The Simple Checks I Use to Stop AI Scams

A client rang me last month convinced she had just spoken to her son. Same voice, same habit of trailing off at the end of his sentences, same slightly impatient tone he gets when he needs something. He was in trouble, he said, and needed money moving that afternoon. It was not him. It was roughly thirty seconds of audio lifted from a video he had posted, run through software that costs less than a takeaway. She did not send anything, and the reason she did not is the whole point of this post.

Why Trying to Spot AI Scams Stopped Working

For years the advice was to look for the tells. Bad spelling, clumsy phrasing, a logo in slightly the wrong shade of blue. That advice worked when scams were churned out by people rushing through hundreds of messages a day. It does not work now. The spelling is perfect. The phrasing reads like a real person because real people's writing trained the thing that wrote it. The voice on the phone is your daughter's voice, because it was built from your daughter's voice.

I have written before about how AI scams keep getting harder to spot, and the short version is that the tells people were taught to look for have quietly disappeared. So I stopped teaching people to spot scams a while back and I have not gone back. Detection puts all the pressure on you being sharp at exactly the wrong moment, usually when you are tired, distracted or frightened. Verification does the opposite. It assumes you will be fooled at some point and gives you something to do anyway.

The Safe Word Every Family Should Have

This is the one I push hardest and it costs nothing at all. Pick a word or a short phrase that your immediate family knows and that would never come up in ordinary conversation. Not a pet's name, not a street you used to live on, nothing that is sitting in a Facebook post somewhere. Something daft works best, because daft is memorable and nobody can guess it.

The rule is simple. If someone claiming to be family asks for money, or asks for something urgent and out of character, you ask for the word. A real relative will either know it or laugh at you for asking. A cloned voice will stall, get irritated, or try to talk you past it. That reaction is the tell, and it is far more reliable than anything you might think you can hear in the voice itself.

I have set this up with families where the grandparents felt a bit silly about the whole idea. Two of them have since used it for real. Neither felt silly at the time.

Why I Always Hang Up and Call Back

The second habit is even simpler. Whoever rings you, whatever they say, you end the call and you ring back on a number you already had. Not the number that just called you. Not a number the caller reads out to you. The one saved in your phone, or printed on the back of your bank card, or on a letter you were sent months ago.

This works because it breaks the one thing every scam of this kind depends on, which is keeping you inside a conversation they control. A fake bank fraud team cannot follow you onto a line you dialled yourself. Neither can a cloned voice. Leave a minute or two before you dial as well, because older landlines could sometimes be held open by the caller, and a short wait costs you nothing.

Real organisations are completely relaxed about this. I have never known a bank, a utility company or the police to object to being called back. Anyone who does object, who tells you there is no time or that the line has to stay open, has just told you exactly what they are.

Video Calls Are Harder Than People Expect

Voice cloning gets the headlines, but faked video is now good enough to fool people on a short call, particularly on a phone screen with a patchy connection. The old advice about asking someone to turn their head or wave a hand in front of their face is getting less reliable every year, and I would not want anyone betting a house deposit on it.

So I treat video exactly the same as voice. If a video call is asking me to do something that moves money or hands over access, the call itself is not the verification. I go and check through a different channel entirely, which usually means a text to a number I already have, or a phone call I place myself. The point is not which channel you pick. The point is that the person on the screen does not get to choose it for you.

What to Do When You Simply Cannot Check

Sometimes there is genuinely no way to verify in the moment. A relative is abroad, it is the middle of the night, the one person who could confirm it is unreachable. This is the situation scammers engineer on purpose, because urgency plus isolation is where people make the decision they later cannot explain to themselves.

My rule for that gap is that nothing irreversible happens inside it. No transfers, no card details, no codes read out loud, no remote access software installed because someone talked you through it. Waiting an hour has never once cost one of my clients anything real. Acting inside that hour has cost people their savings.

Two things worth having in place long before you ever need them. Turn on two factor authentication for your email and your banking, so that a scammer holding your password still cannot get in. And use a password manager, so one leaked login does not quietly open everything else you own. I use NordPass for exactly that reason and it takes an evening to set up properly.

If you want the official version of all this sitting alongside mine, Take Five is the national campaign built around the same idea and it is worth ten minutes of anyone's time. And if you would rather just talk it through with a real person, get in touch and I will help you set a family safe word up properly.