The code word: a five-minute defense against voice clones

The call comes late in the evening. It sounds like your daughter, or your manager, and they are frightened. There has been an accident, or a deal is about to fall through, and they need money moved right now.

That voice may not belong to the person you think. In a December 2024 public service announcement, the FBI warned that criminals use generative AI to create short audio clips that mimic a loved one's voice, then pose as that relative in a crisis to ask for immediate financial help or a ransom. The FTC described the same pattern back in March 2023: a scammer needs only a short clip of someone's voice, often taken from content posted online, plus a voice-cloning program.

The good news is that one of the most effective defenses costs nothing and takes about five minutes to set up. The FBI's advice in that same announcement is simple: create a secret word or phrase with your family to verify their identity.

Why a code word works

A cloned voice copies how someone sounds. It does not copy what only your family knows. A word you agreed on in person, and never posted anywhere, is something an AI model trained on public videos cannot guess.

It also changes the emotional math of the call. Scammers rely on panic and speed. A code word gives you a polite, pre-agreed reason to slow down, and it gives the real person a way to prove themselves in seconds. Nobody has to feel insulted, because everyone agreed to the check in advance.

The FBI has kept repeating the advice as scams have evolved. Its May 2025 warning about AI-generated voice messages impersonating senior U.S. officials again recommended a family secret word, and noted that AI-generated audio can be hard to tell apart from a real voice. Its December 2025 alert on virtual kidnapping scams, where criminals send doctored "proof-of-life" photos, recommended a private family code word too.

How big is the problem? Honest answer: the numbers are incomplete. The FBI's 2025 Internet Crime Report counts more than $5 million in reported losses to grandparent or "distress" scams involving voice cloning in 2025. Overall, it logged 22,364 complaints that mentioned AI, with about $893 million in reported losses. The same report notes that many victims do not realize how much AI was involved in the scam they fell for, so treat these figures as a floor rather than the full picture.

Set it up tonight

You can do this over dinner. Here is a checklist you can copy.

1. Gather the people who would call each other in an emergency. For a family, that usually means parents, kids old enough to have a phone, grandparents and anyone who handles money for an older relative. For a team, include anyone who can approve payments, reset passwords or change bank details.

2. Pick a word or short phrase together. It should be easy to remember under stress and hard to guess from social media. Avoid pet names, street names, birthdays, school mascots and anything you have ever posted.

3. Make it a little odd. Two unrelated words work well, such as a food and a place that have nothing to do with your family. Odd is memorable, and memorable matters when someone is scared.

4. Agree on how to ask for it. Decide on a natural phrase, such as "What's our word?" Practice once so it feels normal, not accusatory.

5. Agree that the real person will never be offended. Say it out loud: anyone can ask for the word at any time, and the right answer is always to give it calmly.

6. Decide on the fallback. If someone forgets the word or cannot say it, you hang up and call them back on a number you already know. This matches the FTC's advice not to trust the voice and to call the person on a number you know is theirs.

Store it, use it, rotate it

Storing it. The safest place is your memory. If someone needs a written reminder, keep it offline, such as a card in a wallet, or in a password manager. Never put it in a group chat, a shared document, a social post or an email. If it is written somewhere a hacked account could reach, it is no longer secret.

Using it. Ask for the word whenever a call or message involves urgency plus money, gift cards, crypto, passwords, codes or secrecy. You do not need it for everyday chats. The FBI's guidance also suggests listening closely to tone and word choice, but a voice that sounds right is no longer proof on its own. The word is the check.

Never say it first. If a caller asks you to "confirm the family word," do not repeat it. The person in trouble is the one who gives the word, not the one who asks for it.

Rotating it. Change the word whenever it might have been exposed: after you used it on a call that turned out to be a scam, if someone wrote it down somewhere public, when a person leaves your team, or when your household changes. Many families also pick a fixed moment to refresh it, such as a birthday or the start of the school year. There is no official rotation schedule, so choose one you will actually keep.

When someone fails the check

This is the moment the code word exists for, so plan it in advance.

• Stay calm and polite. You do not need to accuse anyone. Say you will call right back, then hang up.

• Call the real person on a number you already have. Do not use a number the caller gave you, and do not call back the incoming number. If you cannot reach them, try another family member, a partner, a roommate or a colleague who sits nearby.

• Do not send anything while you check. No money, no gift card numbers, no passwords and no one-time codes. The FTC lists requests to wire money, send cryptocurrency or buy gift cards and read out the numbers as clear warning signs.

• Save what you can. Note the number, the time, what was said and any photos or messages. The FBI's virtual kidnapping alert specifically asks people to keep screenshots or recordings.

• Report it. In the U.S., report to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov. At work, tell your IT or security contact right away. Then change the code word.

And if someone in your family or team realizes afterward that they did send money or share a code, treat it as a shared learning moment. These scams are designed to work on caring, quick-thinking people. Call the bank or payment provider immediately, report it, and talk through what would make the next check easier.

Make it a habit

A code word only works if people remember it exists. Mention it again in a month. Ask a teenager or a grandparent to explain it back to you. At work, add a line about it to payment and password-reset procedures so a new hire learns it on day one.

Five minutes tonight means that if that frightening call ever comes, everyone already knows what to say.

Sources

• FBI Internet Crime Complaint Center, "Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud," Dec. 3, 2024: PSA I-120324-PSA

• FBI Internet Crime Complaint Center, "Senior US Officials Impersonated in Malicious Messaging Campaign," May 15, 2025: PSA I-051525-PSA

• FBI Internet Crime Complaint Center, "Criminals Using Altered Proof-of-Life Media to Extort Victims in Virtual Kidnapping for Ransom Scams," Dec. 5, 2025: PSA I-120525-PSA

• FBI Internet Crime Complaint Center, "2025 IC3 Annual Report," April 2026: 2025 Internet Crime Report (PDF)

• Federal Trade Commission, "Scammers use AI to enhance their family emergency schemes," March 20, 2023: FTC consumer alert

Or let NimBot handle it

Agree on your word before you need it, and the scary call becomes a 30-second check. You can do all of this yourself, and it works. If you'd rather not run it alone, NimBot handles the training, the drills and the reminders for your whole team. Try it at app.nim.bot.