How to Protect Your Friends and Club from AI Scams
The statistics, the warning signs, why group codewords work, and a step-by-step plan to stop AI impersonation scams targeting your friend group, club, or team.
A message lands in your club's group chat. It's your treasurer — same name, same photo — saying the venue changed payment providers and this month's dues need to go to a new account, today. Or a close friend calls, voice shaking, asking you to cover an emergency transfer until tomorrow. The voice is theirs. The urgency feels real. But it isn't them. Scammers now clone a voice from a 3-second clip pulled off social media, and impersonating "someone in the group" is one of their favorite plays — because friends and teammates trust each other by default.
This guide gives your circle a complete plan: how these scams work, why groups are uniquely exposed, why a shared codeword defeats them, and the exact steps to protect your friend group, club, or team this week. (Protecting your family? There's a dedicated family protection guide too.)
Once your group is set up, share the Three Words Check — our free five-step verification protocol for the moment a suspicious call or text arrives.
AI impersonation scams thrive on exactly what makes a group a group: default trust, routine money movement, and a chat history full of context.
A group multiplies the scammer's return: impersonate one trusted member and the whole roster becomes a mark. The playbook is always the same three moves:
- Urgency. Dues to the new account today. The transfer covered tonight. No time to check with anyone.
- Untraceable payment. A "new" account, gift cards, crypto, wires — anything that can't be reversed once it moves.
- Isolation. "Keep this between us" or a private DM instead of the group chat — the scam dies the moment the group compares notes.
The identities scammers pick are predictable: whoever handles money or gives instructions others act on. Treasurers, trip organizers, coaches, club presidents, group-chat admins. Those are the people whose voices and writing styles get cloned — and the people whose requests everyone reflexively obeys.
AI can clone a voice, mimic a texting style, even fake a video call. The one thing it cannot do is know a secret your group never posted anywhere.
So the defense is one shared question. Any request involving money or changed payment details gets answered with: "What are the words?" A real member answers instantly from the app. A scammer — no matter how perfect the clone — has nothing to say. The scam dies in the group chat, in public, in seconds.
This is the same strategy security researchers and BBC Future's August 2026 feature "The secret codewords that scammers hate" recommend for families — read our take on the BBC piece. For groups there's one extra wrinkle: a single static password shared across a whole club is fragile. One leaked screenshot compromises it forever, and clubs churn members. That's why groups especially benefit from rotating codewords that change automatically every 60 seconds — a leaked word expires before anyone can use it, and a departed member's knowledge goes stale within a minute.
1Make the rule before the scam arrives
Put one sentence in the group chat or say it before the next practice: "Any request involving money or a new account gets verified with the codewords — no exceptions, even if it comes from the treasurer." Agreeing on this in advance is the whole battle; a real member will never mind being verified, and a scammer can't survive it.
2Set up rotating codewords with Trust Onion
Trust Onion is free on iPhone and Android, takes about 60 seconds, and needs no account — so nobody in the group has an excuse not to install it:
- Download the app. Free on the App Store and Google Play. No subscription, no paywall.
- Create your group. Tap the + button and pick a name your group will recognize — "Sunday Ride Crew", "FC Northside", "Book Club" all work.
- Invite the group. Drop the invite code in your group chat — especially anyone who handles money, like a treasurer or trip organizer. Everyone who joins sees the same three words at the same time.
Once everyone is in, every phone in the group displays the same three rotating words. They change automatically on a timer and are generated locally on each phone — no server, no cloud, no account. Trust Onion never sees your codewords because they never leave your device, so even if the Wi-Fi at the clubhouse goes out, the words still work.
3Use the words the moment something feels off
A text from an unknown number: "Hey, it's Jamie — dropped my phone in the lake this weekend, this is my new number. Can you send the dues money here instead?" It sounds like Jamie. It might even use Jamie's texting style, because AI can study someone's messages and mimic how they write. You text back: "What are the three words?" If they can't answer, it's not Jamie. Conversation over.
The codewords rotate on a timer, so even if a scammer somehow overheard yesterday's words, they've already expired. And because the words are calculated on each device with no server involved, there's no database to hack and no transmission to intercept.
4Escalate to a Proofie when money is on the line
Some scams hit harder than a text: a call from a "friend" stranded abroad who needs a transfer, a voice note from your "club president" authorizing a payment. That's when you ask for a Proofie — a verified selfie that proves a real person took it, right now, on their actual phone. It carries the current codewords, a timestamp, GPS location, and a cryptographic signature locked to the sender's device biometrics.
Each member's phone generates a unique Proof ID tied to their device and Face ID or fingerprint. Every Proofie is signed with it and checked automatically on arrival — a mismatch is rejected on the spot. You can't fake a Proofie with AI: the words rotate too fast to pre-generate one, the biometric signature can't be copied to another device, and the location shows where the sender actually is. Proofies go straight from their phone to yours; Trust Onion never stores or sees them.
5Know what to do if a scam gets through
If your group is targeted: don't pay, verify with the real person on a number you already have saved, and warn the whole group immediately so nobody else pays — scammers often hit several members at once. If money moved, call the bank right away; minutes matter for reversals. Then report it: the FTC at reportfraud.ftc.gov and the FBI's Internet Crime Complaint Center at ic3.gov.
Why do scammers target friend groups, clubs, and teams?
Because groups trust each other by default and routinely move money: dues, trip deposits, gear orders, fundraisers. A scammer who impersonates one member — especially a treasurer or organizer — inherits the whole group's trust at once. Group chats also leak the exact context (names, events, payment habits) a scammer needs to sound convincing.
What does an AI impersonation scam against a club look like?
Common patterns: a message from the 'treasurer' saying dues must go to a new account today; a 'friend' texting from a new number asking you to cover an urgent transfer; a voice note from the 'club president' authorizing a payment. The voice or writing style is cloned by AI — modern tools need only seconds of audio from social media to build a convincing clone.
What is a group codeword and why does it stop these scams?
A group codeword is a private word or phrase only your group knows. When a message or call asks for money or a change of payment details, anyone can reply: what are the words? AI can clone a voice and mimic a texting style, but it cannot know a secret your group never posted anywhere. A missing or wrong answer ends the scam in seconds.
Is a rotating codeword better than one fixed group password?
Yes. A static password shared across a whole club is especially fragile — one leaked screenshot compromises it forever. Rotating codewords change automatically every 60 seconds, so a leaked word expires before it can be reused. Trust Onion generates three rotating codewords locally on each member's phone, with no server involved, so there is nothing to intercept.
Who in the group most needs to be in the codeword system?
Everyone benefits, but prioritize anyone who handles money or makes requests others act on: the treasurer, trip organizer, coach, club officers, and admins of the group chat. Those are the identities scammers impersonate, and the people most likely to receive urgent payment requests.
What should our group do if a scam message gets through?
Do not pay. Verify directly with the real person on a number you already have saved, and warn the whole group immediately so nobody else pays. If money moved, contact the bank right away, then report the scam to the FTC at reportfraud.ftc.gov and the FBI's Internet Crime Complaint Center at ic3.gov.
Set up your friends or club today
One message in the group chat, a 60-second app setup, and one agreed rule — that's the whole plan. Download the app, create a group, drop the code in your chat — and if you want the same protection at home, follow the family protection guide next. For the story behind the strategy, read why scammers hate secret codewords.