A voice cloning scam is a phone call in which a criminal uses AI-generated audio that sounds like someone you love, usually claiming an emergency, to get you to send money before you have time to check. The family emergency scam, sometimes called the grandparent scam, is old; what has changed is that the voice on the line can now sound right. Both the US Federal Trade Commission and the FBI have warned that criminals build these clips from short samples of a person's voice, often taken from content posted online. This guide explains how the scam works, why the usual instinct ("I would know my own child's voice") no longer protects you, and the two habits that do: a family code word and a firm call-back rule. It is written for families, and for the bank, telecoms and care staff who help people recognise these calls. For video and image deepfakes more broadly, see the Spotting Deepfake Scams Guide.
Key takeaways
- The voice is no longer proof. The FTC's advice is blunt: do not trust the voice; hang up and call the person on a number you already know is theirs.
- Agree a family code word now. The FBI recommends a secret word or phrase that family members can ask for to confirm who they are talking to.
- Urgency plus unusual payment is the signature. Requests to wire money, send cryptocurrency or read out gift card numbers and PINs are warning signs on their own.
- Calling back breaks the scam. A short pause and a call on a known number, or to another relative if the person cannot be reached, defeats almost every version.
- Less public audio means less material. Private social media accounts and fewer public voice clips make a convincing clone harder to build.
What it is
A family emergency scam is impersonation of a relative or friend in trouble. Voice cloning adds synthetic speech generated to imitate a specific person. The FTC describes scammers using voice-cloning software and a short audio clip of a family member, often from content posted online, so the caller sounds like the loved one. The FBI's December 2024 public service announcement describes criminals creating short audio clips of a loved one's voice to pretend they are in crisis and need money immediately, or are being held for ransom.
| Variant | Typical story | Channel | What the criminal wants |
|---|---|---|---|
| Grandparent or family emergency | Car accident, arrest, stranded abroad, hospital | Phone call, sometimes followed by a "lawyer" or "officer" | Wire transfer, gift cards, cryptocurrency, cash |
| Fake kidnapping (virtual kidnapping) | A relative is being held and will be harmed unless a ransom is paid | Phone call with a crying or pleading voice | Immediate ransom payment, keeping you on the line |
| Hi mum or hi dad messages | "I lost my phone, this is my new number, I need to pay a bill" | Text or messaging app, sometimes a voice note | Bank transfer to a new payee |
| Account access | The criminal uses a cloned voice of you, not your relative | Call to your bank or provider | Access to your accounts, which the FBI also warns about |
Text-based versions are covered in the Vishing and Smishing Guide. This guide focuses on the voice call.
How it works
Step 1: collecting the voice
The FTC notes a short clip is enough. Public videos, voice notes shared widely, livestreams, podcasts and voicemail greetings are all potential sources. The same posts often reveal names, relationships, travel plans and the school or employer the story will mention, which makes the story feel specific.
Step 2: building the pressure
The call is designed to stop you thinking. Common elements:
- Emotion first: crying, panic, a short burst of the familiar voice, then a handover to a second person ("a police officer", "a lawyer", "the other driver") who does most of the talking. A short clip is easier to fake than a long conversation.
- Secrecy: "Don't tell Mum", "the judge has a gag order", "if you call the police they will hurt her".
- Time limits: bail must be paid in the next hour, the hospital will not treat without payment.
- Caller ID that looks right: phone numbers can be spoofed. Network caller ID authentication helps, but a familiar name on screen is not proof. See the STIR/SHAKEN Caller ID Authentication Guide.
Step 3: taking the money
The FTC lists wiring money, sending cryptocurrency and buying gift cards and reading out the numbers and PINs as the payment methods to treat as warning signs. These are chosen because they are fast and hard to reverse. Some variants send a courier to collect cash, or direct the victim to a cryptocurrency ATM; see the Crypto ATM Scams Guide and the Loyalty Points and Gift Card Fraud Guide.
Family code words and call-back rules
Two habits defeat the scam regardless of how good the voice is, because neither depends on recognising the voice.
The family code word
- Choose it together, in person: a word or short phrase that is not on social media, not a pet's or child's name, and not guessable from public posts.
- Use it as a question, not a hint: ask "what's our word?" and wait. Never say a candidate word yourself; a criminal will agree with anything.
- Share it with the people who might be called: grandparents, older relatives, regular babysitters. The FBI's advice is a secret word or phrase shared with family.
- Change it after use or exposure: if it was ever said on a call that turned out to be fake, or written in a message, pick a new one.
- Keep a refusal plan: if the caller cannot give the word, end the call and verify. A genuine relative in trouble will understand.
The call-back rule
- Hang up. Do not stay on the line while you check; criminals use the open line to keep pressure on.
- Call the person on a number you already have, not one the caller gives you and not by pressing redial on the incoming number.
- If they do not answer, call someone who would know: another family member, their partner, a friend, their workplace. This is the FTC's advice.
- For a claimed arrest or hospital stay, look up the police station or hospital yourself and call its published number.
- For a bank-related call in the UK, dial 159. Stop Scams UK says the number connects you to your own bank, covers customers of more than 99% of UK retail current accounts, and cannot be spoofed.
- Do not pay while verifying. No genuine emergency service requires gift cards, cryptocurrency or a courier collecting cash.
Write both on a card by the phone for older relatives. A ready-made format is in the Family Cyber Security Plan Template.
Why it matters
The scam targets the people least likely to question a loved one's voice and most likely to act fast to help. It also works on the professionals around them.
| Role | What to watch for | Useful action |
|---|---|---|
| Family members | Urgent money request in a familiar voice, secrecy, unusual payment | Code word, call back, tell another relative |
| Bank and branch staff | Older customer withdrawing unusual cash or setting up an urgent payment "for a grandchild", on the phone during the transaction | Ask open questions, delay and verify, follow the bank's vulnerable customer process |
| Retail staff | Customer buying large amounts of gift cards in a hurry while on the phone | Ask what the cards are for, point to warning signage |
| Care providers | Resident distressed after a call about a relative | Help them call the relative on a known number |
| Contact centres | A cloned customer voice used to reset access | Do not rely on voice alone to authenticate; see the voice biometrics and voiceprint authentication guide |
For banks and care organisations building a programme around this, see the Elder Financial Abuse and Scam Prevention for Banks and Care Providers Guide.
Regulation and reporting
- United States: the Federal Communications Commission unanimously adopted a Declaratory Ruling classifying calls made with AI-generated voices as "artificial" under the Telephone Consumer Protection Act, which brings AI voice robocalls under the Act's rules. Report scams to the FTC at ReportFraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov.
- United Kingdom: the Take Five to Stop Fraud campaign advises Stop, Challenge, Protect, and if you think you have been scammed, contact your bank straight away and report to the police at reportfraud.police.uk or on 0300 123 2040.
- If money has gone: call your bank or the payment provider immediately; speed matters for any chance of recovery. Keep the caller's number, the time of the call, payment receipts and any messages.
Reducing the raw material
- Make accounts private: the FBI advises limiting online content of your voice and image, making accounts private and limiting followers to people you know. See the Social Media Privacy Settings Guide.
- Think about voicemail greetings and public voice notes: a generic greeting gives away nothing.
- Keep travel posts until you are home: "stranded abroad" stories work best when the criminal knows you are abroad.
Common misconceptions
- "I would recognise my own family's voice." The point of cloning is that you will. The FBI suggests listening for tone and word choice, but treat that as a bonus, not a test you can rely on.
- "They would need hours of recordings." Both the FTC and FBI describe short clips being enough.
- "The number on screen was theirs." Caller ID can be spoofed. A call back on the number you hold is different from trusting the incoming display.
- "Only older people fall for it." Older relatives are frequent targets, but parents receiving a fake kidnapping call are under just as much pressure.
- "Asking for the code word is rude in an emergency." Agreeing in advance that you will always ask removes the awkwardness; a real relative expects it.
- "Hanging up could put them in danger." In a fake kidnapping, staying on the line is what the criminal wants. Verify through someone else while a second person, if available, keeps the call short.
Related concepts
- Deepfakes: synthetic video and images used in romance, investment and executive fraud. See the Deepfake and AI Impersonation Guide.
- Vishing: voice phishing generally, including bank and tax impersonation. See the Vishing and Smishing Guide.
- Impersonation scams: government, delivery and company impersonation. See the Impersonation Scams Guide.
- Executive voice fraud: the same technique aimed at finance teams, where a cloned executive voice requests a payment. See the Executive Deepfake and CEO Fraud Guide.
- Caller ID authentication: network measures that reduce spoofed numbers but do not verify who is speaking.
Practitioner checklist
- Agree a family code word in person and share it with everyone likely to receive a call.
- Adopt a call-back rule: hang up, call a known number, then a second relative.
- Write the code word prompt and call-back steps on a card by older relatives' phones.
- Treat any request for gift cards, cryptocurrency, wire transfers or cash couriers as a scam until verified.
- Make social media accounts private and review public voice content and voicemail greetings.
- Save your bank's number, and in the UK remember 159, before you need it.
- Train branch, retail and care staff to spot customers acting on an urgent call.
- Know the reporting routes: your bank first, then ReportFraud.ftc.gov and ic3.gov (US) or reportfraud.police.uk (UK).
Standards and references
- FBI Internet Crime Complaint Center: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
- Federal Trade Commission: Scammers use AI to enhance their family emergency schemes
- Federal Communications Commission: FCC Makes AI-Generated Voices in Robocalls Illegal
- Stop Scams UK: 159
- UK Finance: Take Five to Stop Fraud
Related NHI Mgmt Group resources: Spotting Deepfake Scams Guide · Vishing and Smishing Guide · Elder Financial Abuse and Scam Prevention for Banks and Care Providers Guide · Family Cyber Security Plan Template