Family Codewords: The Simple System That Defeats AI Scams

AI attacks what can be observed and copied: your voice, your face, your writing style. A codeword is different in kind — it's shared private knowledge that never appears in any public data an AI could train on.

That's why one question — "What are the words?" — resolves any suspicious contact in seconds, across every channel. The genuine person answers without thinking. The impersonator has exactly three moves: stall, deflect, or hang up. All three are confessions.

• Use words, plural. Three words are dramatically harder to guess or socially engineer than one, and still easy to recall.
• Avoid the guessable: pet names, street names, birthdays, favorite teams — anything visible on social media is not a secret.
• Make them sayable by a scared 8-year-old and a stressed 80-year-old. Vivid, concrete, slightly absurd words stick: pickle — trombone — Saturn beats any password-style string.
• Rotate on a schedule. Words shared over months of calls and texts slowly leak. Rotation keeps a compromised word from becoming a skeleton key. (Trust Onion automates the rotation so nobody has to remember to do it.)
• Never confirm or deny a guess. If a caller offers wrong words, don't correct them — end the call and check in through a channel you initiate.

The system only works if the most scam-targeted family members actually use it. What works:

1. Frame it as protecting you, not doubting them. "If someone fakes my voice, this is how you'll know it's really me."
2. Practice one round. Have a family member call and ask the question. Thirty seconds of rehearsal makes the real moment automatic instead of awkward.
3. Set the money rule together: no transfers, gift cards, or account codes move on any emergency request until the words check out — no matter how real it sounds.
4. Include the periphery. Grandparents, teens with public social accounts, and the relative who answers every unknown number are the primary targets — start with them.

When a call, text, or video chat makes an urgent request:

1. Pause. Urgency is the scam's fuel. One breath.
2. Ask: "What are the words?" Say nothing else — don't volunteer names, places, or hints.
3. Instant correct answer → proceed. Anything else — stalling, anger, "there's no time" — treat as a failed check.
4. On a failed check, hang up and reach the person directly on contact info you already had.
5. Tell the family. A failed verification means someone is actively targeting your circle; the next call may go to a less-prepared relative.