The phone rings. It's your daughter's voice — not a voice like hers, her voice — crying, saying she's been in an accident and needs money for a lawyer before the police process her. A man takes the phone and tells you where to wire it. Everything in your body says act now. And that's the whole trick: the voice is a machine, your daughter is fine, and the number you're about to wire money to belongs to a scammer who found ten seconds of her talking on Instagram. This is the fastest-growing scam in America, and the defense against it costs nothing.
Three Seconds Is All It Takes
Voice cloning used to require studio recordings and specialist software. Today, free and cheap online tools can produce a convincing clone from three to four seconds of audio — McAfee's researchers measured an 85% voice match from a single short sample, rising higher with more audio [1]. Where do scammers get three seconds of your voice? Everywhere you've put it: Instagram reels, TikToks, YouTube videos, podcast appearances, even your voicemail greeting. If you or your kids post videos with audible speech, the raw material is already public.
The clone doesn't need to be perfect. It plays over a phone line — compressed, in a "noisy" location, and delivered mid-crisis. Panic does the rest of the work. This is the same asymmetry we covered in our AI scams overview: the technology only has to be good enough to survive thirty seconds of a terrified parent's judgment.
The Three Scripts
The modern grandparent scam. Your child or grandchild calls from an unknown number: accident, arrest, kidnapping. There's always a reason they can't talk long, always a second voice giving payment instructions, and always a demand for wire transfer, gift cards, or crypto — the unrecoverable channels. The FBI found average losses of about $38,500 per victim among Americans over 60, and this age group reported $7.7 billion in total cybercrime losses in 2025, up 59% in a year [2].
The business version targets employees who can move money. The most famous case: in 2024, a finance worker at engineering firm Arup joined a video call with his CFO and several colleagues — every one of them a deepfake — and wired $25.6 million across 15 transfers before a routine check with headquarters exposed the fraud [3]. He'd suspected the initial email was phishing. Seeing and hearing familiar faces overrode the suspicion. If it works on trained finance staff at a multinational, it works on a five-person office.
Not every clone calls you live. Scammers leave cloned voicemails — "Hey, it's me, new number, text me here" — that seed a longer con by text, where no voice is needed at all. The clone just opens the door; the extraction happens in writing. Any "new number" message, voice or text, deserves a callback to the old number before you believe it.
The Defense Costs Nothing
You cannot reliably out-listen a clone — 70% of people can't, and the accuracy is still improving. The defenses that work don't rely on your ear:
- Set a family safe word tonight. One word or phrase, agreed in person, never posted anywhere. Any emergency call asking for money gets one question: "What's the word?" A clone can mimic a voice; it can't know a secret. This is the single highest-value defense and it takes two minutes at dinner [4].
- Hang up and call back. On the number you already have for that person — not the number that called you. Real emergencies survive a sixty-second callback. Scams don't.
- Treat urgency + secrecy + untraceable payment as the scam signature. Wire transfer, gift cards, crypto, "don't tell anyone" — no legitimate emergency ever combines these. This rule catches voice clones, and every other scam besides.
- Shrink the raw material. Set social accounts private where you can, and reconsider the outgoing voicemail greeting in your own voice — the default robot greeting gives a scammer nothing.
- At work: verify money movement out-of-band. Any payment request that arrives by call or video gets confirmed through a separate channel you initiate. That one policy would have stopped the Arup fraud cold.
Don't stay on the line making decisions. Hang up, call the real person, and if money moved, contact your bank immediately — recovery windows are measured in hours. Report it at ic3.gov (FBI) and reportfraud.ftc.gov. The FTC's impersonation rule, in force since April 2024, lets it pursue these scammers in federal court directly [5] — but only reported cases get counted, and most victims stay silent out of embarrassment. Don't. The voice fooled trained professionals; it isn't a lapse in judgment to be fooled by it.
A clone can copy a voice perfectly. It can't know a word two people agreed on at the kitchen table.
— Why the oldest security tool beats the newest scamStrip away the AI and this is the oldest con there is: manufactured panic, a demand for secrecy, and money sent somewhere it can't come back from. The voice clone just removed the last tell — the voice that didn't quite sound right. So the defense moves one layer down, to something no model can generate: a shared secret and a habit of calling back.
This is the first entry in AI Watch, our series flagging AI-powered threats as they emerge — short, practical, and current. Set the safe word tonight. Then send this to the person in your family most likely to get the call.