(Credit: Zain bin Awais/PCMag/Getty Images)
It’s a parent’s worst nightmare: A frantic, unexpected call from what sounds like your child, saying they’ve been kidnapped. The child tells you to pay the criminal, usually using cryptocurrency, then the call ends.
If you guessed the voice is AI, you’re correct. But most parents who receive a message like that aren’t considering the scammy possibilities first.
Unfortunately, scammers are always coming up with new, highly manipulative ways to part you from your money. Cybersecurity consulting firm F-Secure recently published survey results showing that 56% of respondents encountered online scams each month, and 52% of victims lost money to them. To learn more about how voice cloning scams work, I spoke with Megan Squire, a cyber threat intelligence researcher at F-Secure.
How Scammers Clone Your Child's Voice in Seconds
Last week, I received three calls claiming to be from a Delaware County courthouse. I don’t live in Delaware, so I didn’t answer, but I did listen to one of the voicemails left by a caller. They claimed a loved one had been arrested and needed money quickly to post bail. According to Squire, this is a common tactic among phone-based scammers.
“It's a bit outrageous,” she said. “The scammer is going to set up a ruse, involving everything from ‘your child's been kidnapped’ to a car accident. It depends on how much audio they're willing to use to try to set up the ruse.”
Squire said most AI voice cloning tools require only 10 seconds of clear audio to create an effective voice clone. Scammers get this audio by combing social media feeds or accounts on video-sharing platforms like YouTube.
“If you've been interviewed by the news, if you have a halfway large and public social media account with videos on it, these tools can grab those audio clips and then create clones of the voice that say different things,” Squire explained.
Don’t give scammers too much credit for their investigative skills, though. It’s incredibly easy to find out who is related to whom online. Thanks to years of companies losing or selling your data, it’s pretty effortless to find out basic information about anyone.
“These people are not detectives,“ noted Squire. “If you find some kid on social media that's got a fairly large profile and you can easily find their parents probably also commenting on the same social media platform.”
A quick look at your own entry on a data broker website like WhitePages will give you a picture of what kinds of information a scammer can gather about you and who you’re related to, using just your name. When you’re ready to delete that WhitePages profile, or your entries on other data broker websites, check out my guide for cleaning up your digital footprint.
Why Old-School Social Engineering Still Works
Scammers are social engineering experts, so they don’t even need to use AI tools to fool people over the phone. Squire told me that scammers’ acting skills often come into play when they incorporate other characters into phone scams.
“For example, they might set up a case where the child has been in a terrible accident, and now you need to talk to the police officer or the lawyer,” Squire said. “They can be quite creative. It reminds me of acting or improv.”
The most important thing to know about phone scams is that they can affect anyone. A parent is a parent for the entire duration of their child’s life, so older parents with adult children are being targeted just as frequently as parents with young children. For example, during our call, Nicole, one of F-Secure’s public relations representatives, shared a story about her grandfather becoming a victim of a scam.
Here’s what happened: A person claiming to be a lawyer called Nicole’s grandfather’s phone, and told him his grandson, Nate, had been in a motorcycle accident, was believed to be at fault, and needed $6,000 immediately to retain legal counsel. She said her grandfather didn’t call to get a second opinion until after he sent the money.
In the example above, no voice phishing was required. No one needed to clone the grandson’s voice to get a payment from the grandfather, because the criminals had the element of surprise on their side. Later in the article, we’ll talk about how to handle these scammers in the heat of the moment, but the big takeaway is that you should always take a moment to get a second opinion, or call your child directly if you receive an urgent phone call from them. As I’ve mentioned when giving advice about online scams, do not send money to strangers on the internet for any reason.
The Family Emergency Scam Has Global Variations
As mentioned above, the bail money scam is common, but F-Secure researchers note that it’s most common in the United States. That’s because many states publish public arrest lists each day or each week, so scammers can use AI to scan them, find out who each person is related to, and then call a list of potential family members or friends to ask for money while impersonating a lawyer or the arrested individual.
Across the pond, the family emergency grift is a little different. Squire told me about the so-called “Hi Mum” scam, which starts with a short text. The scam tends to work because the supposed kidnapping or accident victim will tell their parents that they’re texting from someone else’s phone because they lost theirs due to the terrible accident or incident they endured. The panicked parent will often fail to call the child’s phone because they assume the child won't answer, but Squire says that’s a major mistake.
“Be as skeptical as you can and try to follow through on everything,” said Squire.
“Look, I know it's hard because you think, ‘I'm not being mother of the year. If I question my child and they really are sick or hurt, I'll feel so bad.’ You'll also feel bad if you just lost $30,000. Take the time. Deep breath in and out.”
The Three-Step Response That Can Save You Thousands
To effectively fend off these types of scams, I recommend following the wise words of Vanilla Ice: “Stop, collaborate, and listen.” I’m serious!
The first thing you can do in an emergency situation is to stop yourself from reacting right away. Instead, take a moment to determine whether the call or text is genuine by asking the caller or texter questions about the situation. If the contact wants you to send them cryptocurrency or gift cards in exchange for your loved one’s freedom, hang up immediately; it’s a scam.
Second, you need to collaborate with the potential victim by contacting them directly. Hang up on the caller, and immediately call your child’s number. Most of the time, if it’s a scam, your child will answer the phone, confused and unharmed, and you can block the scammer’s phone number and report the incident to law enforcement. Scammers are crafty, though, and may offer reasons why you shouldn’t try to call your child back. Squire said, “If they'll come up with some reason now why they can't be called back, or if the lawyer steps in and tries to convince you that that's just not possible, insist on meeting the caller at the local police station or the hospital to verify that the child is in danger or needs help. Do your due diligence to make sure that this is real.”
Third, remember to stay calm and listen to your child’s voice on the phone. It may be painful to hear your child’s distressed voice, but listen carefully for any repeating words or sounds. Squire said that while AI tools are advanced, many scammers use cheap or free tools that don’t allow them to create more than 10 or 20 seconds of audio from a voice, so you may hear the same audio clip over and over.
The One Family Rule That Stops These Scams Cold
The best way to prevent scams is to stay skeptical when interacting online, keep your social profiles private, and create a quick scam response plan. I’ve addressed ways to stay skeptical throughout this article, and scammers will always have a hard time stealing your photos, videos, or voice if you don’t post that media online.
As for the scam response plan, my first recommendation is establishing a safe word or passphrase you can use with family members or friends. Establish this phrase when you’re speaking with them in person, and don’t type the phrase anywhere. If you get a strange or frantic call, ask the person for the passphrase. If they don’t know it, hang up immediately and call the number saved in your phone.
I also recommend checking out the products on my list of the top scam prevention tools. Many of the tools on the list are free and can help you detect scams in real time.
In a similar vein, it’s a good idea to invest in an identity theft protection service. These plans will offer cybersecurity insurance, legal advice, and other support after a successful scam attempt.
When you’re ready to lock down all of your devices and get serious about your family’s online privacy, check out my cybersecurity checklist.