Deepfake & AI Voice Clone Scams

A relative calls in distress -- an accident, an arrest, a hospital, a stranded trip abroad. They need money now and beg you not to tell anyone else in the family. The secrecy request is the tell: its only function is to stop you from making the one phone call that would expose the fraud.

A finance employee joins a video meeting with the CFO and several colleagues, and is instructed to process an urgent confidential transfer. In a widely reported case at a multinational engineering firm, every other participant on the call was a real-time deepfake, and the finance employee made a series of transfers before anyone noticed. Group video calls now carry the social proof that a single suspicious email never did.

A voice note from your manager on a messaging app asks you to buy gift cards, approve an invoice, or share a login code. Voice notes are especially effective because they are short, informal, and feel too small to verify.

A deepfaked well-known figure endorses a trading platform or crypto giveaway in a video ad. This feeds directly into investment fraud, which the FBI recorded as the single largest category of losses in 2025 at more than $8.6 billion (FBI IC3 2025 Internet Crime Report, accessed 5 September 2026).

Do not negotiate, do not test them, do not stay on the line. Say you will call back and hang up. A real relative in a real emergency will not be harmed by a two-minute delay.

Use the contact stored in your phone, not a number the caller gave you and not the number shown on the incoming call. This is the whole trick: the attacker controls the inbound channel, but not your address book.

Another relative, their partner, their workplace. The demand for secrecy exists only to prevent this step, which is exactly why you should take it.

Go: open a terminal in a folder you can write to — cd ~/Desktop on macOS or Linux, cd %USERPROFILE%\Desktop on Windows.

Do: save this as safeword.py and run python3 safeword.py. Nearly every article on this subject recommends a family safe word; this is what one actually does.

"""A shared safe word: the classic advice. Watch it fail."""

FAMILY_SAFE_WORD = "blue-harbour"

def verify(caller_says):
    return caller_says == FAMILY_SAFE_WORD

print("Mum calls. She sounds exactly like Mum, because she is Mum.")
print("  she says the word:", FAMILY_SAFE_WORD, "->", "PASS" if verify(FAMILY_SAFE_WORD) else "FAIL")
print()
print("Six weeks later a scammer calls, having heard that call.")
print("  he says the word :", FAMILY_SAFE_WORD, "->", "PASS" if verify(FAMILY_SAFE_WORD) else "FAIL")
print()
print("The word is a password that is spoken aloud, over the phone,")
print("every time it is used -- and never changes. Overhearing it once")
print("is enough, forever.")

You should see: the same word working for the right person and then for the wrong one:

Mum calls. She sounds exactly like Mum, because she is Mum.
  she says the word: blue-harbour -> PASS

Six weeks later a scammer calls, having heard that call.
  he says the word : blue-harbour -> PASS

The word is a password that is spoken aloud, over the phone,
every time it is used -- and never changes. Overhearing it once
is enough, forever.

A safe word is a password with two properties no password should ever have: it is transmitted in the clear, out loud, on every use, and it never changes. Anyone within earshot of one genuine call — or holding one recording of it, which is exactly what a voice cloner already has — owns it permanently.

If not: if both lines print FAIL, the string in FAMILY_SAFE_WORD does not match the one passed to verify(); they must be identical, hyphen included. On Windows, python3 may not be recognised — use py safeword.py.

Go: the same folder.

Do: save this as challenge.py and run python3 challenge.py. Instead of one word used every time, this is a short private list agreed in person, from which you ask a different item on each call.

"""Ask something only the real person can answer, and never the same thing twice."""
import secrets

# A small private list, agreed in person, written down at home. Never spoken in full.
SHARED = {
    "1": "the campsite was called Trelow",
    "2": "the car we drove to Wales was green",
    "3": "grandad's dog was called Pip",
    "4": "we ran out of petrol near Bala",
}

def challenge_call(answers_known_to_caller):
    n = secrets.choice(list(SHARED))
    reply = answers_known_to_caller.get(n)
    ok = reply == SHARED[n]
    print("  we ask item %s -> %s" % (n, "answered correctly" if ok else "no usable answer"))
    return ok

print("CALL 1 - the real family member, who has the whole list")
print("  result:", "PASS" if challenge_call(SHARED) else "FAIL")
print()
print("CALL 2 - a scammer who recorded one earlier call and knows item 3 only")
recorded = {"3": SHARED["3"]}
print("  result:", "PASS" if challenge_call(recorded) else "FAIL")
print()
print("A recording answers the question asked LAST time, not this time.")
print("With %d items, a caller who knows 1 of them passes 1 time in %d."
      % (len(SHARED), len(SHARED)))
print("With 12 items, 1 in 12. Add items; never reuse one aloud.")

You should see: the genuine caller answering and the recording unable to:

CALL 1 - the real family member, who has the whole list
  we ask item 1 -> answered correctly
  result: PASS

CALL 2 - a scammer who recorded one earlier call and knows item 3 only
  we ask item 2 -> no usable answer
  result: FAIL

A recording answers the question asked LAST time, not this time.
With 4 items, a caller who knows 1 of them passes 1 time in 4.
With 12 items, 1 in 12. Add items; never reuse one aloud.

Two things about this output will differ on your machine, deliberately. The item numbers are chosen at random on every run, so yours will not be 1 and 2. More importantly, roughly one run in four the scammer will be asked item 3 — the one he recorded — and will pass. That is not a fault in the lab; it is the measurement the last two lines report. Four items give an attacker who knows one of them a one-in-four chance. This is the entire argument for a longer list, and for never re-using an item aloud once it has been spoken.

If not: KeyError means an item number in SHARED is not a string — the keys are quoted ("1", not 1) because secrets.choice returns whatever is in the list. If both calls always pass, check that recorded holds only item 3 and not the whole dictionary.

Go: the same folder. This is the step that replaces “be suspicious” with something you can apply.

Do: save this as what_is_evidence.py and run it.

"""Sort every signal in a phone call into: attacker can produce it, or cannot."""

SIGNALS = [
    ("the voice sounds like them",        True,  "cloned from any public clip"),
    ("the number shown is theirs",        True,  "caller ID is a field the caller sets"),
    ("they know your name",               True,  "public"),
    ("they know where you work",          True,  "public"),
    ("they mention a real recent event",  True,  "public posts"),
    ("they are crying / panicking",       True,  "acted, or synthesised"),
    ("they answer a fresh question",      False, "requires the shared list, not a recording"),
    ("they answer on YOUR callback",      False, "requires control of their actual line"),
]

print("%-36s %-14s %s" % ("SIGNAL", "FORGEABLE?", "HOW"))
print("-" * 78)
for sig, forgeable, how in SIGNALS:
    print("%-36s %-14s %s" % (sig, "yes" if forgeable else "NO", how))

forgeable = sum(1 for _, f, _ in SIGNALS if f)
print()
print("signals in the call :", len(SIGNALS))
print("attacker can produce:", forgeable)
print("actual evidence     :", len(SIGNALS) - forgeable)
print()
print("Everything that persuades you is in the forgeable column.")
print("Everything that proves anything is in the other one.")

You should see: six of the eight signals in the attacker's control:

SIGNAL                               FORGEABLE?     HOW
------------------------------------------------------------------------------
the voice sounds like them           yes            cloned from any public clip
the number shown is theirs           yes            caller ID is a field the caller sets
they know your name                  yes            public
they know where you work             yes            public
they mention a real recent event     yes            public posts
they are crying / panicking          yes            acted, or synthesised
they answer a fresh question         NO             requires the shared list, not a recording
they answer on YOUR callback         NO             requires control of their actual line

signals in the call : 8
attacker can produce: 6
actual evidence     : 2

Everything that persuades you is in the forgeable column.
Everything that proves anything is in the other one.

The second row is the one people find hardest to accept. The number shown on an incoming call is supplied by the caller, in the same way the From: line of an email is supplied by the sender; the telephone network carries it without checking it. A call that displays your bank's real switchboard number tells you nothing at all about who is speaking.

Read the two rows in the NO column and notice what they have in common: both require the caller to possess something now, not to know something. That is the only distinction that has survived.

If not: if the table wraps, widen the terminal — the rows are 78 characters. The counts at the bottom are what matter and are printed on their own lines.

Go: the same folder.

Do: save this as sign_media.py and run it. This is the mechanism behind “content credentials” on news footage, reduced to its essentials: a signature over the exact bytes.

"""Provenance: prove who produced a file, and that it has not been altered."""
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
from cryptography.exceptions import InvalidSignature

# The newsroom's signing key. The private half never leaves their building.
# Fixed seed here so your output matches this page exactly; real keys are random.
private = Ed25519PrivateKey.from_private_bytes(bytes(32))
public = private.public_key()

clip = b"VIDEO: minister says 'we will raise the rate to 40 percent'"
signature = private.sign(clip)
print("clip      :", clip.decode())
print("signature :", signature.hex()[:32], "... (64 bytes)")

def check(data, sig):
    try:
        public.verify(sig, data)
        return "VERIFIED - this is exactly what the newsroom published"
    except InvalidSignature:
        return "REJECTED - not what the newsroom published"

print()
print("original   ->", check(clip, signature))

tampered = clip.replace(b"40 percent", b"14 percent")
print("one word   ->", check(tampered, signature))

deepfake = b"VIDEO: minister says 'transfer the funds immediately'"
print("a new clip ->", check(deepfake, signature))

You should see: the real clip verifying, and both altered versions rejected:

clip      : VIDEO: minister says 'we will raise the rate to 40 percent'
signature : 1f6dbc4c24a69dd5f771b44216ba898d ... (64 bytes)

original   -> VERIFIED - this is exactly what the newsroom published
one word   -> REJECTED - not what the newsroom published
a new clip -> REJECTED - not what the newsroom published

The seed is fixed to zero in this script so your signature matches the one above character for character — a real key is random and secret. Change a single word and verification fails; there is no partial credit and no “probably fine”.

But notice the limit, because it is the important part. This proves a clip came from a key. It cannot prove a clip is true, and it says nothing whatever about the unsigned video someone forwards to you — which is every video you will actually be sent. Provenance helps publishers defend their own material. It does not help you judge the clip in your messages, and any advice that says otherwise has the direction backwards.

If not: ModuleNotFoundError: No module named 'cryptography' means the library is not installed — install it with python3 -m pip install cryptography. If your signature differs from the one shown, the clip text was altered when copying: it must be byte-identical, including the straight apostrophes around the quoted words.

Go: the same folder.

Do: save this as protocol.py and run it.

"""The family rule, written as a decision you can apply while being shouted at."""

def decide(call):
    if call["asks_for_money_or_codes"] or call["asks_for_secrecy"]:
        if not call["you_called_them_back"]:
            return "STOP. Hang up and call them on the number you already have."
        if not call["fresh_challenge_answered"]:
            return "STOP. They failed the challenge."
        return "Proceed."
    return "No money, no codes, no secrecy -- ordinary call."

CALLS = [
    ("daughter, crying, needs bail money now, 'don't tell dad'",
     dict(asks_for_money_or_codes=True, asks_for_secrecy=True,
          you_called_them_back=False, fresh_challenge_answered=False)),
    ("same call, you hang up and ring her own number",
     dict(asks_for_money_or_codes=True, asks_for_secrecy=True,
          you_called_them_back=True, fresh_challenge_answered=True)),
    ("'boss' on video, voice and face right, wants an urgent transfer",
     dict(asks_for_money_or_codes=True, asks_for_secrecy=True,
          you_called_them_back=False, fresh_challenge_answered=False)),
    ("mum asking what time you're coming Sunday",
     dict(asks_for_money_or_codes=False, asks_for_secrecy=False,
          you_called_them_back=False, fresh_challenge_answered=False)),
]

for label, call in CALLS:
    print("%-58s" % label)
    print("   ->", decide(call))
print()
print("Note the rule never asks whether the voice sounded real.")
print("That question has no useful answer any more.")

You should see: the same verdict for the crying daughter and the familiar boss:

daughter, crying, needs bail money now, 'don't tell dad'  
   -> STOP. Hang up and call them on the number you already have.
same call, you hang up and ring her own number            
   -> Proceed.
'boss' on video, voice and face right, wants an urgent transfer
   -> STOP. Hang up and call them on the number you already have.
mum asking what time you're coming Sunday                 
   -> No money, no codes, no secrecy -- ordinary call.

Note the rule never asks whether the voice sounded real.
That question has no useful answer any more.

The rule fits on a fridge magnet: money, codes or secrecy means you hang up and dial the number you already had. It has no opinion about whether the voice was convincing, which is what makes it survive an improvement in the technology; a rule built on detection expires the moment the fakes get better, and they will.

The third case is worth sitting with. Video, voice and face all correct, on a call that appears to come from inside the company — and the verdict is unchanged, because none of those three is in the NO column from step 3.

If not: if the fourth call returns STOP, one of its three flags is True; an ordinary call sets all of asks_for_money_or_codes, asks_for_secrecy to False. If every call returns Proceed, the if conditions were flattened — the two inner checks must sit inside the outer one.