How to Protect Your Friends and Club from AI Scams

A message lands in your club's group chat. It's your treasurer — same name, same photo — saying the venue changed payment providers and this month's dues need to go to a new account, today. Or a close friend calls, voice shaking, asking you to cover an emergency transfer until tomorrow. The voice is theirs. The urgency feels real. But it isn't them. Scammers now clone a voice from a 3-second clip pulled off social media, and impersonating "someone in the group" is one of their favorite plays — because friends and teammates trust each other by default.

This guide gives your circle a complete plan: how these scams work, why groups are uniquely exposed, why a shared codeword defeats them, and the exact steps to protect your friend group, club, or team this week. (Protecting your family? There's a dedicated family protection guide too.)

Once your group is set up, share the Three Words Check — our free five-step verification protocol for the moment a suspicious call or text arrives.

AI impersonation scams thrive on exactly what makes a group a group: default trust, routine money movement, and a chat history full of context.

A group multiplies the scammer's return: impersonate one trusted member and the whole roster becomes a mark. The playbook is always the same three moves:

• Urgency. Dues to the new account today. The transfer covered tonight. No time to check with anyone.
• Untraceable payment. A "new" account, gift cards, crypto, wires — anything that can't be reversed once it moves.
• Isolation. "Keep this between us" or a private DM instead of the group chat — the scam dies the moment the group compares notes.

The identities scammers pick are predictable: whoever handles money or gives instructions others act on. Treasurers, trip organizers, coaches, club presidents, group-chat admins. Those are the people whose voices and writing styles get cloned — and the people whose requests everyone reflexively obeys.

AI can clone a voice, mimic a texting style, even fake a video call. The one thing it cannot do is know a secret your group never posted anywhere.

So the defense is one shared question. Any request involving money or changed payment details gets answered with: "What are the words?" A real member answers instantly from the app. A scammer — no matter how perfect the clone — has nothing to say. The scam dies in the group chat, in public, in seconds.

This is the same strategy security researchers and BBC Future's August 2026 feature "The secret codewords that scammers hate" recommend for families — read our take on the BBC piece. For groups there's one extra wrinkle: a single static password shared across a whole club is fragile. One leaked screenshot compromises it forever, and clubs churn members. That's why groups especially benefit from rotating codewords that change automatically every 60 seconds — a leaked word expires before anyone can use it, and a departed member's knowledge goes stale within a minute.

1Make the rule before the scam arrives

Put one sentence in the group chat or say it before the next practice: "Any request involving money or a new account gets verified with the codewords — no exceptions, even if it comes from the treasurer." Agreeing on this in advance is the whole battle; a real member will never mind being verified, and a scammer can't survive it.

2Set up rotating codewords with Trust Onion

Trust Onion is free on iPhone and Android, takes about 60 seconds, and needs no account — so nobody in the group has an excuse not to install it:

1. Download the app. Free on the App Store and Google Play. No subscription, no paywall.
2. Create your group. Tap the + button and pick a name your group will recognize — "Sunday Ride Crew", "FC Northside", "Book Club" all work.
3. Invite the group. Drop the invite code in your group chat — especially anyone who handles money, like a treasurer or trip organizer. Everyone who joins sees the same three words at the same time.

Once everyone is in, every phone in the group displays the same three rotating words. They change automatically every 60 seconds and are generated locally on each phone — no server, no cloud, no account. Trust Onion never sees your codewords because they never leave your device, so even if the Wi-Fi at the clubhouse goes out, the words still work.

3Use the words the moment something feels off

A text from an unknown number: "Hey, it's Jamie — dropped my phone in the lake this weekend, this is my new number. Can you send the dues money here instead?" It sounds like Jamie. It might even use Jamie's texting style, because AI can study someone's messages and mimic how they write. You text back: "What are the three words?" If they can't answer, it's not Jamie. Conversation over.

The codewords rotate on a timer, so even if a scammer somehow overheard yesterday's words, they've already expired. And because the words are calculated on each device with no server involved, there's no database to hack and no transmission to intercept.

4Escalate to a Proofie™ when money is on the line

Public by default, under your control. Proofie photos and signed records are stored securely on Amazon Web Services (AWS). A Proofie is public by default: anyone with its link or QR code can view the photo and signed record. You can add a password to make a Proofie private, or delete it at any time. Deleting a Proofie removes its photo and signed record from our AWS storage and takes its link offline, but cannot recall copies someone has already downloaded or saved.

5Know what to do if a scam gets through

If your group is targeted: don't pay, verify with the real person on a number you already have saved, and warn the whole group immediately so nobody else pays — scammers often hit several members at once. If money moved, call the bank right away; minutes matter for reversals. Then report it: the FTC at reportfraud.ftc.gov and the FBI's Internet Crime Complaint Center at ic3.gov.

---

Why do scammers target friend groups, clubs, and teams?

Because groups trust each other by default and routinely move money: dues, trip deposits, gear orders, fundraisers. A scammer who impersonates one member — especially a treasurer or organizer — inherits the whole group's trust at once. Group chats also leak the exact context (names, events, payment habits) a scammer needs to sound convincing.

What does an AI impersonation scam against a club look like?

Common patterns: a message from the 'treasurer' saying dues must go to a new account today; a 'friend' texting from a new number asking you to cover an urgent transfer; a voice note from the 'club president' authorizing a payment. The voice or writing style is cloned by AI — modern tools need only seconds of audio from social media to build a convincing clone.

What is a group codeword and why does it stop these scams?

A group codeword is a private word or phrase only your group knows. When a message or call asks for money or a change of payment details, anyone can reply: what are the words? AI can clone a voice and mimic a texting style, but it cannot know a secret your group never posted anywhere. A missing or wrong answer ends the scam in seconds.

Is a rotating codeword better than one fixed group password?

Yes. A static password shared across a whole club is especially fragile — one leaked screenshot compromises it forever. Rotating codewords change automatically every 60 seconds, so a leaked word expires before it can be reused. Trust Onion generates three rotating codewords locally on each member's phone, with no server involved, so there is nothing to intercept.

Who in the group most needs to be in the codeword system?

Everyone benefits, but prioritize anyone who handles money or makes requests others act on: the treasurer, trip organizer, coach, club officers, and admins of the group chat. Those are the identities scammers impersonate, and the people most likely to receive urgent payment requests.

What should our group do if a scam message gets through?

Do not pay. Verify directly with the real person on a number you already have saved, and warn the whole group immediately so nobody else pays. If money moved, contact the bank right away, then report the scam to the FTC at reportfraud.ftc.gov and the FBI's Internet Crime Complaint Center at ic3.gov.

---

Set up your friends or club today

One message in the group chat, a 60-second app setup, and one agreed rule — that's the whole plan. Download the app, create a group, drop the code in your chat — and if you want the same protection at home, follow the family protection guide next. For the story behind the strategy, read why scammers hate secret codewords.