That Voice Isn't Your Grandchild: One Family Password Beats the AI Clone Scam

The phone rings late. It's your grandson's voice — really his voice, the exact pitch and rhythm you've known since he was a boy — and he's in trouble. A car accident. An arrest. He's crying, he's scared, and a second voice comes on the line: a "lawyer" or "officer" who needs bail money wired tonight, and please, don't tell his parents.

Except it isn't him. It's software.

This is the AI voice-clone scam, and it has moved from novelty to national problem. The FBI's Internet Crime Complaint Center added a section on artificial intelligence to its annual report for the first time in the report's history, and the numbers explain why: Americans filed more than 22,000 complaints referencing AI in 2025, with losses near $893 million. Americans 60 and older filed more than 3,100 of those complaints — and absorbed over $352 million of the losses, a wildly outsized share. All told, according to the FBI, Americans over 60 reported $7.7 billion in fraud losses in 2025, up 59 percent in a single year.

Let's be clear about who falls for this: everyone. Bank executives, attorneys, and technology professionals have been taken by cloned voices. These are professional criminal operations running a script engineered to short-circuit careful thinking. The scam doesn't work because the target is careless. It works because the voice is real — real enough that your ear, which has never once been wrong about your own family, tells you it's him.

How they get the voice

They don't need to tap your phone. Security researchers at McAfee found that as little as three seconds of audio — a social media video, a voicemail greeting, a clip from a school event posted online — is enough to produce a clone with an 85 percent voice match, and a handful of clips pushes it above 95 percent. If a grandchild has ever posted a video publicly, the raw material is already out there.

The rest is old-fashioned pressure. The FBI's own public warning on criminals' use of generative AI describes the pattern: an urgent crisis, a demand for immediate payment, and instructions to keep it secret.

The tells

The technology is new. The script is not. Watch for these:

• Manufactured urgency. "It has to be tonight." "The judge leaves at five." Real emergencies allow time for one phone call. Scams never do.
• Sworn secrecy. "Don't tell Mom and Dad — they'll kill me." Secrecy is not for your grandchild's protection. It's to keep you from making the one call that unravels the whole thing.
• Untraceable payment. Wire transfers, gift cards, cryptocurrency, a courier sent to your door for cash. No court, hospital, or law office on earth collects bail in Apple gift cards.
• A handoff. The "grandchild" talks briefly, then a lawyer, officer, or doctor takes over. The clone is fragile in open conversation, so the script limits its airtime.
• A wrong or blocked number. Caller ID showing a familiar number proves nothing — spoofing is trivial — but an unfamiliar one is still a flag.

The ten-minute drill: set your family password this weekend

Here is the counter-move, and it costs nothing. The FBI itself recommends it: agree on a secret word or phrase that only your family knows, and require it before any money moves in an "emergency."

Do it in person or by video call — a Sunday dinner, a weekend phone round. Here's the script:

1. Pick the word together. Something no stranger could guess and no scammer could find online: the name of a long-gone family dog, the dish Grandma burned in 1987, the lake cabin's nickname. Not birthdays, not pet names on Facebook, not anything in a public post.
2. Set the rule out loud: "If anyone in this family ever calls needing money urgently, the other person asks for the password. No password, no money — no exceptions, no matter how real it sounds."
3. Cover the pushback. Tell the grandkids: if you're ever truly in trouble and forget the word, we will still help you — after we verify. A real family member will never be offended by the question. Only a scammer argues with it.
4. Rehearse it once. Thirty seconds. "It's me, I need help." "What's the password?" Done. Repeat at Thanksgiving.

The callback rule makes the clone worthless

The password is the lock; the callback is the deadbolt. If a distressed call comes in — password or no — say this: "I love you. I'm hanging up and calling you right back at your number." Then dial the number you already have saved for that person. Not the number that called you. Not a number the "lawyer" provides.

A cloned voice cannot answer your grandchild's actual phone. Ninety seconds of dial tone defeats a million dollars of software. If you can't reach them, call a parent or sibling — the very people the scammer told you not to call.

If it happens to you

Being targeted is not a failure, and being fooled is nothing to be ashamed of — these operations fool trained professionals every week. What matters is speed:

• Call your bank immediately. Wires can sometimes be recalled or frozen if you act within hours.
• Report it to the FBI at IC3.gov — these reports are how federal investigators map and dismantle these rings.
• Report it to the Federal Trade Commission at ReportFraud.ftc.gov.
• Tell your family. Every report and every dinner-table story strips these criminals of their best weapon: silence.

You've spent a lifetime looking out for your family. Ten minutes and one word this weekend, and you'll have done it again.