Set up a family or team code word against voice-clone scams

A voice that sounds like your child, your parent, or your founder is no longer proof of who is speaking. Cloning tools can imitate a person from a short clip: a voice note, a social post, a talk, a voicemail greeting. The scam itself is simple — urgency, secrecy, and a request for money, a one-time code, or a quiet exception to the usual process.

You do not need a new app to push back. You need a code word, a call-back habit, and one practice run.

1. Agree what the word is for

The code word is a yes/no check: “Is this really you, and are you actually asking for this?” It is not a password for your bank, and you should never type it into a website or a “verification” form a caller points you to.

Use it for any unexpected request that involves:

• sending money, gift cards, or crypto
• changing bank or payroll details
• sharing a one-time code, password, or login approval
• keeping the request secret from everyone else

If the caller cannot give the word, you hang up. Then you call back on a number that was already in your phone.

2. Pick a word that is actually private

Choose a short word or a small phrase that would sound odd in a normal emergency, and that is not sitting on the public internet.

Avoid:

• birthdays, anniversary years, pet names, school names
• anything in an Instagram bio, a WhatsApp status, or a “get to know me” post
• the company name, the founder’s name, or “password”

A slightly silly phrase is easier to remember and harder to guess. You can have one word for family and a different one for the people at work who can approve payments.

3. Share it the slow, boring way

Tell the people who need it in person, or on a channel you already trust and that is not the same chat that will later ask for money. A family dinner, a standup, a known-good phone call.

Do not post it in a large group chat “just so everyone has it.” The fewer inboxes it lives in, the better. For a team, write the rule in your payment process (“we always verify with the code and a call-back”) and share the word itself only with the people who can move money or change access.

4. Write the rule in one sentence

Something like:

If someone asks us to send money, change bank details, or share a code, we do nothing until they give the code word and we have called back on a number we already had.

The founder, the parent, the finance lead — everyone is covered, including the person nobody wants to second-guess. Attackers like to impersonate that person.

On the call-back, use a number already saved in your contacts, on the back of a bank card, or on the official website you typed yourself. Do not use a number the urgent caller just read out.

5. Practice once

It will feel awkward the first time. That is the point. Send a test voice note or make a short test call: “This is a drill — I need a transfer today.” The other person should ask for the word, then call you back.

Agree what happens if the word is ever spoken on a recorded line, put in an email, or leaked: pick a new one and share it the same careful way.

6. Pair it with a payment habit at work

A code word is not a substitute for dual approval. For a business, also require a second person (or a second known-channel check) before new payees or bank-detail changes go through. Put that in writing. Make it apply even when “the CEO said so on a call.”

If you want a wider checklist for the team, grab the free AI-safety checklist for businesses. For more on how these calls work, read voice-clone scams.