The family safe word and callback rule

AI can copy a voice well enough that recognizing it no longer proves who's calling. People reported losing more than $5 million in 2025 to 'distress' calls that used voice cloning, and the FBI says the script is spreading from grandchildren to other relatives and friends.⁴ The FBI recommends a family secret word, AARP recommends a code word, and the FTC and FCC tell you to hang up and call back on a number you know.¹⁵²³

1. 1

   Step 1: Gather the people who'd call each other in a crisis

   Include grandparents, parents, adult children, teens, and anyone who handles money for the family. Do it in person or on a call you placed, not over text or email. Explain that this is about AI copying voices, not about anyone being gullible.

   How you know it worked

   Everyone who might make or receive an emergency call was part of the conversation.

2. 2

   Step 2: Choose a word nobody could look up

   Skip pet names, street names, birthdays, school mascots, and anything that appears on social media. Two unrelated words or an odd phrase works well, as long as everyone can remember it when they're scared. A family story only you share is another option AARP suggests.⁵

   How you know it worked

   Scroll your family's public social profiles; the word isn't there and couldn't be guessed from them.

3. 3

   Step 3: Keep it in people's heads, not in chats

   Don't text it, email it, post it, or put it in a shared note. If someone needs a reminder, give it in person or on a call you started. Adults who use a password manager can store it there.

   How you know it worked

   The word doesn't appear in any family group chat or email thread.

4. 4

   Step 4: Agree exactly how to use it

   Whoever gets an urgent call asks for the word, and the caller has to say it without hints. If the caller can't give it, changes the subject, or gets angry, treat it as a scam. The FBI recommends the same kind of code word for 'virtual kidnapping' texts that arrive with altered photos as proof.⁶

   How you know it worked

   Each person can explain the rule back in one sentence, such as 'No word, no money.'

5. 5

   Step 5: Add the callback rule

   For any request to send money, share a code, or give personal details, hang up and call the person back on the number saved in your contacts, even if they gave the word. If you can't reach them, call another relative or friend, even if the caller asked you to keep it secret.⁷ Caller ID can be faked, so never call back the number that called you.³

   How you know it worked

   Everyone has the others' numbers saved as contacts, and a backup person to call for each.

6. 6

   Step 6: Plan for the 'lawyer' or 'officer' on the line

   Scammers often hand the phone to a fake police officer, lawyer, or court official who couldn't know the word anyway. Agree that nobody pays bail, fines, or fees over the phone, by gift card, by wire, by crypto, or to a courier at the door. AARP notes that law enforcement doesn't collect bail from relatives this way.⁵

   How you know it worked

   Everyone agrees that a stranger taking over the call is a reason to hang up and call family.

7. 7

   Step 7: Practice once

   Run a short drill: one person calls with a made-up emergency and the other asks for the word, then hangs up and calls back. Keep it light, and do it again with grandparents and kids, who are the most likely to get a real attempt.

   How you know it worked

   The person answering asked for the word and called back without being prompted.

8. 8

   Step 8: Change the word when it's been exposed

   Pick a new word after it's used in a real call, if it was said where others could hear, or if someone leaves the family circle. Otherwise, revisit it once a year.

   How you know it worked

   You've set a yearly calendar reminder to check the word still works for everyone.

• A safe word only works while it stays secret. Once it's said on speakerphone, typed in a group chat, or posted, treat it as burned and pick a new one.
• Scammers usually dodge the question rather than fail it. They claim to be too hurt or panicked to think, or they pass the phone to a fake official, so the rule has to be 'no word, no money', not 'they sounded right'.
• A callback can't help if a relative's own phone or messaging account has been taken over. That's why the rule includes a second family member to check with.
• People forget under stress, especially young children and anyone with memory changes. Keep the word simple, and lean on the callback rule when the word fails.
• It doesn't cover scams that impersonate banks, government agencies, or tech support instead of someone you know. The callback rule still works for those; the safe word doesn't.
• It can delay help in a real emergency by a few minutes while you check. Agree as a family that a short delay to verify is acceptable.

• ThreatHomeBusiness

  Voice cloning and deepfake scams

  Criminals can copy a voice from a short clip and fake faces on a video call, then use them to ask for money in a hurry. In 2025 the FBI logged 22,364 complaints that mentioned AI, with losses near $893 million, most of it in investment scams; voice-cloned 'distress' calls alone cost victims more than $5 million. The defense is low-tech: pause, hang up, and confirm through a number or channel you already trust.

  Read
• GuideHome

  Help an older relative stay ahead of AI phone scams

  Older adults report losing money to fraud less often than younger adults, but when a scam works it tends to cost them more, especially when it starts with a phone call. People 60 and older reported $7.7 billion in losses to the FBI in 2025, including $352 million in complaints that mentioned AI. This guide helps you set up call screening, bank alerts, and a trusted contact together, as partners, and plan what to do if something gets through.

  Read
• GuideBusiness

  Two-channel verification for payments

  Money only moves after a second channel confirms it. Keep a list of known-good phone numbers, call back on those numbers before paying or changing bank details, require two people above a set amount, and know who to call in the first hour if money goes out. Among the controls finance teams use against business email compromise, that callback is the one most often rated very effective.

  Read
• GuideHome

  Digital hygiene at home: the household baseline

  A safe household runs on a few habits: one password manager, passkeys or multi-factor authentication (MFA) on the accounts that matter, automatic updates, and backups you've actually tested. AI adds one more: a family safe word and a callback rule, so a panicked call that sounds like family gets checked before anyone pays. People 60 and older reported $7.7 billion in losses to the FBI in 2025, so bring older relatives into the plan.

  Read