Criminals need as little as a short audio clip to clone a family member’s voice and place a convincing phone call demanding emergency cash. The Federal Trade Commission and the FBI are now telling families to agree on a secret code word in advance, a low-tech defense against a problem that cost Americans nearly $3 billion in 2024. The advice comes as federal agencies track a growing wave of AI-powered impersonation schemes targeting ordinary households and, in at least one recent campaign, senior U.S. government officials.
How AI voice cloning turned a phone call into a weapon
The scheme works like this: a scammer pulls a few seconds of someone’s voice from a social media video, a voicemail greeting, or any publicly available recording. Using commercially accessible AI tools, they generate a near-perfect vocal replica and call a relative, usually a grandparent, claiming the loved one is in jail, hurt, or stranded. The caller presses for immediate payment by wire transfer, gift card, or cryptocurrency before the target has time to think.
The FTC has warned that these AI-enhanced family emergencies are an evolution of long-running “grandparent” scams. In its guidance on AI-powered impersonation, the agency notes that hearing what sounds like a loved one’s voice can override skepticism, especially when the caller insists the situation is urgent and must be kept secret. Traditional verification, such as calling back on a known number, still works but only if the target pauses long enough to do it. Scammers deliberately create panic to prevent that pause.
The FBI’s Internet Crime Complaint Center spelled out a specific countermeasure in its December 2024 alert on generative AI fraud: “Create a secret word or phrase with your family to verify their identity.” If the caller cannot supply the agreed-upon word, the recipient should hang up immediately and contact the person using a trusted number. The code word acts as a second factor that AI cannot replicate because it exists only inside the family’s private agreement, not in any harvestable recording.
$3 billion in losses and an active campaign targeting officials
Impersonation scams, the broader category that includes voice-clone fraud, generated nearly $3 billion in reported losses in 2024, according to the FTC’s data on impersonation-related complaints. That figure covers all impersonation fraud, not voice cloning alone, because neither the FTC nor the FBI currently breaks out voice-clone incidents as a separate line item. The absence of a standalone count does not diminish the threat; it signals that tracking has not caught up with the technology.
The FBI issued a second public service announcement in May 2025 describing an active campaign, running since April 2025, in which attackers used AI-generated voice messages and text messages to impersonate senior U.S. officials. That alert on the malicious messaging campaign repeated the same family code word recommendation, extending the advice beyond household scams to a national-security context. When the same defensive measure appears in alerts months apart and across different threat categories, it reflects how few reliable technical barriers exist right now.
On the regulatory side, the FTC proposed new protections aimed at AI-enabled impersonation of individuals, including deepfakes and voice cloning, in early 2024. The agency also ran a Voice Cloning Challenge that solicited prevention concepts, such as techniques to distort harvested voice samples so they become harder to clone. Winners were announced in April 2024, but no timeline for turning those concepts into enforceable standards has been published, and no single technical fix has emerged as a clear front-runner.
What a code word can and cannot do
The code word strategy has clear strengths. It costs nothing, requires no app or device, and works regardless of the victim’s age or technical skill. A grandparent who might not recognize a spoofed caller ID can still ask for the family password. The FBI’s December 2024 alert on generative AI fraud treats the code word as a frontline defense precisely because it sidesteps the technology problem entirely and gives potential victims a simple script to follow under stress.
The limits are just as real. No federal agency has published data showing that families using code words experience fewer successful scam payments than families relying on callback verification alone. The hypothesis is intuitive, but it has not been tested in a controlled study. Families also face practical friction: the word needs to be memorable, private, and periodically refreshed. If it leaks through a compromised text message or a child shares it casually, the protection disappears.
There is also the risk of overconfidence. A code word can fail if the scammer has already compromised another family member’s account and can search old messages for the phrase. And in a genuine emergency, a panicked caller may forget the word or misstate it, leading to confusion. Experts advising on these schemes therefore emphasize that the code word should supplement, not replace, other checks such as calling back, asking additional questions only the real person would know, or verifying with a third relative.
Technical defenses remain thin. The FTC’s Office of Technology noted that modern text-to-speech systems can clone a voice from a small training set in ways that are difficult to detect by ear. Until detection tools catch up, or until new rules restrict how voice-cloning software can be distributed and used, the gap between what scammers can do and what consumers can verify will keep widening. For now, social and behavioral defenses-like code words and deliberate pauses before sending money-are carrying most of the load.
What families should do first
For anyone who has not already set up a family code word, the practical first step is to hold a short, explicit conversation about it. Pick a word or phrase that is easy to remember but not something you routinely post online, such as a childhood nickname, a made-up place, or a line from an inside joke. Make sure every participating family member understands when to use it: only when someone calls, texts, or messages about an emergency, not in everyday chatter.
Next, agree on a backup plan if the word cannot be recalled under pressure. That might mean designating a second relative everyone should try to reach, or committing to hang up and initiate a video call before sending money. Families should also rehearse the idea that it is acceptable-even wise-to slow things down, no matter how urgent the caller sounds. A simple line like, “I’m going to hang up and call you right back on your usual number,” can interrupt the emotional momentum scammers rely on.
Households can layer in a few additional safeguards. Parents may want to review children’s public social media posts and trim back videos that include long stretches of uninterrupted speech, which provide ideal training material for voice clones. Adults who frequently speak in public can consider separating professional contact numbers from personal ones and reminding close relatives never to send money based solely on a voice call.
Finally, if a suspicious call does come through, families should report it to law enforcement and to the FTC, even if no money is lost. Complaint data is one of the few tools regulators have to map how quickly AI-driven scams are evolving. Until stronger technical and legal guardrails are in place, a shared code word, a healthy pause before paying, and a willingness to verify through trusted channels remain the most practical defenses against cloned voices on the line.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
