Your Family Needs a Code Word. Here's How to Pick One.
Last verified: August 13, 2026
Jump to: How to choose one · Setting it up · When the call comes · If it has already happened
The short answer
Agree on one word or question that only your family knows, and use it whenever a call involves money or an emergency. Pick something unguessable and not on social media. Tell everyone. Practice it once. The whole thing takes about ten minutes, and it is currently the only defense that works against a cloned voice.
The defense that stopped working
For thirty years, the grandparent scam had one weakness. The caller did not quite sound right.
Someone would ring an older person claiming to be a grandchild in trouble, and often the voice was close enough to be frightening but wrong enough to be doubted. Families beat it constantly by noticing something was off.
That defense no longer works.
Voice cloning tools now need roughly three seconds of audio, taken from anywhere your family member's voice appears in public. A TikTok. A YouTube clip. A voicemail greeting. A wedding video someone posted. The result reproduces pitch, accent, and cadence closely enough that people who have known the voice for decades do not doubt it.
The barrier to running this is about thirty minutes and no money at all. It requires no technical skill.
So the old instruction, listen carefully and see if they sound like themselves, is now actively dangerous. They will sound like themselves. That is the point.
What this actually costs people
The FBI's Internet Crime Complaint Center reported that Americans over 60 lost $7.7 billion to cybercrime in 2025, a 59 percent increase on the previous year. AI-related fraud specifically accounted for over $352 million of losses among seniors, from 3,143 complaints filed by people over 60.
Voice-cloned distress scams, the FBI's term for the family-emergency call, produced more than $5 million in reported losses in 2025. Payments are usually gift cards, cryptocurrency, or cash handed to a courier.
In one major Justice Department case, the average victim was 84 years old.
Those numbers undercount reality, because most people never report it. Some are embarrassed. Many never work out that a crime happened at all.
Why a code word works when nothing else does
Every other defense asks the frightened person to make a judgment.
Does this sound right? Is this plausible? Would he really call me instead of his mother? Those are exactly the assessments that panic destroys, and the entire call is engineered to produce panic.
A code word asks for nothing except a word.
A person who has cloned your grandson's voice from a TikTok has the voice. They do not have a word agreed at your kitchen table three years ago. They cannot research it, guess it, or talk their way around it.
And when they cannot answer, the call ends. Not because anyone decided it was a scam, but because the rule says so.
That is the whole design. No judgment required at the moment judgment is impossible.
How to choose one
Most advice stops at "pick a code word," which is the easy part. Choosing a bad one is the common failure.
What not to use
Anything findable. A pet's name, a street you lived on, a school, a birthday, a mother's maiden name. All of that is on social media, in public records, or in the data broker files these operations already buy.
Anything guessable from your family. The dog everyone posts about. The town in your profile. The team on your Facebook cover photo.
Anything you would use as a security answer elsewhere. If it is the answer to a bank security question, it is already in a breach somewhere.
What works
A shared memory, phrased as a question. Not a fact about your family, but a moment only the people present would know.
"What did we eat at the airport in Denver?"
"What was the name of the terrible band at your cousin's wedding?"
"Where did the car break down that summer?"
These work because they are not stored anywhere, not posted anywhere, and cannot be inferred. A stranger with your entire social media history still cannot answer.
Or a nonsense word pair. If a question feels awkward, two unrelated words work fine. copper-lantern. blue-marmalade. The requirement is only that it has no connection to your family's public life.
One rule that matters more than the choice
Never write it in a text message, an email, or a group chat.
Agree it in person or on a call you initiated. If it lives in a phone that gets compromised, or an email account that gets breached, it is worth nothing.
Setting it up with a parent
This is the part where these plans usually fail, because the conversation goes badly and nothing gets agreed.
Do not open with the threat
"There's a new AI scam where they clone your voice" produces alarm and often disbelief. It sounds like something off the internet, and for a lot of people it is easier to dismiss than to absorb.
Open with the plan
"I want us to have a code word, so if either of us ever gets a call from the other asking for money, we can check it's really us. Can we pick one now?"
That frames it as mutual. You are not protecting them. You are setting up something you both use, which is a completely different conversation.
Make it reciprocal, genuinely
Tell them you will use it too. Then actually do. If they call you about money and you ask for the word, the habit is real rather than something imposed on them.
Include everyone who might call
Grandchildren especially, because they are who the scam impersonates. Cousins, siblings, anyone who might plausibly phone in an emergency.
Practice it once
Ring them the next day and ask for the word. It feels silly and it is the difference between a plan and a memory. A word agreed once and never used is a word nobody recalls at 11pm when the phone rings.
What to do when the call comes
The call will be convincing. Expect that. Plan for it.
Ask for the word before anything else. Before you ask what happened, before you get details, before you offer anything. Details are how they build the story.
Do not offer names. The single most useful thing anyone told me about this: the caller says "Grandma?" and waits. If she answers "Michael?", they now have a name and the call is theirs. The correct response is "who is this?" and nothing more.
If they cannot answer, hang up. Not "let me check." Hang up.
Then call the real person on a number you already have. Not a number the caller gave you. Your own contacts.
If you cannot reach them, call someone else in the family. In almost every case the person is fine and asleep.
If your parent freezes on the code word
It happens under stress. The backup rule covers it:
Any call asking for money ends with hanging up and calling back on a number you already have.
That works even if the word is forgotten. Have both.
The exit line
There is one more piece, and it is the one people rarely address.
A lot of older adults will not hang up on someone who sounds nice. Not because they believe the story, but because they were raised in a world where hanging up on a polite stranger was rude, and seventy years of manners does not switch off because their daughter warned them.
So give them a sentence that ends the call without requiring them to be rude or to decide anything.
The best one I have heard came from a woman in a caregivers group describing her mother:
"My daughter handles all of my finances."
Then hang up.
It is close to perfect. It requires no judgment about whether the caller is real. It gives away nothing. And it removes the reason to keep trying, because there is no money to be had from this person directly.
Others that work:
"I can't talk right now."
"I don't take calls about money. Send it in writing."
None of these require deciding anything. That is the point.
What else changes with voice cloning
Reduce the audio that is public. Not realistic to eliminate, and not worth becoming anxious about, but a public voicemail greeting in your own voice is an easy thing to change. So are public video posts by grandchildren, who are the usual source.
Expect the call to come at a bad hour. Late night and early morning are standard, because a person woken at 2am is a person who cannot think.
Know the tell that still works. These operations run through dialers, so there is often a short pause before the caller speaks. It is not reliable enough to depend on, but it is worth knowing.
Doing this properly, once
The code word is one piece of a small set of things that keep working without anyone paying attention. The others are a rule for bank calls, a lock on the phone account so a number cannot be stolen, and someone who gets an alert when money moves. Those sit with the three accounts that actually matter.
Together they take about two hours and then you can stop thinking about it.
If you want it laid out in order, with the conversation scripts and printable cards, that is what the Family Security Kit is. $79, one payment. The free version of most of it is spread across this site's articles if you would rather assemble it yourself.
If it has already happened
If money has already moved, speed matters more than anything else.
- Call the bank's fraud line using the number on the card. Ask them to freeze the account and reverse what can be reversed.
- Report it at IdentityTheft.gov. Banks and insurers frequently ask for that record.
- Report it to the FBI at IC3.gov, which is where these cases are tracked.
- Freeze credit at all three bureaus. Equifax 800-685-1111, Experian 888-397-3742, TransUnion 888-909-8872. A freeze needs all three; a fraud alert needs only one.
And expect a follow-up. Successful victims get resold, and there is a specific second scam offering to recover the money for a fee. Money recovered legitimately never requires a payment from the victim.
That resale is why monitoring earns its cost after a hit, not before. Services like Coveron watch for a person's details appearing in new breaches, on dark web markets, and in credit applications, and include help with the cleanup if something happens again.
Affiliate link. SPG earns a commission at no extra cost to you.
Who does not need this: if nothing has happened yet, skip the monitoring. The code word and the callback rule prevent more than monitoring does. Monitoring tells you after the fact.
Full details are in what to do after a scam call.
Frequently asked questions
What is a family code word?
A word or question agreed privately by your family, used to verify identity on a phone call involving money or an emergency. Because it was never shared publicly, someone impersonating a family member cannot produce it, even with a cloned voice.
How much audio does voice cloning need?
Roughly three seconds. That is short enough to take from a social media video, a voicemail greeting, or a posted clip. No technical skill is required and the tools are free.
What makes a good code word?
Something unguessable and never posted anywhere. A shared memory phrased as a question works well, such as "what did we eat at the airport in Denver." Avoid pet names, streets, schools, and anything used as a bank security answer.
Should I text the code word to my family?
No. Agree it in person or on a call you initiated. A code word sitting in a text thread or an email account is worth nothing if that account is compromised.
What if my parent forgets the code word during a call?
Have a backup rule that requires no memory: any call asking for money ends with hanging up and calling the person back on a number you already have.
Does the caller ID prove who is calling?
No. Caller ID is trivially faked, and these operations routinely spoof a real family member's number alongside the cloned voice.
How common is this actually?
The FBI reported that Americans over 60 lost $7.7 billion to cybercrime in 2025, up 59 percent year over year. AI-related fraud accounted for over $352 million among seniors, from 3,143 complaints.
Sources
| Claim | Source |
|---|---|
| $7.7 billion in senior losses in 2025, up 59% | FBI IC3 2025 Internet Crime Report (published April 2026) |
| $352 million in AI-related fraud; 3,143 complaints from people over 60 | FBI IC3 2025 report, Elder Fraud section |
| More than $5 million in voice-cloned distress scam losses | FBI IC3 2025 report, Artificial Intelligence section |
| AI used in family emergency schemes | FTC Consumer Alert, March 2023 |
| Code word as a recommended defense | FBI and FTC guidance; American Bar Association, March 2026 |
| Average victim age of 84 in one large case | U.S. Attorney's Office, District of Massachusetts |