An editorial Q&A on the language side of the voice-clone scam — what kinds of words hold up against a clone, which ones almost always fail, and what the public regulator material from the FTC, FBI IC3, and AARP says about the moment of the call. The questions are ours; the answers cite the public sources inline.
About this piece
This is an editorial Q&A from The Family Word editorial — not an interview with an outside expert. The questions are the ones we think a reader is most likely to bring to this topic; the answers cite the public regulator material — the FTC's consumer guidance, the FBI IC3 elder-fraud reports, and the AARP Fraud Watch Network — alongside the speaker-recognition research from NIST. Every substantive claim links to a public, primary source so a reader can check it themselves. Where the answer is opinion shaped by that reading, we say so plainly.
How do words slip past someone in a panic?
Panic narrows the cognitive aperture. Working memory shrinks, attention locks onto the threat, and the listener loses the ability to do the kind of fine-grained acoustic analysis that would normally flag a voice that is "almost but not quite right." Anyone who has tried to remember a phone number after a near-miss in traffic knows the feeling.
This is not a personal failing. It is a basic property of how human attention behaves when the body believes someone is dying. The HHS Office of Inspector General consumer alerts describe the same dynamic in plain terms: scam scripts work because they bypass deliberation, not because the target lacks intelligence. The FTC reaches the same conclusion from a regulator angle in its "how to avoid a scam" guidance — the recommended defense is structural ("stop, check, call back on a number you trust"), not analytic ("listen harder").
Why does a family story work where other defenses don't?
The asymmetry is the point. The criminal has the voice — perfectly, in many cases. The criminal does not have your family. The story lives in your family, and the caller either knows it or does not. That is a clean yes/no check, available to anyone who picked up the phone, no analysis required.
This is the same operational shape the regulators keep pointing families toward. The FTC's consumer guidance recommends a structural check ("stop, verify, call back on a number you trust"), not an analytic one ("listen harder"). The AARP Fraud Watch Network has been clear for years that the defenses that actually help families are the ones a family can perform in the moment.
What kinds of words almost always fail?
Anything that has been said in public. Anything in a wedding speech that ended up on Facebook. Anything the family says into a phone during a podcast appearance, a campaign event, a class reunion. Anything in a Zoom recording that got uploaded somewhere. Anything searchable.
The NIST Speaker Recognition program has been running formal evaluations of voice-biometric systems since 1996; its public summaries make the same point from the other direction — voice itself reuses heavily across contexts, and anything the parent says in front of a camera or microphone should be assumed to have been ingested somewhere. The lesson for families is simple: candidate stories have to be checked against the family's public footprint, not just against the parent's intuition for what is "private."
Other common failure modes: words that double as common security-question answers (mother's maiden name, first pet, first car), words that are the answer to an old personality quiz the parent took on social media, and words that are emotionally awkward to say out loud during an actual emergency.
What does the public research actually say?
Three sources do most of the load-bearing work for the case we make, and each of them is public and free to read:
- Imposter-scam losses. The FTC Consumer Sentinel Data Book and the FBI IC3 annual reports publish the headline numbers each year. Imposter scams are the most-reported variant, and the FBI's elder-fraud reports document the dollar impact concentrating on older adults.
- Voice biometrics. The NIST Speaker Recognition Evaluations have benchmarked voice-biometric systems since 1996. The throughline most relevant to families: voice itself is not a usable sole authenticator, even with state-of-the-art systems.
- Synthetic-voice detection. The MIT Media Lab and the Stanford Institute for Human-Centered AI have both published on the practical detectability of synthetic voice; the headline result is sobering — machine detectors do better than humans, but neither can be in a grandparent's kitchen at 9 p.m. on a Sunday.
The headline result is consistent across all of it: human listeners are not reliable detectors of synthetic voice under stress, the law and the standards bodies have accepted this, and the operational fix has to be something the family can actually do at the kitchen table. A short story that lives in the family is one such fix.
Does this approach work in non-English households?
It works better, actually. Multilingual families have a native advantage: a code-switch the criminal cannot mimic. A grandmother who normally speaks to her grandchild in Spanish at home will hear the difference between a clone speaking English with a Spanish lilt and the real child code-switching mid-sentence into the actual family register.
The story itself can come from any of the family's languages. For families where English is the lingua franca but a heritage language is the language of intimacy, a story from the heritage language is often the strongest choice — the public audio corpus a criminal would have trained on almost certainly does not include it.
What should families avoid when writing your story?
Anything you would type into a security form. Anything anyone has heard you say. Anything in the family group chat (those get backed up to cloud services that get breached). Anything obviously meaningful — a deceased grandparent's name is poignant but is also the kind of thing a criminal might already have. Anything a stranger could guess from a paywall obituary or a public records search the FTC's fraud report intake flags as a precursor.
Anything that the family is going to forget. The word has to be pronounceable, retrievable in panic, and short enough to say twice if the line is bad. We have a whole guide to picking one.
The criminal has the voice. The criminal does not have the family. The story lives in the family.
Where to go next
For the operational version of this argument, head to the guide to picking a family story. For the printables and audio samples, the Resources library has everything. For the imposter-scam baseline numbers, the FBI IC3 annual report and the FTC Consumer Sentinel Data Book are the public sources; the FCC's spoofing primer covers the caller-ID side of the same problem; and the AARP Fraud Watch Network has the steady plain-English overview if a family member needs a calm read. For the longer piece on how the hotline rings the family members you choose, see our hotline explainer. When you are ready, order the kit for $59 with free US shipping — it ships with the hotline live day-one, ringing the family members you pick.
