A Safe Word Can Protect against AI Impostor Scams

Defend Yourself against AI Impostor Scams with a Safe Word

By Ben Guarino

The most common fraud in the U.S. over the past year was the impostor scam. More than 856,000 instances, collectively draining $2.7 billion nationwide, were reported to the Federal Trade Commission in 2023. First, swindlers fake familiarity or authority—maybe by stealing the identity of a friend or relative or claiming to be a bank representative or a federal agent. Then, in that guise, they call, text or e-mail you and attempt to take your money.

And now artificial intelligence has larded these scams with an additional layer of duplicity: inexpensive voice-cloning services that an impersonator can easily abuse to make deceptive—and astonishingly convincing—phone calls in another person’s voice. These AI tools digest speech samples (perhaps snatched from videos posted online or from a supposedly “wrong number” phone call) and generate audio replicas of the stolen voice that can be manipulated to say basically anything.

If there were a golden rule to thwart AI-infused phone scams, it might be something like this: Online or on the phone, treat your family members and friends as though they were an e-mail log-in page. Make up a passcode—a safe word or private phrase—and share it with them in person. Memorize it. If they call you in alarm or under unusual pressure, especially if those concerns are connected to requests for money, ask for the code to verify who is on the other end of the line.

On supporting science journalism

If you’re enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.

Adopting a computerlike countermeasure for a problem enabled by computer algorithms is admittedly an unnatural practice. It is a human impulse to trust a family member’s voice, said Jennifer DeStefano, a target of an attempted scam, to a Senate judiciary subcommittee last June. Perpetrators had called her phone, claimed her then 15-year-old daughter was kidnapped and demanded a ransom. The plot fell apart when DeStefano learned her child was safe on a ski trip—but only after DeStefano had at first been thoroughly deceived by an AI mimic of her daughter’s voice. “How many times has a loved one reached out to you in despair and you stopped them to validate their identity?” she wrote in her testimony. “The answer is, more than likely, never.”

Using a verbal password or code phrase may simply be the most straightforward way to combat AI voice scams. “I like the code word idea because it is simple and, assuming the callers have the clarity of mind to remember to ask, nontrivial to subvert,” says Hany Farid, a professor at the University of California, Berkeley, who has studied audio deepfakes. “Right now there is no other obvious way to know that the person you are talking to is who they say they are.” Farid and his wife have a code word. His pro tip: “Ask each other what the code is every once in a while—because unlike a [computer] password, we don’t use the code word very often, so it is easy to forget.”

With scam fears and dangers becoming such a prominent part of technology news, many of the staff at Scientific American have established safe words, too. Here’s what some of our editors had to say about choosing a memorable and efficient code:

My family has had an all-purpose code word since I was a kid. It was originally developed to keep me from being kidnapped in the car line in elementary school, though I don’t think we ever had to use it. The idea was that if someone showed up to pick me up claiming that they were sent by my parents, I should ask them for the code word. Nowadays the code word mostly exists to make sure my parents don’t get scammed by someone pretending to be me. —Allison Parshall, associate news editor

Establishing a code word with my parents was fairly easy—we had one from middle and high school that was easy to reuse. It was harder to coordinate one with my partner. For each suggestion, he provided an imaginary situation in which hostage-takers could use the word without even knowing its secret meaning. We’re still working to find one that’s foolproof. In the meantime, I’m reminding friends and family that, when in doubt, driving in person to the bank or the police department is more reliable than trusting a voice over the phone claiming to work for either place! —Arminda Downey-Mavromatis, associate engagement editor

My wife and I settled on a pet name that one of us has for the other that was historically reserved for when we’re being twee and annoying (and now, I guess, vigilant). With my brother—because I do not have a cutesy nickname for him—our defense is rooted in the fact we’re never far from our phone. I generated a QR code that we both linked to a one-time password authenticator app. One of us begins the challenge by asking, “Hey, buddy, what’s your number?” The correct answer is the first three digits of the six-digit code displayed in the authenticator app. Then the original challenger reads out the last three numbers. A match is a strong indicator that all parties involved are who they say. —Ben Guarino, associate editor, technology

After reading a scary article about these scams, I contacted my parents and my sister, and we all agreed on a code word based on a funny family lore story about my dad’s childhood. Hopefully we’ll be able to remember it if someone ever tries to ensnare us in one of these! —Clara Moskowitz, senior editor, space and physics

For a while now, I’ve been worried about scammers using generative AI to mimic my or a family member’s voice to scam us out of our money. So when news stories started to confirm that this was actually happening, I told my family that we should make a code word or phrase that we could use to know it was really us. I suggested a question-and-answer pair based on something only our family would know, and one of my family members immediately blurted out the answer in a group text, necessitating a new one. That kicked off a thread where we proceeded to list different family memories and in-jokes, some of which even we didn’t know the answer to! It was a fun trip down memory lane. —Tanya Lewis, senior editor, health and medicine