If you have an older parent, an aunt, a grandparent, or anyone in your family who answers their phone when an unknown number calls, you are now in scope for the AI voice clone scam. This guide is the long version: how the technology works, the conversations that defeat it, and what to do in the first hour after a call.
Why this guide is overdue
Imposter fraud is the single most-reported category to the Federal Trade Commission and has been every year since 2019. The 2023 Consumer Sentinel Network Data Book tallied more than 850,000 imposter reports and $2.7 billion in reported losses. The same agency opened a AI-impersonation rule announcement in 2024 because cloning is now the load-bearing piece of imposter scams.
The FBI's Internet Crime Complaint Center (IC3) tells the same story from a different angle: its 2023 Elder Fraud Report recorded $3.4 billion in reported losses from victims age 60 and over — up 11 percent over the prior year. Average loss per older victim: roughly $33,915. The grandparent variant of the scam is the one with the steepest emotional cost.
The thing that has changed in the last eighteen months is not human inventiveness. The thing that has changed is the cost of a usable clone. What used to require a recording studio and a research grant now requires a free trial and three seconds of audio.
What a voice clone scam is, in plain English
A voice clone scam is a phone call where a machine plays a synthesized version of someone you love. The script is almost always the same: an emergency, a money request, an instruction to stay on the line, a payment method that cannot be reversed. The voice is the bait. The script is the trap.
The cloning step is technical but not exotic. Modern speech models can build a recognizable copy of a person's voice from clips as short as three seconds, drawn from social media, voicemail, podcasts, public Zoom recordings, wedding speeches on Facebook, or any video where the person is talking. The AARP Fraud Watch Network has a plain-language explainer on this; so does the FCC guide to caller-ID spoofing, which covers the other half of the call (the fake incoming number).
The call itself does not need to be perfect. It needs to be good enough that a panicked parent does not pause to check. Most older adults will not run a forensic listening test in the first ten seconds of a call from a grandchild who is crying.
How a voice clone scam call works, step by step
The full mechanism is boring once you write it out. Boring is the point — the scam works because each step feels small.
- Source.
A criminal finds three to thirty seconds of a target's voice. Most often: a public TikTok of a college student, a YouTube clip of a wedding toast, a podcast interview, a high-school graduation video, or a voicemail greeting.
- Clone.
The clip is fed to a speech model. The output is a controllable voice that can read any script. Cost: cents to dollars per call.
- Spoof.
The criminal uses a voice-over-IP service to display a familiar number on caller ID. The FCC's STIR/SHAKEN program has reduced this, but it has not eliminated it.
- Open with panic.
The script starts with crying, an accident, a jail cell, a hospital, an attorney who needs paperwork. The goal is to put the parent below the level of analysis.
- Bridge to money.
Within ninety seconds the call asks for an unusual payment: gift cards, wire transfer, a courier coming to pick up cash, a cryptocurrency exchange, a "bond" paid through a specific app.
- Stay on the line.
The script forbids hanging up. "Stay on the line while I pass you to the lawyer" or "Don't tell anyone, the gag order is in place." This is the tell that should end the call.
- Vanish.
Once the money moves, the call ends. The clone is deleted. The number is recycled.
The call is good enough that a panicked parent does not pause to check. That is the whole point.
What signals a parent can actually hear
None of the signals below are a positive ID on their own. Two or three in the same call is a strong tell. We covered the short list in our seven-things-to-listen-for piece; this is the same list in more detail.
The call opens with a high-stakes emotion before any context. A real grandchild calling from a difficult situation usually establishes who and where first. A clone does not.
The script avoids the parent's name in the form the family actually uses. A clone is built from voice, not from memory. It can sound exactly like a son and still call his mother "ma'am" instead of the name on the fridge.
The call rushes off any topic that requires improvisation: where they are, what the room looks like, what they ate for breakfast. Imposters cannot generate location detail in real time.
The call refuses a callback. "My phone is broken" or "I can't take incoming" is the universal signature. A real loved one in trouble will almost always give a number the parent can dial back, even if it is a borrowed phone.
The call wants money in an unusual form. Gift cards, cryptocurrency, wire transfers, and "stay on the line while a courier comes" are the four common shapes. The CFPB consumer-fraud center has a current list of payment patterns to watch for.
The call cannot say a small thing only the real person would know. Not a security question — those are guessable from public records. A small specific thing: a nickname for a pet, the name of a first apartment, what was on the dinner table last Sunday.
And the cleanest tell of all: the call cannot say the story.
What defenses really stop these calls
There are three categories of advice in circulation. Two of them do not work. The third does, and it is what The Family Word ships.
The first category is "be skeptical." Telling a 78-year-old to be skeptical when she hears her grandson crying about a car accident is asking her to fight her own nervous system. It does not work at scale.
The second category is "use a passphrase." This is closer, but most family passphrases fail in one of two ways: they get said out loud on a phone call that is being recorded, or they get posted somewhere the family forgot about (a wedding speech, a Facebook reminiscence, a podcast interview). The NIST Speaker Recognition group has been clear for years that voice itself is not a usable authenticator.
The third category — the one that holds — is a question your family agrees on, paired with a private number on the fridge that rings the family members you choose. The question is something only your family knows. The number is the floor underneath the question: when the call gets weird, hang up and dial — and someone in your own family picks up.
What the kitchen-table conversation looks like
The hard part of this whole problem is not the technology. It is the conversation. You sit down with your parent at the kitchen table and you say: I love you, and there is a kind of phone call going around, and I want us to have a routine you set up in five minutes so we are ready.
- Pick a calm moment.
Not after the news. Not after a long drive. A weekend morning with coffee is ideal.
- Write a story together.
Something specific to the family. Never one that has appeared on social media, in a wedding speech, in a podcast. Pronounceable in the family's first language.
- Write it on an index card.
The card goes on the fridge. The card is the artifact. The fridge is the obvious place a panicked parent will look.
- Agree the rule about money.
Any urgent money request on the phone must include the story. No story, no money. Even if the voice sounds exactly right.
- Walk through one practice call.
Five minutes. Real phones. Run through the sentence. Make sure it does not feel embarrassing the first time the real moment arrives.
- Tell the siblings.
Anyone who might be the "voice on the phone" needs to know the story exists, and which family members the hotline routes to.
- Tape the hotline number to the card.
A private number that rings the family members you choose, written on the same card. When the parent is unsure, that is the number to dial — and another adult in the family picks up.
What to do after a call has already happened
If a call has already happened, the first hour matters more than anything else. We have a dedicated first-hour piece with the full checklist; the short version follows.
Stay calm. Do not hang up first if the call is still live and the loved one's number was spoofed — many phones will fail to connect a callback while the original line is still open. As soon as the call ends, dial the real person on the number already in the phone.
If money has moved, call the bank's fraud line immediately — bank time is the dominant constraint. Then file a report at reportfraud.ftc.gov and a second report at ic3.gov. If the payment used the mail, add a report at the U.S. Postal Inspection Service. For care guidance specifically for older adults, the HHS Office of Inspector General consumer alerts has a steady, plain-English page.
Tell the rest of the family the time of the call, the number on the screen, and what was said. Update the FBI field-office list of points-of-contact in the area if it is a sustained pattern — the FBI field-office finder is the entry point.
Where to go next
If you want the printables (fridge card, first-hour checklist, scam-call audio samples) head to the Resources library. For the longer piece on how the hotline routes, see our hotline explainer. When you are ready, order the kit for $59 with free US shipping — it ships with the hotline live day-one, ringing the family members you choose, and the kitchen-table conversation takes five minutes from open.
