AI voice scams are no longer as niche as they once were. The technology is both cheap and convincing: a worrying combination that has lowered the barrier to entry for would-be scammers. According to a Hiya report from March, one-in-four Americans say they’ve received a deepfake voice call in the past 12 months. A further quarter (24%) say they can’t tell the difference.
The same study reveals that twice as many Americans think scammers are winning the battle with mobile carriers over voice clones. But it’s not a foregone conclusion. The technology might be impressive, but a simple technique could stop the scammers in their tracks: a pre-agreed safe word.
How are deepfakes used by scammers?
We all think we could recognize a loved one’s voice. But cloning technology is advancing at a dizzying rate. All scammers need is a few seconds of audio to create a convincing deepfake. That audio can be scraped from social media posts if access hasn’t been restricted via privacy settings, or from work-related content that ends up being posted online.
One of the most prominent scams involves cold calling a relative and playing deepfake audio designed to make them think their loved one has been kidnapped. These virtual kidnapping scams may be made to appear more realistic by citing personal details also harvested from the same social accounts. Scammers may also monitor the victim’s social media profile, or those of their relatives, in order to choose the best time to strike. It can be more useful for them if the victim is abroad at the time and therefore not checking their phone for incoming calls.
The key for the fraudsters is to keep the victim’s relatives guessing, and traumatized. To this end they’ll use the cloned voice only for a few seconds at a time, mix it with sobbing noises, and potentially introduce background noise to make the whole thing sound more plausible and chaotic.
What is a safe word?
In this context, one of the simplest but most effective things you can do to see through a scam is to agree on a safe word with your family members. It should be an easy-to-remember word or phrase that a family member can request if they think your voice may have been deepfaked. A scammer would have no way of finding out what the safe word is, thus unmasking any plot designed to trick your family into paying a ransom.
It should be memorable but also unusual, and it shouldn’t be anything that could be gleaned from reading your social media posts or other open source intelligence (OSINT) sources. That rules out the likes of family pets and favorite sports teams for starters.
How to introduce it without frightening people
There’s a right way and a wrong way to go about agreeing on this kind of approach. You don’t want to alarm your family, but equally you need them to recognize that technology has advanced and there are bad actors ready to capitalize on it.
It might help to explain that it’s unlikely you’ll ever be called upon to use the word, but suggest some scenarios in which requesting a safe word would be a good idea — for example, an unsettling and unsolicited call in which someone sounding like you tries to elicit money or information from them.
What if someone forgets the safe word?
It’s important to have a backup if someone can’t remember the safe word. Encourage family members to end the call and ring back on the number they have for you in their address book, or message you through an existing group chat. That will instantly tell them whether you are in trouble or not.
Alternatively, they could ask another question that only someone in the family would know — one that cannot be researched online. They should also know never to send money or personal information if something feels wrong.
What to do if you’ve fallen for a deepfake scam
Don’t be embarrassed. Deepfake technology is becoming more convincing by the day. If you or a family member has been scammed:
- Stop communicating with the scammer immediately
- Contact your bank to explain what’s happened and ask whether there is any recourse to blocking or recovering the defrauded funds
- Change any passwords that may have been disclosed across all relevant accounts — this is also a good time to enable two-factor authentication (2FA) and switch to strong, unique passwords stored in a password manager
- Preserve any relevant evidence (e.g., phone numbers, recordings)
- Report the scam to the appropriate authorities (e.g., FTC, FBI IC3)
Remember: scammers are shameless. Be on the lookout for secondary fraudsters who will promise to recover your money for a fee or to secure your accounts. They’re lying — paying them will only increase your losses.
FAQs
How can scammers get hold of my voice?
They only need a few seconds of audio to produce a convincing voice clone. It could be something posted of you speaking in a work capacity, or video and audio content you shared on social media. Limiting your followers to people you know is always a good precaution.
Does a safe word really stop deepfakes?
Nothing is foolproof, but a safe word is a simple, free option for uncovering deepfake audio fraud such as virtual kidnapping scams. It doesn’t stop the deepfake being created, but it can significantly reduce the success rate of the scam that follows.
What if scammers guess our safe word?
Anything is possible, but if you choose a random, unusual word or phrase with no real significance outside the family, it should be extremely difficult to guess. That said, it’s useful to have backup plans — such as agreeing to call the person back on a known number — in case the safe word is ever compromised.
What should I do if I’ve been scammed?
Stop all communication with the scammer immediately, contact your bank to notify them, and preserve as much evidence as you can. Change any relevant passwords and report the scam to the appropriate authorities.
