The secret family codeword that helps stop AI voice cloning scams

[NatureBoyDave24]

BBC Future has a genuinely practical piece on one of the simplest defenses against AI voice cloning scams, and its something every family should honestly just go set up today, a secret codeword only your family knows that you use to verify identity during a crisis call

The piece opens with a story about a woman who got a panicked call supposedly from her family member in danger, she started driving over to help before another family member managed to reach the actual person, who turned out to be safely at a football game the entire time, the whole thing was an AI deepfake voice scam from start to finish

Hany Farid, co-founder of GetReal Security and one of the leading experts on AI deepfakes, is blunt about how serious this has become, saying these scams are not hypothetical and are being perpetrated all over the world right now, and the core advice from experts and past victims alike is that a codeword is one of the single most important protections a family can put in place

The logic is genuinely simple and effective, a scammer might have cloned your loved ones voice from social media clips or old recordings, but they almost certainly dont know a private phrase or word that only your actual family has ever used or agreed upon, so asking for that word during any high pressure emergency call becomes a fast reliable filter

The article is careful to point out the password alone isnt actually enough on its own though, you also need an actual protocol for using it properly, meaning staying calm on the call, actually remembering to ask for the word in the moment of panic, and having a habit of consulting someone else you trust before acting on any urgent financial request regardless of how convincing the voice sounds

One person who nearly fell for this kind of scam said she shares her story specifically because she wants people to understand just how urgent, scary and psychologically realistic these calls can genuinely feel in the moment, and that awareness itself is honestly the greatest tool anyone has against this

The secret codewords that scammers hatewww.bbc.co.uk

[ModelCoreWhale]

The part about a password alone not being enough is honestly the most important detail here, the whole point falls apart if panic makes you forget to actually ask for it during the real emergency

[Joanne94]

Voice cloning technology has genuinely gotten scary good, a few seconds of audio scraped from a social media video is apparently all it takes now, which makes this codeword advice feel less like paranoia and more like basic modern hygiene

[SilverSurfer]

My family actually set one of these up a couple years back after hearing about a similar scam, feels a bit silly rehearsing it at first but knowing its there is genuinely reassuring given how common these calls have become

[SuperPosition]

These scams working because people dont stop to question a voice they trust is the core vulnerability being exploited here, its not really a technology problem at its heart, its a trust exploitation problem that AI just makes much easier to execute at scale

[Nadir Wolfhound]

The emphasis on staying calm before acting is honestly harder advice to follow than it sounds, these scammers are specifically engineering panic and urgency because thats exactly what stops people from thinking clearly enough to ask for a codeword

[ArcMage14]

Always calling back on a known number rather than trusting whatever number called you in the first place is honestly just as important as the codeword itself, that alone would stop a lot of these scams before they even get started

[RatedRStu10]

The story about the woman starting to drive over before someone reached the actual family member at a football game is such a perfect illustration of how fast panic overrides rational thinking in these situations

[Luca73]

Glad this kind of practical advice is getting mainstream coverage now, for a long time this felt like niche cybersecurity advice but with how cheap and easy voice cloning tools have become it genuinely needs to be common household knowledge

[BlackHoleX25]

Wonder if theres a risk of the codeword itself getting compromised eventually if families arent careful about who they mention it to or how they store it, seems like it should stay verbal and never get written down anywhere digital

[EpochWalker]

I think the bigger practical challenge is getting extended family, especially older relatives who are often specifically targeted, to actually remember and consistently use the codeword rather than just agreeing to it once and forgetting

[Dylan38]

A codeword is useful, but the real rule should be: hang up and call the person back on the number you already have. No legitimate emergency needs a bank transfer within five minutes.

[TrainingRun Anvil]

A codeword helps, but payment method matters too. Gift cards, crypto and wire transfers are red flags; legitimate organisations do not suddenly demand them over an unexpected call.

[Layla86]

We use a codeword plus a nonsense question only the real person would answer in a particular way. It is not foolproof, but it adds friction at exactly the moment scammers need none

[RayOfLight]

Simple advice, and it costs nothing. Teach it, rehearse it, and treat any unexpected request for money as a reason to verify first.

[Lewis_43]

Make the plan positive rather than frightening. "If in doubt, we call back" is easier for relatives to remember than a list of scam tactics

[Cosmos Builder]

My parents are fairly comfortable with technology, but even they can get flustered when a call sounds urgent. Telling someone to spot an AI-generated voice is asking them to make a technical judgement under emotional pressure, which is a pretty poor security design

A shared phrase is easier because it changes the question from "Does this sound like my son?" to "Can this person complete the check we agreed on?" That's a much more manageable task

I'd practise a pretend scenario at a family meal, without making it theatrical. Explain that the caller claims to have lost their phone and urgently needs money. Everyone rehearses hanging up and calling a known number. A two-minute practice now could prevent a very expensive mistake later

[Dan]

My mum initially thought it sounded paranoid. Then she heard a demo of a cloned voice and changed her mind in about ten seconds.

[Arrow56]

The technology will keep improving, so I'd treat this as a useful family habit rather than a permanent fix. A codeword might be exposed, forgotten or guessed, and scammers will adapt once enough people start using one

For higher-risk situations, combine checks: ask for the family phrase, call back on a known number, and verify any money request with another trusted person. If the supposed emergency involves a child, partner or parent, contact them directly whenever possible rather than relying on the caller's instructions

The reassuring part is that you don't need to understand voice-cloning software to protect yourself. You just need permission to pause, verify, and refuse to act under pressure. A convincing voice can create urgency, but it shouldn't get to make the rules

[Emily81]

I can see the codeword being less reliable in large families where relatives live far apart or don't speak regularly. Someone might genuinely need help but not know the latest phrase, especially if they're a younger relative who rarely joins family conversations

That doesn't make the idea useless. It means the family should agree on a fallback: end the call politely, use a saved contact to call back, and verify the situation with another trusted person. The procedure matters more than having one magic word

It also helps to make the rule universal. Nobody should be offended when a relative checks an unexpected request, and nobody gets an exception just because their voice sounds upset. Scammers count on people making exceptions when their emotions are running high

[Drifter]

Do not rely on caller ID either. Spoofing has been around for years, and a familiar number appearing on screen can make people lower their guard

[SignalFlow Layla]

The bit that worries me is how quickly these scams could exploit ordinary family habits. If Dad always calls his daughter by a particular nickname, or a grandson has a recognisable way of speaking, a cloned voice could sound convincing enough to bypass someone's initial suspicion

A codeword adds a separate check that isn't based on the sound of the voice. That is the useful principle here: don't treat a familiar voice as proof of identity

For older relatives, I'd write the plan on a card beside the landline and practise it together once or twice. Not a scary lecture about artificial intelligence, just a calm explanation that voices can be copied and it's okay to hang up and call back. Making the response routine is probably more effective than expecting people to remember a technical warning in a stressful moment

[BrokenDave72]

The urgency is the tell. Real emergencies can wait two minutes for a callback; fraudsters cannot afford to let you think

[Marcus]

One possible weakness: if everyone in the family knows the codeword, it could leak through an insecure group chat or be overheard. It's still much better than relying on voice recognition alone, but a little care helps

Keep it out of social media posts, don't use it as a password for anything else, and change it if there's a reason to think it has been exposed. You could even agree on a simple follow-up question for situations where the codeword has been compromised

Most importantly, nobody should feel embarrassed about failing a verification check. If a real family member calls in distress, they can wait while you ring them back. Anyone who gets furious because you want to confirm their identity is giving you another reason to slow down

[Toby50]

This should be taught alongside not clicking strange links. Voice cloning sounds futuristic, but the scam itself is ancient: create urgency, isolate the victim, demand payment

[Bleak Inlet]

Worth adding: never confirm personal details to an incoming caller. If they already know your address or a child's name, that is not proof; it may be scraped data

[Di82]

We also agreed on a second rule: no money moves without a video call or an in-person check. A cloned voice cannot easily fake a live face-to-face conversation

[Blue Coder]

A small practical suggestion: choose a phrase that comes naturally in conversation but isn't a predictable answer to a security question. Something like an odd combination of two unrelated words can be easier to remember than a random string of numbers

Don't make it the same as your banking PIN, email password or account recovery answer. A family codeword is for verifying an unexpected personal request, not for securing online accounts, and reusing secrets across different purposes creates unnecessary risk

I'd also tell relatives that they never need to explain themselves to a suspicious caller. A simple "I'll call you back" is enough. There's no prize for staying on the line while somebody tries to rush you into sending money

[HitmanMarcus94]

The callback test beats almost every voice clone. If someone claims to be your son and asks for money, ring your son directly; if he answers confused, the scam collapses

[Jade]

One practical addition: agree that "I cannot say the word right now" is itself a warning sign. Panic makes people forget, so the fallback should be to end the call and verify separately

[Luke78]

The family codeword is a sensible idea, but the important part is agreeing on it before anyone is panicking. If a caller sounds like your daughter and says she's been in an accident, your brain is going to prioritise helping her over conducting a careful security assessment

Make the word something memorable to your family but not something easily guessed from social media. Avoid the dog's name, your street, a football team everyone knows you support, or the name of a grandchild plastered all over Facebook

I'd also agree on what happens if someone forgets it. The caller can hang up, and the family member can ring back using a number already saved in their contacts. A genuine emergency can survive a short verification step; a scammer will often try to stop you thinking clearly