A family code word is the simplest protection against an AI voice-clone call: one private signal two trusted people agree on in advance, so an urgent money request can be confirmed in seconds. The idea is easy. Choosing one that holds up, and making it part of how your household actually operates, is the work this guide does with you.
Why a code word became official advice
For years this was a clever household trick. It is now the recommendation regulators print first. In December 2024 the FBI's Internet Crime Complaint Center told the public, in plain language, to "create a secret word or phrase with your family to verify their identity" against AI-generated imposters. The Federal Trade Commission's alert on AI-enhanced emergency schemes reaches the same conclusion from the consumer side, and McAfee and the Better Business Bureau both now publish the same instruction. Four independent authorities, one prescription. What none of them ship is the thing that makes the advice usable: a private line to confirm on. That gap is what The Family Word fills.
The pressure behind the convergence is measurable. Hiya's State of the Call 2026 report found that one in four Americans say they received a deepfake voice call in the past 12 months. The clone is cheap to make, too: Microsoft Research's VALL-E paper demonstrated convincing synthesis from a three-second sample of a target speaker. Cheap to fake, hard to catch by ear, and now arriving at a quarter of households. A shared signal is the cheap counter-move.
Verification, not detection
Most products in this space try to detect the fake, scoring an inbound call for synthetic artifacts and flagging it. That is the losing side of the bet, because roughly seven in ten people cannot reliably tell a clone from a real recording, and the detectors that beat humans are not sitting in a grandparent's kitchen at 9 p.m. on a Sunday.
A code word flips the problem. You stop trying to detect the forgery and instead verify the person. The caller either supplies the signal your household agreed on, or they do not. It is a clean yes-or-no any frightened relative can run with no analysis, no app, and no training. Detection asks the impossible question, "is this fake?" Verification asks the answerable one, "do you know what only we know?"
What makes a code word actually hold up
The strength of the signal is entirely in its privacy. A cloned voice is a perfect copy of how someone sounds; it carries none of what your household has agreed on off-camera. So a code word fails the instant it has been spoken where it can be captured, and holds for as long as it has not. That single rule generates the checklist below.
- Generate three candidates together, off any device.
Sit in one room with phones down. Reach for the off-record, the dog's ridiculous nickname, a misheard lyric from a road trip, a private in-joke. Three is plenty; more turns the kitchen table into a committee.
- Cut anything that has ever been recorded or posted.
Search each candidate against your household's online footprint, wedding-toast videos, podcast clips, captions, livestream archives. If a scraper could find it, a scammer already has. Assume the searchable web is the attacker's training set.
- Cut anything that doubles as a security answer.
First pet, mother's maiden name, the street a parent grew up on, these are sold in five-dollar background checks. A signal a stranger can buy is not a signal.
- Keep the most sayable survivor.
It has to be pronounceable over a bad cellular connection by someone whose hands are shaking. Of the safe candidates, pick the one that is easiest to say twice. Skip tricky vowel pairs and near-rhymes.
- Write it on paper, not in the cloud.
An index card on the fridge, or the card in the kit. Never the group chat, a shared note, or an email, those sync to systems that get breached. Paper your household controls does not.
The signal lives on paper your household controls. The group chat lives on a server you do not.
A static word vs. a shared memory
One word is good. A shared memory beats it. A static signal can be overheard once and reused forever; a memory beat, "tell me where we hid the spare key the summer the porch flooded," forces the caller to produce something a clone can never improvise. The criminal can mimic the timbre flawlessly and still have no idea what happened that summer.
This is the strongest version of the same primitive. Pick a beat from the household's own past that lives nowhere online, and it is at once harder to scrape than a single token, harder to brute-force than a security answer, and just as easy for your own people to recall. The deeper into the shared archive you reach, the safer the signal.
Wiring it into a real household ritual
A protection nobody uses protects nobody, so the goal is to make the signal a habit, not a chore. Tie it to a routine that already exists. If the code word is "anchor," for the porch chair grandpa loved, it surfaces naturally every time grandpa comes up, and stops feeling like homework.
Run one practice call. Five minutes, real phones: "Hi mom, quick check, what's the signal?" "Anchor." "Perfect. Love you." It feels silly once and earns its keep every time after. Rehearsed drills hold up under stress where unrehearsed ones collapse, which is exactly why fire-escape and severe-weather plans are practiced rather than merely written. Refresh briefly at the next holiday and leave it there.
Putting it on a secure line
Every safe-word guide ends the same way: agree on a signal, never say it over the phone unless you placed the call, and call back to confirm. Then they leave you with no safe number to call back on. That missing channel is what The Family Word ships as a product. The kit pairs the code word on a fridge card with a private hotline that rings the relatives you choose, no 800 number for a scammer to spoof, no strangers admitted, no data captured off the line.
That is the whole loop. A suspicious call comes in. The relative asks for the signal. The line goes silent. They hang up, dial the private number on the card, and the people they trust pick up, calmly, on a channel that is always safe to use. If a call has already used the signal aloud in a recorded attempt, retire it, choose a fresh one, and log the incident at reportfraud.ftc.gov and the FBI Internet Crime Complaint Center.
One last thing the elder framing can obscure: this is not only for aging parents. The same signal works for a spouse who texts that the wire instructions changed, for a teen away at college, for anyone you would panic for, because a private signal on a safe line is simply how trusted people prove it is really them in a world where any voice can be faked.
