CyberSandberg

Cyber Finance AI

A familiar voice isn't proof anymore. A family code word is.

Checked

The phone rings, and it sounds exactly like your grandson. He's in trouble and needs money right now. Or your company's finance chief asks, on a video call, to move funds quietly today. Both can now be faked. A few habits, set up ahead of time, can stop these scams before any money moves.

Talk about it at home: jump to the Kitchen Table Talk

What's changed

A deepfake is audio, video, or an image made or altered with artificial intelligence (AI) to look or sound like a real person. Voice cloning is the audio version.

FINRA (the Financial Industry Regulatory Authority, a self-regulatory organization that oversees U.S. brokerage firms under the supervision of the SEC) says AI voice cloning can be built from just seconds of recorded speech taken from social media, public interviews, or other sources. It warns about real-time phone calls that use cloned voices of family members who seem to be in an emergency. That's the new twist on the old "grandparent" or family-emergency scam: FINRA: deepfakes and vishing.

The FBI describes the same pattern. In a December 2024 public service announcement, it said criminals create short audio clips in a loved one's voice, describing a crisis and asking for immediate financial help or a ransom. It also said criminals make videos for real-time video chats with people posing as company executives, law enforcement, or other authority figures, and that AI-made content can be hard to spot: FBI IC3: criminals use generative AI to facilitate financial fraud.

This has happened at work, too. In 2024, the engineering firm Arup confirmed to CNN that it was the victim of a deepfake scam in Hong Kong and that "fake voices and images were used." Hong Kong police said the finance worker joined a video call with people he believed were the chief financial officer and other staff, all of them deepfakes. He sent HK$200 million (about US$25.6 million) in 15 transactions, CNN reported, citing Hong Kong broadcaster RTHK and police: CNN: Arup revealed as victim of $25 million deepfake scam.

The core defense: a code word

The FBI and FINRA both recommend one. The FBI's first tip is plain: "Create a secret word or phrase with your family to verify their identity." FINRA says: "Establish family code words to verify one another during emergencies." A code word works because a cloned voice can copy how someone sounds, but it can't know a secret that was never recorded or posted.

If a call, text, or video asks for money or urgent help, ask for the word. The real person knows it. A scammer doesn't.

How to choose a good code word:

At work, pair a team verification phrase with a firm rule: any request to move money or change payment details gets confirmed through a second, known channel first.

Do this now: Pick a family code word this week, in person, and tell everyone who might get a call about you.

Four habits that back it up

1. Hang up and call back on a number you know. FINRA says that if you're contacted by phone, hang up and call back using trusted numbers. If you can't reach the person, our advice is to try another family member or their friends. The FBI gives similar advice for calls that claim to be from a bank or other organization: hang up, look up the organization's number yourself, and call it directly. The FCC (Federal Communications Commission) adds that scammers often use caller ID spoofing to make a call look legitimate, and that AI-generated voice calls are illegal unless you agreed to receive them or the caller is exempt: FCC: stop unwanted robocalls and texts.

2. Ask a question only the real person would know. If you haven't set a code word yet, ask about a shared memory that has never been online, like what you ate after a specific family event. Avoid questions whose answers are easy to find, such as a mother's maiden name or a hometown.

3. Slow down when you hear urgency, secrecy, or odd payment requests. FINRA says family-emergency impersonators may urge payment by wire transfer, payment app, gift cards, or cryptocurrency, all methods that make recovering your money difficult, and will likely ask you to keep the "emergency" and the payment secret from other family members. The FCC says scammers create a false sense of urgency, and that if a caller asks you to pay with gift cards, it's a scam. So if you hear "don't tell Mom," pause and check.

4. Limit public voice and video samples where practical. The FBI suggests, if possible, limiting online content of your image or voice, making social media accounts private, and limiting followers to people you know. Just think twice before posting long clips of family members talking.

The FBI also suggests listening closely to tone and word choice. Treat that as a bonus check: a code word and a call-back don't depend on spotting a flaw.

Do this now: Save one trusted phone number for each close family member, so you can call back without using a number from the suspicious call.

If it happens to you

Hang up and call back on a number you know. If you already sent money, our advice is to contact your bank or payment provider right away. The FBI asks victims of financial fraud to report to its Internet Crime Complaint Center at ic3.gov, and FINRA also points people to the FTC, which takes reports at ReportFraud.ftc.gov.

A code word verifies who someone is. It's different from a safe signal, which is a phrase a family member uses to ask for help without anyone nearby noticing. We cover that in The family safe signal: how to say "come get me" without saying it.

Teach it this week

Cyber Finance AI

If a voice sounds exactly like someone you love, how do you know it's really them?

Big idea: AI can copy how someone sounds. It can't copy a secret that was never shared, so a code word and a call-back beat a convincing voice.

Background for the teacher or parent: The FBI and FINRA both recommend a family code word: FBI IC3: criminals use generative AI to facilitate financial fraud and FINRA: deepfakes and vishing.

Classroom version (10 minutes)

  • Objective: Explain why a familiar voice isn't proof, and name two ways to verify a caller.
  • Hook (2 min): Read a made-up script: "Grandpa, it's me. I'm in trouble. Please send gift cards and don't tell Mom." Ask: what would make you stop?
  • Explain (3 min): Short clips can clone a voice. Cover the code word, the call-back, and red flags: urgency, secrecy, gift cards, wire, crypto.
  • Activity (5 to 7 min): Pairs write three practice code words and test each: hard to guess, not online, agreed in person, never offered by the caller. Then role-play the call, with the "grandparent" asking for the word.
  • Discussion questions: Why should the caller never say the word first? What if you can't reach the person?
  • Exit ticket (1 min): Write the two steps you'd take before sending money to a caller.

Kitchen Table Talk (10 minutes)

  1. Ask whether anyone has gotten an "it's me, I'm in trouble" call.
  2. Choose a code word together, out loud. Nobody writes it in a group chat.
  3. Practice once: one person "calls," another asks for the word.
  4. Tonight's action: save a trusted number for each family member in every phone.

Use practice words in class, never your family's real code word. Free to use; please keep the source credit.

Education only, not financial, legal or tax advice. Not a registered investment adviser.

Sources

Primary sources

  1. FBI IC3: criminals use generative AI to facilitate financial fraud, Public Service Announcement I-120324-PSA, published Dec 3, 2024, date checked: Oct 22, 2026
  2. FINRA: deepfakes and vishing, "Deepfakes and Vishing: What You Need to Know to Stay Protected," published June 18, 2026, date checked: Oct 22, 2026
  3. FCC: stop unwanted robocalls and texts, consumer guide, last updated/reviewed Feb 27, 2026, date checked: Oct 22, 2026

Supporting links

  1. CNN: Arup revealed as victim of $25 million deepfake scam, published May 16, 2024, updated May 17, 2024, date checked: Oct 22, 2026