place today. ## Frequently asked questions ### What is the AI-powered 'Hi Mum' scam? The 'Hi Mum' scam is a fraud where criminals contact parents or other family members pretending to be a relative in urgent need of money. In its AI-upgraded form, scammers use voice cloning technology or AI-generated messages to impersonate a specific family member, often using voice samples gathered from social media. The Daily Telegraph reported in July 2026 that this evolution has made the scam much harder for victims to detect. ### How much money do victims typically lose in these scams? Financial losses in individual 'Hi Mum' scam incidents vary widely, typically ranging from a few hundred to several thousand Australian dollars. Because victims initiate the transfers themselves, believing they are helping a family member, recovering funds through banks or authorities is difficult. Cumulative losses across Australian families from this scam type have been reported in the millions of dollars annually. ### How could a family have caught this scam before sending money? The most reliable defence is a pre-arranged family verification system that no impersonator can access. Trust Onion gives every family three private codewords that rotate every 60 seconds and are calculated locally on each family member's device. When any unexpected call or message requests money or personal help, the recipient asks: 'What are the words?' A scammer using a cloned voice or AI-generated message cannot answer, because the current words are never transmitted over any channel they can monitor. That single question would have exposed the fake before any transfer was made. Trust Onion is free and available at trustonion.io. ### Why is AI voice cloning so effective in family impersonation scams? AI voice cloning works by analysing samples of a person's voice, often taken from videos or audio posted publicly on social media, and generating new speech in that person's voice on demand. The resulting audio can replicate tone, accent, pacing, and speech patterns closely enough that family members cannot reliably tell it apart from the real person. Emotional urgency in the conversation further reduces the victim's capacity to think critically, which makes the deception highly effective. ### What should Australian families do if they receive an unexpected call or message from a family member asking for money? Pause before acting. Ask 'What are the words?' using your family's Trust Onion codewords. The three words rotate every 60 seconds and are known only to real family members, so a scammer cannot answer regardless of how convincing the voice sounds. If the caller cannot provide the current words, treat the contact as fraudulent before sending any funds. Setting up Trust Onion in advance is free at trustonion.io and takes only a few minutes. You may also try contacting the family member through a number you already have saved, but note that a determined scammer may be able to spoof or intercept a return call. The codeword challenge is the layer that cannot be faked. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Houston Man Loses $15,000 After AI Clones His Son's Voice" published: 2026-07-03T15:06:54.548Z updated: 2026-10-18T05:20:03.569Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/houston-man-loses-15-000-after-ai-clones-his-son-s-voice --- # Houston Man Loses $15,000 After AI Clones His Son's Voice **Cite as:** Houston Man Loses $15,000 After AI Clones His Son's Voice, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/houston-man-loses-15-000-after-ai-clones-his-son-s-voice A 71-year-old Houston man lost $15,000 in June 2026 after scammers used AI voice cloning to impersonate his son, claiming the son had been arrested for DUI following an accident involving a pregnant woman. A second scammer posing as a public defender directed the man to pay in cryptocurrency, and the funds were unrecoverable once sent. ## Incident facts - **Incident date:** June 2026 - **Location:** Houston, Texas, United States - **Victim type:** Elderly individual - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $15,000 ## Timeline - **The Setup:** Scammers gathered audio of the man's son, likely from social media or other public sources, and used it to train an AI voice model that could replicate his son's voice on a phone call. - **The Attack:** The man received a call from what sounded exactly like his son, who claimed to be in police custody after a DUI accident involving a pregnant woman. A second caller, posing as a public defender, then instructed the man to pay $15,000 in cryptocurrency to secure his son's release on bond. - **The Impact:** The man transferred $15,000 in cryptocurrency to the scammers. Because cryptocurrency transactions cannot be reversed, the funds were unrecoverable once sent. - **The Discovery:** The man discovered the fraud after calling his son directly and confirming he had never been arrested. The urgency of the call had been enough to push him to pay before he stopped to verify. - **The Fallout:** The man reported the incident to authorities and spoke publicly through FOX 26 Houston to alert other families. Law enforcement advised people to verify any emergency call by dialing a loved one back on a known, saved number. ## How the attack worked The 71-year-old Houston man answered his phone and heard what he believed was his son's voice. The caller described a DUI arrest after an accident in which a pregnant woman had been struck, details chosen to raise the legal stakes, amplify apparent shame and distress, and push him to act quickly and quietly. Scammers had gathered audio of his son, most likely from social media videos, and used it to generate a synthetic voice that matched his son's tone, cadence, and speech patterns. A second scammer then joined the call, presenting himself as a public defender assigned to the case. The fake attorney walked the man through the payment steps and directed him to pay in cryptocurrency, specified because it transfers instantly, cannot be reversed, and is difficult for law enforcement to trace. The emotional weight of a son's voice in distress, combined with apparent legal authority and a coherent narrative, compressed the window for rational decision-making until it closed entirely. ## Damage assessment The man lost $15,000 in cryptocurrency. Those transactions cannot be reversed, and recovery of cryptocurrency in fraud cases of this scale is rare even when law enforcement investigates. He chose to speak publicly through FOX 26 Houston, a step that exposes fraud survivors to unwanted scrutiny but warns other families before they face the same call. For the duration of that conversation, he had believed his son was in danger. ## How verification helps When the first caller spoke words that sounded like the man's son, a single question could have ended the call: 'What are the words?' Trust Onion gives families three rotating codewords that change every 60 seconds and are generated locally on each device, never stored on a server. A scammer with a cloned voice has no way to know those words. The fake public defender would never have had the opportunity to request payment, because the call would already have been identified as fraudulent. For an older adult like the man, the setup happens once with a family member's help. After that, if a call comes in from someone claiming to be a relative in trouble, the older adult asks one question and waits for the answer. A real family member reads the three words from their own device; a scammer cannot answer. A Proofie™ adds a further layer: a passkey-signed selfie that binds a photo to a specific key, time, and location, so a family member can send verifiable proof of where they are. Used together, codewords and Proofies give families tools that AI-cloned audio alone cannot defeat. Note that a failed callback to a loved one does not prove the original caller was legitimate; a pre-shared codeword works before any callback is needed. ## Key lessons - AI voice cloning requires only a small amount of publicly available audio to produce a convincing imitation of a family member's voice, making social media recordings a ready source for scammers. - Scammers pair a cloned voice with a fabricated authority figure, such as a fake attorney, to add institutional credibility and steer the target toward irreversible cryptocurrency payment. - A pre-agreed challenge question, such as Trust Onion's three rotating codewords, gives an older adult a concrete way to pause any emergency call and expose a cloned voice before any payment conversation begins. ## Key takeaways - A 71-year-old Houston man lost $15,000 in June 2026 to scammers using an AI-cloned version of his son's voice, with a second caller posing as a public defender to direct the cryptocurrency payment. - The fake emergency, a DUI arrest involving an injured pregnant woman, was designed to maximize emotional urgency and discourage verification; the man discovered the fraud only after calling his son directly. - Authorities advise calling a loved one back on a known, saved number, but a pre-shared codeword system provides protection before any callback is needed, since scammers can stay on the line or call back immediately to prevent it. ## Frequently asked questions ### What happened to the Houston man in this voice cloning scam? In June 2026, the man received a call from what sounded like his son's voice, claiming a DUI arrest after hitting a pregnant woman. A second caller posing as a public defender instructed him to pay $15,000 in cryptocurrency as bond money. The voice was AI-generated, his son was never in custody, and the funds were unrecoverable. ### How much money did the Houston voice cloning scam victim lose? The man lost $15,000, paid in cryptocurrency at the direction of a scammer posing as a public defender. Cryptocurrency transactions are irreversible, and the funds have not been recovered. ### How could this scam have been prevented? If the man's family had set up Trust Onion in advance, he could have asked the caller 'What are the words?' Trust Onion gives families three rotating codewords that change every 60 seconds, generated locally on each device. An AI-cloned voice cannot answer correctly. The challenge takes one second and Trust Onion is free. ### How did scammers clone the son's voice so convincingly? AI voice cloning tools can produce a convincing imitation from a small audio sample. Scammers likely sourced audio from social media videos or other public recordings. The resulting synthetic voice replicates tone, cadence, and speech patterns well enough to deceive a parent in an emotionally heightened moment. ### Why did the scammers demand cryptocurrency specifically? Cryptocurrency payments process immediately, cannot be reversed once sent, and are harder for law enforcement to trace than wire transfers or checks. Scammers specify cryptocurrency precisely because it eliminates the window in which a bank or payment processor might flag, delay, or reverse a suspicious transaction. ### How does an older adult use Trust Onion if they are not comfortable with technology? A family member sets it up once on the older adult's device. After that, if a call comes in from someone claiming to be a relative in trouble, the older adult asks 'What are the words?' The real family member reads three words from their own device. If the caller cannot answer, the call is a scam. No internet connection is needed at the moment of the call. Trust Onion is free. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Bay Area Mom Loses $5,400 in AI Voice Cloning Fake Kidnapping Scam" published: 2026-06-04T10:52:14.518Z updated: 2026-10-18T05:20:01.796Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/bay-area-mom-loses-5-400-in-ai-voice-cloning-fake-kidnapping-scam --- # Bay Area Mom Loses $5,400 in AI Voice Cloning Fake Kidnapping Scam **Cite as:** Bay Area Mom Loses $5,400 in AI Voice Cloning Fake Kidnapping Scam, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/bay-area-mom-loses-5-400-in-ai-voice-cloning-fake-kidnapping-scam Bay Area resident wired $5,400 to Mexico after scammers played an AI-cloned recording of her 37-year-old daughter's voice claiming she had been kidnapped by a Mexican drug cartel. The fraud ran for roughly five hours before the Bay Area resident called her daughter directly and found her safe at work. ## Incident facts - **Incident date:** May 2026 - **Location:** Bay Area, California, United States - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** $5,400 ## Timeline - **The Setup:** Scammers sourced a short audio clip of the daughter's voice, likely from a public social media post or online recording, then used AI voice cloning tools to generate a convincing replica in seconds. - **The Attack:** The Bay Area resident received a call in which the AI-generated voice claimed her daughter had been kidnapped by a Mexican drug cartel. Callers kept pressure on her for roughly five hours, directing her to wire money to Mexico. - **The Impact:** The Bay Area resident wired $5,400 to Mexico across multiple transactions while believing her daughter's life was in immediate danger. - **The Discovery:** The Bay Area resident called her daughter directly and found her safe at work, with no knowledge of any incident. The kidnapping was entirely fabricated and the voice had been AI-generated. - **The Fallout:** ABC7 News covered the case as part of a documented pattern of AI voice cloning ransom scams. Law enforcement, including Operation Shamrock, cited it as evidence of a trend targeting families across the United States. ## How the attack worked Scammers obtained a short audio sample of the daughter's voice, most likely from a public social media post or video. AI voice cloning tools, many commercially available, can generate convincing replicas from just a few seconds of source audio. When they called the Bay Area resident and played the recording, a voice she recognized as her daughter's told her the kidnapping was real. The callers held the Bay Area resident under sustained pressure for roughly five hours, a deliberate tactic to stop her from pausing to verify the claim. That window was enough to move $5,400 in wire transfers to Mexico. The fraud unraveled only when she ended the call and dialed her daughter, who answered from her workplace, safe and entirely unaware. ## Damage assessment The Bay Area resident wired $5,400 to Mexico across multiple transactions. Wire transfers sent internationally in fraud schemes of this type are largely irreversible, making recovery rare. Operation Shamrock and other authorities confirmed the incident fits a documented pattern of AI-assisted virtual kidnapping schemes. Each successful fraud finances further criminal operations and signals to other criminal networks that the method works, which accelerates its spread. ## How verification helps If the Bay Area resident's family had been using Trust Onion, asking "What are the words?" the moment the AI-generated voice played would have ended the call before any money moved. No AI system can know a family's current three rotating codewords, so the scammer would have had no valid answer. Note that a failed callback alone does not prove the original caller was legitimate; the caller must still know the family's private Trust Onion codewords. The codewords rotate every 60 seconds and are calculated locally on each device, with no server to breach and no database to steal from. Families can also use a Proofie™, a selfie signed by a passkey through the Trust Onion app, to share verifiable proof of safety. In a scenario engineered to keep a victim isolated and overwhelmed, a rehearsed challenge removes the need for any judgment call under pressure: the answer is either correct or it is not. ## Key lessons - AI voice cloning requires only seconds of publicly available audio, making anyone with an online presence a potential target for voice impersonation scams. - Virtual kidnapping scammers deliberately extend calls for hours to stop victims from independently verifying the claim with the supposed victim directly. - A pre-established family verification challenge using Trust Onion's three rotating codewords, known only to trusted members, removes the need to make judgment calls about voice authenticity under extreme emotional pressure. ## Key takeaways - A Bay Area resident wired $5,400 to Mexico after scammers played an AI-generated clone of her daughter's voice in a fake kidnapping call. - The fraud lasted roughly five hours before she called her daughter directly and confirmed she was safe at work. - A simple challenge question using Trust Onion's three rotating codewords would have exposed the cloned voice instantly, regardless of audio quality. The words rotate every 60 seconds and cannot be known by any AI system or scammer. ## Frequently asked questions ### What happened in the Bay Area AI voice cloning kidnapping scam? A Bay Area resident received a call in which scammers played an AI-generated clone of her 37-year-old daughter's voice, claiming her daughter had been kidnapped by a Mexican drug cartel. Over roughly five hours, the Bay Area resident wired $5,400 to Mexico before calling her daughter directly and finding her safe at work. ### How much money did the Bay Area resident lose? The Bay Area resident lost $5,400 in wire transfers sent to Mexico during the roughly five-hour call. Wire transfers of this kind are largely irreversible, particularly when sent internationally. ### How did scammers clone her daughter's voice? Scammers used AI voice cloning tools that can generate convincing replicas from just a few seconds of source audio, most likely pulled from a public social media post or online recording. Law enforcement has noted the method requires minimal technical skill and is accessible to a wide range of criminals. ### How could this scam have been caught before any money was sent? Asking "What are the words?" at the start of the call would have exposed the fraud immediately. Trust Onion's three rotating codewords are known only to trusted family members, calculated locally on each device, and rotate every 60 seconds. No AI voice clone can produce the current words, so the scammer would have had no valid answer. ### Are virtual kidnapping scams using AI voice cloning common? Yes. Authorities including Operation Shamrock have confirmed that AI voice cloning ransom scams are a growing trend. The technology is commercially available and low-cost, and the method has proven effective enough that criminal networks are adopting it more widely. --- title: "AI Scammers Clone Daughter's Voice to Extort Vancouver Man" published: 2026-05-09T14:42:44.665Z updated: 2026-10-11T06:13:12.690Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-scammers-clone-daughter-s-voice-to-extort-vancouver-man --- # AI Scammers Clone Daughter's Voice to Extort Vancouver Man **Cite as:** AI Scammers Clone Daughter's Voice to Extort Vancouver Man, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-scammers-clone-daughter-s-voice-to-extort-vancouver-man Scammers cloned the voice of a Vancouver, Washington man's daughter and staged a fake kidnapping call demanding ransom. He recognized the fraud before transferring any money and confirmed his daughter was safe. ## Incident facts - **Incident date:** 2024 - **Location:** Vancouver, Washington, United States - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Prevented - **Financial impact:** undisclosed ## Timeline - **The Setup:** Scammers collected audio of the victim's daughter, likely from publicly available social media videos, and used AI voice-cloning software to generate a convincing replica of her voice. - **The Attack:** The man received a call in which a voice mimicking his daughter cried out in distress, followed by a second caller claiming she had been kidnapped and demanding an immediate ransom payment. - **The Impact:** The cloned voice was convincing enough to cause serious alarm. Hearing what sounded like his daughter in danger was the scammers' primary weapon. - **The Discovery:** The victim recognized signs of the scam before sending money, then reached his actual daughter directly and confirmed she was safe. - **The Fallout:** The man reported the incident to KGW News in Portland, Oregon, prompting AI experts to publicly explain how voice-cloning technology enables this type of fraud. ## How the attack worked The call followed the structure of a classic virtual kidnapping scam, updated with AI. The victim heard what sounded like his daughter's voice, distressed and crying out, before a second person took over and demanded ransom. Modern voice-cloning tools can produce a convincing replica from as little as a few seconds of recorded audio, which means any publicly posted video or audio clip is a potential source for fraudsters. The emotional shock of hearing a loved one apparently in danger is designed to override rational thinking and push the target into paying immediately. Commercially available tools can clone a voice with minimal effort, and calls are often placed from spoofed numbers to add credibility. The Vancouver man did not send money, but the incident shows how little time a target has to think clearly before the pressure of the moment takes over. ## Damage assessment No money was lost, but the emotional toll of receiving a call that sounds like a panicked, endangered child is real and not trivial. The seconds and minutes during which this man believed his daughter might be in danger represent a form of harm that has no financial measure. Virtual kidnapping scams that use AI voice cloning are especially damaging because they exploit a parent's instinct to protect their child. Even when the victim spots the fraud, the experience can produce lasting anxiety and distrust of phone calls from family members. When incidents like this become public, they also erode confidence in phone communication during genuine emergencies. ## How verification helps When the caller played the AI-cloned voice, a single question would have ended the scam immediately: 'What are the words?' Trust Onion lets families share three private codewords that rotate every 60 seconds, calculated locally on each device with no server to compromise. No scammer, however convincingly they replicate a voice, can know words that exist only between family members and change every minute. A family verification protocol changes the dynamic of a panic-driven call. Rather than trying to reason through whether the voice sounds right, the father would have had a simple, practiced response: ask for the words. A Proofie™, a selfie signed using a passkey in the Trust Onion app, can further confirm a family member's identity and location when the signed record is verified against their full public key in a shared group. ## Key lessons - AI voice-cloning tools can replicate a family member's voice using only a small amount of publicly available audio, such as social media clips. - Virtual kidnapping scams rely on panic to prevent rational thinking. A pre-agreed family verification method counters this by giving the target a practiced, calm response: ask 'What are the words?' and wait for the three Trust Onion codewords. - Calling a loved one directly on a known number is an important immediate step, but a shared codeword system can expose the fraud even faster, before a ransom demand gains traction. ## Key takeaways - AI voice cloning was used to impersonate a Vancouver man's daughter in a virtual kidnapping extortion call, requiring only publicly available audio to produce a clone convincing enough to cause genuine alarm. - The victim avoided financial loss by recognizing the scam, but the emotional impact of the call was real and lasting. - A pre-agreed family codeword challenge using Trust Onion would have exposed the fake voice instantly. The three rotating codewords change every 60 seconds and cannot be guessed or cloned alongside a voice. ## Frequently asked questions ### What happened in the Vancouver AI voice cloning scam? Scammers used AI to clone the voice of a Vancouver, Washington man's daughter and placed a call in which the cloned voice appeared to be in distress. A second caller then demanded ransom, claiming the daughter had been kidnapped. The man recognized the scam before transferring any money and confirmed his daughter was safe. ### How much money was lost in this incident? No financial loss was reported. The victim recognized the scam before making any payment. Virtual kidnapping scams of this type frequently succeed in extracting thousands of dollars from victims who have no quick way to verify their family member's safety. ### How could a family codeword have helped in this situation? If the family had been using Trust Onion's three rotating codewords, the father could have immediately asked the caller, 'What are the words?' The AI-generated voice would have had no way to answer correctly, exposing the fraud within seconds. The codewords are known only to the family members who set them up together, rotate every 60 seconds, and are calculated locally on each device with no server to compromise. ### How do scammers clone a person's voice? AI voice-cloning tools can generate a convincing replica of someone's voice using as little as a few seconds of recorded audio. Scammers commonly pull this audio from publicly posted social media videos, podcasts, or other online content. The resulting clone can generate new speech in real time or as pre-recorded audio played during a phone call. ### What should I do if I receive a call like this? Stay as calm as possible and do not engage with the ransom demand. If your family uses Trust Onion, ask the caller for the current three codewords. If they cannot provide them, the call is fraudulent. Contact your family member directly using a known number to confirm they are safe. Note that calling back on a number provided by the scammer is not a reliable safety check. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Ireland's 'Hi Mam, Hi Dad' Text Scam Targets Parents via Fake Child Messages" published: 2026-04-22T12:06:36.950Z updated: 2026-10-11T06:13:13.019Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ireland-s-hi-mam-hi-dad-text-scam-targets-parents-via-fake-child-messages --- # Ireland's 'Hi Mam, Hi Dad' Text Scam Targets Parents via Fake Child Messages **Cite as:** Ireland's 'Hi Mam, Hi Dad' Text Scam Targets Parents via Fake Child Messages, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ireland-s-hi-mam-hi-dad-text-scam-targets-parents-via-fake-child-messages In April 2026, fraudsters texted Irish parents posing as their children, claiming a new phone number and demanding urgent bank transfers. The campaign ran alongside bank impersonation texts targeting the same population through the same channel. ## Incident facts - **Incident date:** April 2026 - **Location:** Ireland - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Ongoing - **Financial impact:** undisclosed ## Timeline - **The Setup:** Scammers obtained mobile numbers belonging to parents and guardians, likely through data breaches or purchased contact lists. They wrote messages that mimicked the informal tone of a child texting a parent, opening with 'Hi Mam' or 'Hi Dad' to establish immediate familiarity. - **The Attack:** Fraudsters sent unsolicited SMS messages claiming to be a recipient's child contacting them from a new phone number, creating urgency by stating the child needed money quickly. Parents were asked to save the new number and send funds via bank transfer. - **The Impact:** An undisclosed number of Irish families received the messages. Some parents, believing they were communicating with their own child, transferred money to scammer-controlled accounts before realising the contact was fraudulent. - **The Discovery:** TechBuzz Ireland identified and reported the scam wave in early April 2026 after multiple consumer reports. Warnings spread through consumer protection channels and media coverage across Ireland. - **The Fallout:** Irish consumers were advised to contact their banks immediately if they had transferred funds and to report the messages to relevant authorities. The scam continued to circulate alongside parallel bank impersonation texts targeting the same population. ## How the attack worked A text arrives: 'Hi Mam' or 'Hi Dad', followed by a claim that the sender is their child, reaching out from a new or temporary number. Once the parent replies, the scammer introduces an urgent financial need, a broken phone, an unpaid bill, an emergency, and asks for a bank transfer to an account under a plausible alias. The messages go out in bulk with generic openers and require no prior knowledge of the child's name; volume does the work. The campaign ran alongside bank impersonation texts circulating in Ireland at the same time, mimicking notifications from financial institutions to harvest login credentials or card details. Together, the two attack types targeted both emotional and financial vulnerabilities in the same population through the same channel. ## Damage assessment Aggregate financial losses from this scam wave were not publicly disclosed. Individual victims who transferred funds before spotting the fraud faced immediate monetary loss with limited recovery options, since bank transfers to scammer-controlled accounts are difficult to reverse once the receiving account is emptied. Parents who believed they were helping a child in crisis and later discovered the deception reported embarrassment, anxiety, and a lasting wariness of SMS communications. Some became reluctant to respond quickly to genuine urgent messages from their children, which strained normal family communication. ## How verification helps The 'Hi Mam, Hi Dad' scam depends entirely on a parent being unable to confirm in the moment whether they are speaking with their real child. When a message arrives claiming to be from a child with a new number, a parent using Trust Onion can reply with one question: 'What's the word?' A real child knows the current codeword and can answer instantly. A scammer cannot. Trust Onion codewords rotate every few hours, are calculated locally on each device, and work offline, so there is no central database a fraudster could breach to obtain the current word. For an extra layer of assurance, a child can send a Proofie™, a selfie signed by their passkey the moment they take it, so the parent can verify in the Trust Onion app that the exact original photo is unchanged and that the full signing key matches the one in their shared family group. A failed callback to a number you already hold does not by itself prove the original message was fraudulent, so the family's private codewords remain the decisive check. ## Key lessons - Any SMS claiming to be from a family member with a new number should be verified through a pre-agreed family codeword before any money is transferred. - Scammers use generic, high-volume text blasts that require no knowledge of the child's name; any parent can receive these messages. - Running family impersonation scams alongside bank impersonation texts in the same campaign increases the likelihood that at least one attack type will succeed against a given target. ## Key takeaways - Irish families were targeted in April 2026 by SMS scams in which fraudsters posed as their children claiming a new phone number and requesting urgent money transfers. - The 'Hi Mam, Hi Dad' scam does not require the fraudster to know the child's name; generic openers sent at volume are enough to deceive a percentage of recipients. - Bank impersonation texts circulated alongside family impersonation texts in the same campaign, targeting both emotional and financial vulnerabilities via SMS. ## Frequently asked questions ### What is the 'Hi Mam, Hi Dad' scam? Scammers text parents claiming to be their child contacting them from a new phone number. After a brief exchange, they claim to need money urgently and request a bank transfer. The messages go out in bulk and require no knowledge of the child's actual name. ### How much money was lost in this scam wave? Aggregate financial losses from this specific April 2026 wave were not publicly disclosed. Individual victims who transferred funds before identifying the fraud faced immediate losses that are typically difficult to recover through bank reversal processes. ### How could this scam have been prevented? A pre-agreed family codeword stops it cold. When the message arrives, the parent asks: 'What's the word?' A real child using Trust Onion knows the rotating codeword and answers immediately. A scammer cannot. Codewords rotate every few hours, work offline, and are calculated locally, so no fraudster can obtain or guess the current word. ### Why do these scams work if they use generic greetings? They succeed through volume. Only a small percentage of recipients need to respond for the campaign to be profitable. The greeting 'Hi Mam' or 'Hi Dad' is emotionally resonant, and the urgency of a child claiming to be in trouble overrides the skepticism many people would otherwise apply to an unsolicited message. ### What should I do if I receive one of these texts? Do not transfer money or click any links. Contact your child using a number you already have saved, not the one in the suspicious message. If you have already transferred funds, contact your bank immediately. Report the message to your national consumer protection authority. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "Missouri Mom Loses Thousands to AI Voice Clone Kidnapping Hoax" published: 2026-04-22T11:34:04.306Z updated: 2026-10-18T05:20:06.564Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/missouri-mom-loses-thousands-to-ai-voice-clone-kidnapping-hoax --- # Missouri Mom Loses Thousands to AI Voice Clone Kidnapping Hoax **Cite as:** Missouri Mom Loses Thousands to AI Voice Clone Kidnapping Hoax, Trust Onion, 2026-10-18. https://trustonion.io/case-studies/missouri-mom-loses-thousands-to-ai-voice-clone-kidnapping-hoax A Missouri woman received a call displaying her college-age daughter's real phone number, with an AI-cloned voice simulating a kidnapping, and wired thousands of dollars over roughly 90 minutes. Her daughter was never in danger. ## Incident facts - **Incident date:** February 2026 - **Location:** Missouri, United States - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** Thousands of dollars (exact amount undisclosed) ## Timeline - **The Setup:** Scammers spoofed the daughter's real phone number and gathered voice samples, likely from social media or other public recordings, to generate a convincing AI clone of her voice. - **The Attack:** The Missouri woman received a call displaying her daughter's number. An AI-cloned voice screamed that she had been kidnapped, then a second voice threatened to kill the daughter unless the mother wired money immediately. - **The Impact:** Believing her daughter's life was in immediate danger, the Missouri woman wired thousands of dollars over approximately 90 minutes while being kept on the phone under sustained psychological pressure. - **The Discovery:** The Missouri woman eventually reached her actual daughter, who was safe and unaware anything had happened. The call had been a fabrication from start to finish. - **The Fallout:** WDBJ7 covered the incident in early March 2026. The wired funds were not recovered, and the Missouri woman shared her experience publicly to warn other parents. ## How the attack worked The call appeared to come from her daughter's real phone number, so the mother's first instinct to question who was calling never fired. The familiar number primed her to accept what she was hearing before the conversation even started. Behind it was an AI-cloned voice built from audio samples likely pulled from social media, since modern voice synthesis tools can produce a convincing clone from only a few seconds of source audio. Once the cloned voice established the false emergency, a second person took over as the kidnapper, issuing death threats and telling the mother not to hang up and not to contact anyone else. Keeping her isolated and on the line for approximately 90 minutes compressed every decision into a narrow window of terror, with no pause long enough for rational verification. ## Damage assessment The Missouri woman wired thousands of dollars to the scammers during the call. Wire transfers are typically irreversible, and the funds were not recovered; the exact total was not publicly disclosed. Beyond the money, the Missouri woman spent roughly 90 minutes believing her daughter was in mortal danger. She chose to share her story publicly afterward to help other families recognize the pattern, but the burden of that warning falls entirely on someone who has already been harmed. ## How verification helps A shared family codeword would have stopped this attack the moment the cloned voice spoke. Asking one question, "What's the word?", immediately tests whether the voice is real; an AI-generated clone cannot answer a question it has never heard. That single exchange would have exposed the call as fraudulent before any money changed hands. Trust Onion's codewords rotate every few hours and are calculated locally on each device, with no server storing the current word. There is no database for scammers to breach, and no way to look up the active codeword before it changes again. Note that a failed callback to your daughter's number would not, by itself, confirm the original caller was a scammer; always pair a callback with the family codeword check. ## Key lessons - A caller ID showing a family member's real number is not proof the caller is that person. Phone numbers can be spoofed trivially. - AI voice cloning requires only a small amount of publicly available audio. Any voice shared on social media can potentially be replicated. - Scammers use sustained, high-pressure tactics to prevent victims from pausing long enough to verify the situation. A prearranged verification word removes the need for that pause. ## Key takeaways - A Missouri mother lost thousands of dollars in 90 minutes after scammers used an AI clone of her daughter's voice to stage a fake kidnapping call. - The call displayed the daughter's real phone number, bypassing the mother's first line of skepticism before the conversation began. - A shared family codeword challenges the voice, not the number, exposing AI-generated callers regardless of how realistic they sound. ## Frequently asked questions ### What happened in the Missouri AI voice cloning kidnapping scam? A Missouri woman received a call appearing to come from her college-age daughter's phone number. An AI-cloned voice simulated a kidnapping, and a second caller threatened to kill the daughter unless the mother wired money. The mother complied over roughly 90 minutes. Her daughter was never in danger. ### How much money did the Missouri woman lose in the fake kidnapping scam? The Missouri woman lost thousands of dollars, wired to scammers during the call. The exact amount was not publicly disclosed. Wire transfers are generally irreversible, and the funds were not recovered. ### How did the scammers clone the daughter's voice? AI voice cloning tools can generate a convincing replica from a short audio sample. Scammers likely gathered recordings from the daughter's social media or other public sources, then used the clone in real time to simulate distress during the call. ### Why did the call appear to come from the daughter's real phone number? Scammers used phone number spoofing, a technique that makes an outgoing call display any number the caller chooses. Caller ID alone cannot confirm the identity of the person on the line. ### How could a family codeword have helped in this situation? If the mother had asked "What's the word?", the AI-generated voice could not have answered. A voice clone replicates how someone sounds but cannot know a private codeword shared only within the family. That single question would have exposed the call as fraudulent before any money changed hands. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger. --- title: "AI Voice Cloning Scams Fool Families With Fake Relatives" published: 2026-04-16T13:40:51.803Z updated: 2026-10-11T06:13:13.491Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/case-studies/ai-voice-cloning-scams-fool-families-with-fake-relatives --- # AI Voice Cloning Scams Fool Families With Fake Relatives **Cite as:** AI Voice Cloning Scams Fool Families With Fake Relatives, Trust Onion, 2026-10-11. https://trustonion.io/case-studies/ai-voice-cloning-scams-fool-families-with-fake-relatives In March 2023, criminals used AI voice cloning tools to impersonate family members over the phone, needing only a short audio clip pulled from social media to produce a convincing replica. The FTC issued a national warning that a familiar-sounding voice is no longer reliable proof of identity, and cybersecurity experts pointed to family codewords as the most practical defense. ## Incident facts - **Incident date:** March 2023 - **Location:** United States - **Victim type:** Family - **Attack type:** Voice cloning - **Outcome:** Successful fraud - **Financial impact:** undisclosed ## Timeline - **The Setup:** AI voice cloning tools became widely accessible, letting criminals generate convincing voice replicas from audio clips as short as a few seconds. Millions of people had enough audio publicly available on social media to become targets. - **The Attack:** Scammers pulled voice samples from social media profiles, ran them through AI cloning software, and called families posing as sons, daughters, grandchildren, or other relatives. They fabricated emergencies such as arrests, accidents, or hospitalizations, then demanded immediate money transfers or sensitive personal information. - **The Impact:** Multiple families transferred money or disclosed personal information before realizing the calls were fraudulent. The cloned voices were convincing enough that most victims had no reason to doubt the caller until after the damage was done. - **The Discovery:** Victims typically uncovered the fraud after contacting the real family member whose voice had been cloned, finding that person knew nothing about the emergency described. In some cases, financial institutions flagged unusual transfers and alerted account holders. - **The Fallout:** CBS News and the FTC brought the pattern to national attention, with the FTC advising consumers to treat all unexpected calls from relatives as potentially fraudulent regardless of how authentic the voice sounds. Cybersecurity experts publicly endorsed family codewords as the most practical countermeasure available to ordinary consumers. ## How the attack worked A single TikTok video, Instagram reel, or YouTube clip provided enough raw material. AI voice cloning tools, once limited to expensive production studios, became available through cheap or free software in the months before this wave of fraud. They analyze a voice sample and produce a synthetic replica capable of saying anything the attacker types, trained on audio as brief as a few seconds. Scammers identified targets, found publicly available audio of a family member's voice, and fed it into a cloning tool. The resulting synthetic voice drove a phone call built around a fabricated emergency: a grandchild claiming to be in jail after an accident, a child describing a medical crisis, a relative stranded abroad. Callers then pressured victims to act immediately and keep the situation secret from other family members, two conditions that stopped anyone from verifying the caller's identity before money went out via wire transfer, gift card, or peer-to-peer payment app. ## Damage assessment Individual losses ranged from hundreds to tens of thousands of dollars per incident, with gift cards, wire transfers, and payment app transactions the preferred methods because they are nearly impossible to reverse. Aggregate losses to imposter scams reported to the FTC reached $2.6 billion in 2022, a figure that kept growing as AI voice tools became more accessible in 2023. Beyond the money, victims described shame, confusion, and a lasting erosion of trust in phone communications. Believing a loved one was in danger, acting out of care, and then learning the emergency was fabricated produced distress that extended well beyond the monetary loss. ## How verification helps One question stops a voice cloning attack cold: 'What are the words?' Trust Onion gives every family three private codewords that rotate every 60 seconds. Only people who set up Trust Onion together know the current words, and an AI-generated voice cannot answer correctly. If the caller falls silent, makes an excuse, or hangs up, that response alone signals something is wrong before any money changes hands. For added assurance, a family member can send a Proofie™ through the Trust Onion app: a selfie signed by their passkey at the moment it was taken, binding their key to the exact photo, date, time, and location. Codewords and Proofies work alongside each other. If a suspicious call prompts you to call back, use a number you already have on file rather than any number the caller provides; a completed callback does not by itself prove the original caller was legitimate. ## Key lessons - A voice that sounds like a family member is no longer reliable proof of identity. AI voice cloning tools can replicate anyone's voice from a few seconds of publicly available audio. - Scammers deliberately create urgency and secrecy to prevent victims from pausing to verify a caller's identity through a second, independent channel. - Asking 'What are the words?' using Trust Onion's three rotating codewords is a low-tech, high-reliability defense that cannot be defeated by voice cloning alone. The words rotate every 60 seconds and work offline, so they remain dependable in any situation. ## Key takeaways - AI voice cloning tools require as little as a few seconds of audio from social media to convincingly replicate a family member's voice. - The FTC formally warned in March 2023 that consumers can no longer trust a familiar-sounding voice as proof of a caller's identity. - Imposter scams cost Americans $2.6 billion in 2022, with losses growing as AI voice cloning tools became more widely available in 2023. ## Frequently asked questions ### What happened in this AI voice cloning scam incident? Criminals used AI voice cloning software to replicate family members' voices, then called relatives claiming to be in an emergency and demanding immediate money transfers or personal information. The technology required only a short audio clip from a social media post. The FTC issued a national warning in March 2023 after the pattern became widespread. ### How much money did victims lose in AI voice cloning scams? Individual losses ranged from hundreds to tens of thousands of dollars per incident. The FTC reported imposter scams cost Americans $2.6 billion in 2022, with losses continuing to grow as AI voice tools became more accessible in 2023. Exact figures for this specific wave were not fully aggregated at the time of reporting. ### How could a family have protected itself from an AI voice cloning call? A shared set of codewords is the most effective defense. Trust Onion gives families three private codewords rotating every 60 seconds; asking 'What are the words?' immediately exposes a cloned voice. For visual proof, a Proofie™ signed through the Trust Onion app binds a photo to a passkey, date, and location. If calling back, use a number already on file, not one the caller provided. ### How little audio does a scammer need to clone someone's voice? According to cybersecurity experts cited in the March 2023 CBS News report, AI voice cloning tools can produce a convincing replica from as little as a few seconds of audio. A single social media video, voicemail recording, or public clip provides enough raw material for the cloning process. ### Why are gift cards and wire transfers so common in these scams? Scammers request gift cards, wire transfers, and peer-to-peer payment app transactions because these methods are extremely difficult or impossible to reverse once completed. Unlike a credit card charge, a wire transfer or gift card purchase leaves the victim with almost no recourse after the money leaves their account. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger.