Deepfake and voice-clone scams: household defenses

Treat identity and instructions as separate questions

A voice that sounds like your child is evidence that someone can produce that voice; it is not proof that your child placed the call. The same rule applies to a familiar face in a video window, a message from a known account, or a caller ID that displays a relative’s number. The FTC warns that family-emergency scammers can use a short online audio clip and voice-cloning software, while caller ID can be spoofed. The defensive task is therefore not to become an expert deepfake detector. It is to verify the person and the requested action through an independent route.

How an emergency impersonation develops

The details vary, but the pressure pattern is recognizable. A caller or messenger claims that a relative has been arrested, kidnapped, injured, stranded, or otherwise placed in urgent danger. A second person may pose as a lawyer, police officer, doctor, courier, or government employee. The target is told to keep the matter secret and pay immediately by wire, bank transfer, cryptocurrency, payment app, cash, or gift card. Those methods are attractive because recovery may be difficult.

The criminal may know real details gathered from public posts, breached data, people-search services, or earlier conversation. That knowledge can make a false story feel authenticated. A synthetic voice or altered image adds emotional force, but many scams succeed through acting, caller-ID spoofing, or ordinary account compromise. Design a protocol that works against all of them.

Do not rely on a fixed claim about exactly how many seconds of audio every cloning system needs. Required sample length and output quality vary by tool, speaker, noise, language, and desired realism. The accurate household conclusion is simpler: public audio may be enough to support impersonation, and a convincing voice should no longer be accepted as identity proof.

Build a verification phrase, but do not make it a master key

The FBI advises families to create a secret word or phrase. Choose it in person when possible. It should not be a pet name, birthday, school mascot, favorite team, or other fact that appears online. Children and adults should be able to remember it under stress without storing it under an obvious label in a shared cloud note.

Use the phrase as one signal, not as authority to release money or credentials. It can be overheard, disclosed accidentally, phished in a prior contact, or found on a compromised device. Never reveal it to a caller who says, “Tell me the word so I can prove this is real.” The person claiming the identity should provide it in response to a neutral prompt.

Add a second layer: end the call and contact the relative through a number or app already saved before the incident. If the relative cannot be reached, call someone physically near them—a spouse, roommate, school, workplace, caregiver, or neighbor—using independently stored contact information. For a large or unusual financial request, require confirmation by a second adult. The phrase answers “might this be our person?”; the callback and second review answer “should we take this action?”

Households with young children can use a simple rule: an adult asking someone else to pick up the child must know the pickup word, but school and caregiver policies still control. Rotate the word after use, suspected disclosure, or a household change. Do not ask a frightened child to investigate a threatening caller.

Use a calm script under pressure

Stress narrows attention. Put this script near the home phone and in the printed family plan:

1. Pause. “I do not make emergency payments during an incoming call.”
2. Ask. Request the verification phrase without offering clues. Ask a personal question only if the answer is not public, but do not rely on that alone.
3. End the contact. Do not press links, transfer the call, or call a number the caller supplies.
4. Verify independently. Call the person and nearby contacts using known information.
5. Escalate safely. If danger may be real, contact emergency services or the relevant institution directly.
6. Document and report. Save the number, messages, payment instructions, and time without continuing the exchange.

A scammer may forbid hang-up, claim that police are monitoring the line, threaten consequences for contacting family, or play crying and background noise. Secrecy plus urgency is a reason to stop, not a reason to comply. The FTC identifies both as recurring emergency-scam tactics.

Do not make detection your primary defense

Artifacts such as odd blinking, lip-sync errors, distorted details, unnatural cadence, or inconsistent lighting can raise suspicion. They are not a dependable clearance test. Real video can be compressed or delayed; synthetic media can be clean. A live caller may also route a real stolen recording or briefly show authentic media. “It looked normal” should never override the independent-verification rule.

Try a live physical request during a suspicious video call—turn the head, move to a different room, show a changing hand gesture—but treat the result only as additional evidence. A sophisticated setup or a coerced real person can pass. End the session and initiate your own contact.

Reduce useful source material without blaming victims

Review which accounts expose long, clear recordings of family members, relationship names, schools, routine locations, trips, and contact lists. Restrict audiences where practical, remove unnecessary public profile fields, and ask relatives not to post children’s voices and locations without consent. Change public voicemail greetings that reveal a full name or extended clean voice sample.

This reduces convenient material; it does not guarantee safety. Other people may already have recordings, and personal information may come from breaches or public records. A person targeted despite careful privacy did not cause the crime. Spend more effort on transaction rules and recovery than on attempting to erase every image from the internet.

Special cases: kidnapping, authority, and business requests

In a virtual-kidnapping call, do not travel to meet the caller or send money while remaining on the line. Quietly use another device, if available, to contact the supposed victim and law enforcement. The FBI has documented criminals using altered public images as fake proof of life and recommends a code word, independent contact, and preserving communications and payment information. Its virtual-kidnapping alert provides current reporting guidance.

A badge number, case number, or official-looking document is not verification. Find the agency’s public number yourself and ask to be connected. Courts, police, tax agencies, and utilities should not be trusted merely because an incoming call says they are calling. Never install remote-access software at an unsolicited caller’s direction.

For a request that appears to come from an employer or family business, independently verify any new bank instructions. Treat a changed beneficiary, new payment destination, or request to bypass the usual approval process as a stop condition. Use the known vendor or colleague number, not the signature block in the suspicious message.

If money or information was sent

For the fuller first-hour recovery sequence, see What to Do After an AI-Enabled Scam. Speed matters, but no recovery outcome is guaranteed. Contact the bank, card issuer, payment app, wire service, gift-card issuer, or cryptocurrency platform immediately. Say that the transaction resulted from fraud and ask whether it can be stopped, recalled, frozen, or reversed. The FTC’s payment-by-payment recovery page explains whom to contact. If login or identity information was disclosed, change affected credentials from a trusted device and follow an IdentityTheft.gov recovery plan.

Report the attempt at ReportFraud.ftc.gov and, for internet-enabled crime or substantial loss, at IC3.gov. Local law enforcement may also be appropriate. Keep original audio, voicemail, email headers, chat logs, wallet addresses, account numbers, receipts, and transaction identifiers. Do not edit the only copy.

Beware of a second wave: criminals may contact victims while posing as investigators, lawyers, or asset-recovery specialists. An advance fee, demand for cryptocurrency, request for a recovery code, or promise of guaranteed retrieval is another warning sign.

Rehearse without frightening people

Run a five-minute drill twice a year: one adult makes a simulated urgent request, the recipient pauses, requests the phrase, hangs up, and calls a known number. Include grandparents, caregivers, and teenagers who might receive the first contact. Explain that the protocol is not distrust of family; it is how family protects one another when voices, images, numbers, and accounts can all be imitated.

The best measure of readiness is not whether everyone can identify a deepfake. It is whether anyone in the household can slow an urgent request, verify it independently, and refuse an irreversible action until another trusted person confirms it.