How to Set Up a Family Code Word to Stop AI Voice Scams (Step-by-Step)

Pick a private phrase today, a few odd words only your family knows, and agree on one rule: if anyone calls sounding like a family member in trouble, urgently asking for money or help, the first thing you do is ask for that phrase. A scammer can clone a voice. He cannot know a word you only ever said out loud at the dinner table. Here is the full six-step version, what the research actually says about why it works, and what to watch for so you never need it.

The six-step protocol

1. Pick a private phrase. A few random words, not a name, date, or pet that shows up anywhere online.
2. Share it in person. At a holiday dinner, on a visit, anywhere but over the phone or in a text message, since both can be read by whoever already has access to an account.
3. Set the rule: anyone calling in a panic asking for money gets asked for the phrase before anything else happens.
4. If the caller cannot produce it, hesitates, or tries to talk you out of asking, hang up. Do not argue. Do not stay on the line to "explain."
5. Call the person back yourself, on the number you already had saved for them before the call came in, never a number the caller just gave you.
6. Tell a second relative what happened, even if the call turned out to be nothing, so the rest of the family stays sharp on the pattern too.

What is actually happening

Scammers can now clone a voice from a few seconds of audio pulled off a Facebook video, an old voicemail greeting, or a clip of the grandkids. The FBI put out a warning about this pattern, and the old advice, listen for a robotic or flat-sounding voice, no longer holds up. The fakes are good enough now that you cannot tell by ear.

Digital forensics researcher Hany Farid at UC Berkeley, who studies audio deepfakes for a living, told Scientific American that a private passcode is "simple and, assuming the callers have the clarity of mind to remember to ask, nontrivial to subvert." He said he and his own wife keep a code word between them and quiz each other on it now and then so neither of them forgets it under pressure. BBC Future has covered the same advice under the headline "the secret codewords that scammers hate," citing the same logic: AI can copy a voice, but it cannot know a word your family only shared face to face.

From the enterprise IT and cybersecurity side, the part worth knowing is that the voice clone is usually the last step a scammer takes, not the first. The name, the relationship, and the phone number are typically already sitting in plain sight on people-search sites and old social posts before anyone ever opens their mouth. The cloned voice is just the finishing touch that makes the rest of it believable.

This is not a hypothetical. KPAX reported on a Billings, Montana woman who got a call from someone claiming to be her daughter's ex, saying her daughter had been in a wreck, then handed the phone to a man who threatened her and walked her through buying a payment card on the spot. That is the exact pattern above: urgency, isolation, a strange way to pay. The one step she did not get a chance to take was asking a verifying question, which is the whole reason the protocol above exists.

Here is a step most writeups on this topic skip entirely, and it is worth the hour it takes: since scammers usually build their profile on you from people-search sites before they ever call, pulling your name, address, relatives, and phone number off those same sites cuts off part of the problem before it starts. If you live in California, the state runs a free Delete Request and Opt-Out Platform that submits one removal request to every registered data broker in the state for you. Everywhere else, sites like Spokeo, BeenVerified, and Whitepages are required to offer a free opt-out form, you just have to find each one and fill it out yourself, or pay a removal service to do it on an ongoing basis, since your information resurfaces again after a while even after you clear it once. It will not stop every scam call, but it shrinks the pile of information a stranger can use to sound convincing before the voice clone ever enters the picture.

The red flags every one of these calls shares

Stop trying to tell a fake voice from a real one. You cannot do it reliably anymore, and you do not need to. Watch the pattern instead, because every one of these calls shares the same handful of signs.

• The call pushes urgency, demanding you act in the next few minutes, before you have time to think it through or check with anyone else.
• The caller tries to cut you off from the rest of the family, telling you not to call Dad, not to call the police, not to tell anyone what is happening.
• The payment request is strange: a gift card, a wire transfer, crypto, or a payment app you have never used. No real hospital, lawyer, or police department takes payment in Apple gift cards.
• The caller stalls, argues, or gets angry when you ask a simple verifying question instead of just answering it.

What not to pick for your code word

Do not use a pet's name, a birthday, a street name, or anything that has ever shown up in a photo caption, a public post, or a comment anyone in the family has made online. People-search sites and old social accounts already hand scammers most of this. A short, nonsense phrase works better than any real word for exactly that reason, because it does not exist anywhere a stranger could find it. Something like "blue kayak Tuesday" is the kind of phrase that works as an example. Do not use that one. Pick your own, and never write it anywhere public, including in a text thread, a shared note, or a social caption.

Practice it, or you will forget it

A code word only works if you can actually produce it under stress, and most people forget passwords they rarely use. Farid's own habit, quizzing his wife on their phrase every so often, is the right model. Pick a recurring moment, a monthly call with the kids, a holiday visit, the first of every quarter, and ask each other the phrase as a quick check. It takes ten seconds and it is the difference between a code word that actually protects you and one you blank on the one time you need it.

Match the layer to the person, not the whole family

Most writeups on this topic hand every reader the same list, as if a 30-year-old with a locked-down phone and a solo 80-year-old parent face the same odds. They do not. Here is how I'd actually assign the layers below based on who in the family is the realistic target.

Two more layers worth adding

A code word covers the moment of the call. These three cover the moments around it, and they are worth the small cost if a scam call ever reaches your parents or your own household.

Quick disclosure: some of the links below are affiliate links. If you buy or book through one, I may earn a small commission at no extra cost to you.

A dedicated call-blocking device on a landline or a cell line screens out a large share of robocalls and spoofed numbers before they ring through, which means fewer chances for anyone in the house to get caught off guard in the first place.

For an elderly parent who gets targeted often, a simple phone set up with a short trusted-contacts list does the same job a different way. Fewer strangers can reach them at all, and the people who can are the ones who already know the family phrase.

A cheap pocket notebook kept by the phone, with the handful of family numbers written down in pen, is worth more than it sounds like. If a phone ever gets lost, reset, or the contacts list itself gets compromised, you still have the real numbers to call back on, written down somewhere a scammer never touches.

If you forget the word, or it is already too late

If you are rattled in the moment and blank on the phrase, that is fine. Just hang up and call the person back yourself on the number you already had for them. If they are really in trouble, they will pick up. If the call was fake, you just ended it.

If a call like this already got past you, or money already moved, report it at the FTC's reportfraud.ftc.gov or the FBI's Internet Crime Complaint Center. Reporting does not undo what happened, but it feeds the pattern data that helps banks and carriers flag the next one faster, for your family and everyone else's.

The bottom line

This is not meant to scare you. It is a ten-second habit that protects the people you love, and it is worth bringing up at dinner this week. Pick the phrase, share it in person, agree on the rule, and tell a second relative it exists. That is the whole defense, and it beats the most convincing fake voice anyone can build.

More from trusted sources: the National Council on Aging's guide to AI scams for older adults, and my own writeup on whether AI is actually safe to trust, from the cybersecurity side.

I write a short, plain-English rundown like this one on tech and scams that actually matter, free, on Substack, if you want the next one in your inbox instead of stumbled onto later.