“Mum, it’s me. I’ve been in an accident and I need money right now. Please don’t tell Dad.” The voice sounds right, the panic sounds right, and the caller knows your name. Today a voice can be imitated from a short public clip, and caller ID can be faked, so recognising a voice is no longer proof of who is speaking. What does hold up is a simple agreement made in advance.
Our AI deepfake scams article and the Digital Safety Guide both suggest a family code word in a line or two. This page is the how-to.
What the Phrase Is For
It’s meant for situations where someone you love seems to be in urgent trouble and asks for money, gift cards, a code or secrecy. Typical cases include a cloned voice or fake video of a child or grandchild, a “relative” calling from a new number, a hacked messaging account, or a caller posing as police or a lawyer holding a family member. It does not replace your normal caution; it gives you a quick, calm way to test the caller.
How to Choose a Good Phrase
- Make it unguessable from public information. Avoid pet names, birthdays, street names, schools or anything on social media.
- Use a phrase, not a single common word. Two or three unrelated words, or a nonsense sentence only your family would recognise, are harder to guess than “rainbow.”
- Make it easy to say under stress. If it’s hard to remember or pronounce, people won’t use it in a crisis.
- Use a challenge-and-response if you like. One person asks a question (“What did we have for dinner at Grandma’s?”), the other gives a pre-agreed answer.
- Keep it off devices. Don’t put it in a text, email, family chat or notes app; if those are compromised, so is the phrase. Say it aloud or write it on paper kept at home.
- Don’t volunteer it. The person asking must say it first. Never prompt: “Is this you, what’s our word?” invites a scammer to guess or to say “I forgot.”
Setting It Up as a Family
- Explain why. Say plainly that voices and video can be faked, and that you want a way to check, not to distrust anyone. Short, calm and specific works better than a lecture.
- Agree the phrase in person. Face to face, or in a call you started to a number you know. Include everyone who might receive or make an emergency request: parents, grandparents, adult children, teenagers, and anyone who manages money.
- Agree the rule, not just the phrase. Rule one: no money, codes or secrets without the phrase. Rule two: if the phrase is missing or wrong, hang up and call back on the saved number or reach them through someone else.
- Practise once. Run a short, friendly drill so that using it doesn’t feel awkward. Practise saying: “I’ll call you right back.”
- Plan for people who forget. If someone can’t remember it, they can still be verified by call-back, a question only they can answer, or through another family member. Make sure nobody feels punished for forgetting.
- Change it after use or exposure. If the phrase was said aloud on a call you now doubt, shared in writing, or you think it leaked, agree on a new one.
Verify an Urgent Voice Request Before Sending Money
This is the practical sequence for a call, voice note or video call that asks for money:
- Slow down. Urgency is the tool. A real emergency survives a two-minute check.
- Ask for the phrase. If they can’t give it, or deflect (“no time for this!”), treat it as unverified.
- Hang up and call back. Use the number saved in your phone or one you know, not one given during the call, and not by pressing “redial” on a suspicious number.
- Try another route. Call another family member, the person’s workplace, school or the friend they said they were with. Message them on an app you know they use.
- Never pay by hard-to-reverse methods first. Gift cards, crypto, wire transfers and cash couriers are favourites in this scam. If the call-back doesn’t reach them, contact the local police or the hospital they named, using official numbers you look up yourself.
- Report it. Even if you didn’t pay, report the attempt to your national fraud service (such as reportfraud.ftc.gov in the United States, or cybercrime.gov.in and 1930 in India).
Grace’s grandfather, Hugo, gets a call from a young voice: “Grandpa, I’m in trouble, I need $2,000 for bail, please don’t tell Mum.” The voice sounds like Grace.
Hugo remembers the family rule. He asks for the word. The caller stalls and says there’s no time. Hugo says “I’ll call you right back,” hangs up and rings Grace’s saved number. She picks up at her desk, perfectly fine. Hugo tells the family and reports the call.
What mattered: the rule gave Hugo a calm script, and the call-back did the real work.
Caring for Older Relatives
Older relatives are frequent targets of emergency and impersonation scams, but the answer isn’t to take control away from them. Agree the phrase and the call-back rule together, write the rule in large print by the phone, and keep a list of saved numbers for family. Offer yourself as the person they can call at any time to check, with no judgement. Pair it with other protections in the Digital Safety Guide, and talk through scams that use authority and fear, such as the digital arrest scam.
When the Caller Says the Relative Can’t Talk
Scam calls often arrive with a built-in reason you can’t hear from the relative directly: “he’s in surgery,” “her phone is broken, use mine,” “he’s with the police and can’t call.” Agree in advance that this changes nothing. The plan for these calls:
- Don’t discuss payment on the call. Say you will call back and end the call politely. A real emergency contact will understand.
- Reach the relative another way. Call their saved number, message them on an app they use, or ask another relative or their workplace or school.
- Verify the “official” story independently. If a hospital, police station or embassy is named, look up its number yourself and ask. Don’t use the number the caller gives.
- Wait for confirmation before anything else. No confirmed contact, no money, codes or personal details.
Verifying Unusual Payment Requests
Emergency scams push you toward payments that are fast and hard to undo. Treat the method as part of the warning:
- Gift cards, cryptocurrency and cash couriers: a genuine hospital, lawyer or police station doesn’t ask for these. Stop and verify.
- Bank transfers to a new or personal account: confirm the account details with the person through a channel you already trust before sending.
- Payment apps and “collect” requests: only send money you chose to send. See UPI & QR Code Scams for how requests are disguised.
- “Don’t tell anyone”: secrecy is a pressure tactic. The family plan is to tell someone, every time.
A simple household rule works well: nobody sends money for an emergency until a second family member has confirmed it. That one extra person breaks the isolation scammers rely on.
Including Teenagers and Less Confident Relatives
A plan only works if everyone will actually use it. A few things help:
- Teenagers often receive the first message (a friend’s hacked account, a “relative” asking for help). Ask them to agree the same rule: a request for money gets a call-back, even from a close friend or a family member’s account.
- Older relatives need a short, written version next to the phone, and a promise that checking is welcome at any hour.
- Less technical relatives don’t need to understand AI voice cloning. They need three words: “I’ll call back.”
- Nobody is blamed. Say out loud that anyone can be fooled, and that mentioning a suspicious call is always the right move.
Practise With Family Scenarios
Talking through scenarios makes the plan automatic under pressure. Try these (all fictional):
Scenario 1 — The new number. A text arrives: “Mum, I dropped my phone in water. This is my new number. Can you pay a bill for me right now?”
Unsafe: reply and pay to be helpful. Safe: call the child’s old number, or ask another relative, and don’t pay until the child is confirmed. A new number plus a payment request is the classic pattern.
Scenario 2 — The hospital call. A caller says your brother had an accident and needs $2,000 for treatment today, and asks you not to tell the family.
Unsafe: transfer the money to the account provided. Safe: say you will call back, reach your brother or another relative, and look up the hospital yourself. Telling the family is part of the plan.
Scenario 3 — The friend’s account. A teenager gets a message from a friend’s account asking for a quick gift-card purchase.
Unsafe: buy the cards. Safe: ring the friend, or ask an adult, because hacked accounts are often used to message contacts.
If Money Was Already Sent or Details Shared
If someone in the family has already paid or given away information, speed matters more than blame. Call the bank or payment provider on an official number, and then follow the steps in Been Scammed? What to Do in the First Hour. If a one-time code was shared, read what to do after sharing an OTP. To understand what exposed details can and can’t be used for, see When Scammers Have Your Personal Information. Keep messages, numbers and receipts (how to preserve evidence).
One-Page Family Checklist
- We have a verification phrase, agreed in person and kept off our phones and chats.
- We never discuss payment on an urgent call; we say “I’ll call back.”
- We call the person on their saved number, or reach them through another relative.
- A second family member confirms any emergency request before money moves.
- Gift cards, crypto, cash couriers and new-account transfers are red flags.
- We look up hospitals, police and embassies ourselves, never via the caller’s number.
- Older relatives have this list by the phone, and teenagers know it too.
- Nobody is blamed for being fooled; everybody tells the family about suspicious contact.
- If money or codes were sent, we call the bank at once and report it.
- We review the plan and change the phrase every few months, or after it was used.
A Family Agreement You Can Adapt
Copy this into a note or print it, and change it to suit your household. Read it aloud together once.
1. Our phrase. We have one verification phrase. We say it aloud, never in writing on our phones. We change it every ______ months or after we use it.
2. Our rule. If anyone asks for money, codes or secrets in an emergency, we pause and call back on a saved number.
3. Our second person. Before money moves, ______ (or another adult) confirms the emergency.
4. Our red flags. Gift cards, cryptocurrency, cash couriers, new bank accounts, and “don’t tell anyone.”
5. Our promise. Nobody is ever in trouble for checking, for being fooled, or for telling us about a suspicious message.
6. If something goes wrong. We call the bank first, then tell each other, then report it.
Agreed on: ______ Signed/initials: ______________________
What a Phrase Cannot Do
It won’t help if the scammer already knows it, if you’ve shared it in writing, or if the request isn’t from someone who knows the phrase, such as a fake police officer. It doesn’t protect against messages from a hacked account that claim the person is unable to speak. So combine it with the call-back habit, and with the 10-second rule. No tool, including ScamSense, can promise to spot every cloned voice or message; ScamSense can help you assess a suspicious message or screenshot, but verification by people you trust comes first.
If you did send money after a call like this, go to Been Scammed? What to Do in the First Hour straight away.
Key Takeaways
- A voice is no longer proof of identity; agree a phrase and a call-back rule in advance.
- Choose something unguessable, say it aloud, and don’t store it on devices.
- If the phrase is missing, hang up and call back on a saved number.
- Never pay by gift card, crypto or wire on an urgent call.
Related topics:
AI Deepfake ScamsDigital Safety GuideDigital Arrest ScamWhat to Do After a ScamThe 10-Second RuleGot an urgent message from a “relative”?
Paste the message or a screenshot into ScamSense for a risk assessment, then verify with the call-back rule. It is an extra check, not a guarantee.
Start 3-Day Free TrialFrequently Asked Questions
What makes a good family verification phrase?
Is a code word enough on its own?
What if someone forgets the phrase?
Should I ask the caller “what’s our code word?”
How do I include older relatives?
How do we include teenagers in a family scam-safety plan?
What should a family scam-safety agreement include?
Can I verify an AI-cloned voice by listening closely?
Note: This guide is general information, not legal or financial advice. Procedures, deadlines and refund rights differ by country, bank and payment method. Always use contact details from your bank’s official app, website or the back of your card. ScamSense helps you assess suspicious content but cannot guarantee that any message, link or caller is safe or unsafe.