Family Safe Word and Call-Back: Your Defence Against AI Scams

Additional resource for the lesson “Defending Against AI Deception: Separate Channel and Safe Word” — Online Privacy course

A familiar voice is no longer proof of who is speaking. The answer is not to doubt the people you love, but to agree two small habits in advance: a family safe word that never goes online, and a call-back list of numbers you already trust. This resource shows you how to set up both, at home and at work.

A. Why this matters

The previous resource explained how a voice can be copied and why the signs of a fake are unreliable. This one is about what works instead. When you cannot be sure what you are hearing, you can still rely on what you already know: a number saved long ago, a word agreed at the kitchen table.

Both habits rest on a privacy idea. A scammer builds a convincing call from what is findable about you: your voice in a video, your relatives’ names, who approves payments in your business. A safe word works because it is one piece of information you have deliberately kept out of your digital footprint. A call-back works because the number comes from your own records, not from the message.

Neither habit is about fear. Both give your family and colleagues a calm, agreed way to check, without awkwardness.

What the sources say

The US Federal Trade Commission (FTC), writing about voice cloning in family emergency scams, advises calling the person instead: “Use a phone number you know is theirs.”

The FBI’s Internet Crime Complaint Center, in a public service announcement on generative AI and fraud, gives the second habit: “Create a secret word or phrase with your family to verify their identity.” In the UK, Police Scotland suggests calling the person on their usual number and having “code words to use with loved ones if there’s a real emergency”.

The UK’s National Cyber Security Centre (NCSC) gives the general rule for any message you are unsure of: “Don’t use the numbers or address in the message – use the details from their official website.” The Take Five to Stop Fraud campaign, run by the banking body UK Finance, adds: “Only criminals will try to rush or panic you.”

At work the logic is the same. The Swiss National Cyber Security Centre reports that in CEO fraud, where a criminal poses as a manager to obtain an urgent payment, “scammers are now also using deepfake audio calls and voice messages”. Its answer for payment requests is a call back on “a number you already know”.

B. Key concepts

Four ideas behind the two habits.

Separate channel

Checking a request through a different route from the one it arrived on. A voice message asks for money: you do not reply to it, you call the person’s usual number. An email asks you to change a supplier’s bank details: you phone the supplier.

Why it matters to you: Whoever controls the first channel can keep the act going there. A route you choose is much harder to control.

A number you already know

A contact detail that reached you before the request did: saved in your phone months ago, on the back of your bank card, on an old invoice or the organisation’s official website.

Why it matters to you: Calling the number that has just called you, or the one in the email, can lead you straight back to the scammer. A call-back is only as good as the place the number came from.

Family safe word

A word or short phrase agreed in person by a small group, such as your close family, and used only to confirm identity in an emergency. The National Cybersecurity Alliance, a US non-profit, suggests avoiding “common words, birthdays, or pet names” and sharing it “securely, never online”.

Why it matters to you: It is one thing about your family that no post, profile or recording contains, because it was never put there. A cloned voice can sound right, but a word kept offline is much harder for a scammer to learn.

Urgency and secrecy as the signal

AI-made scams still rely on the oldest pressure: act now, tell no one, pay in a way that is hard to reverse. The FTC notes that scammers ask you to pay “in ways that make it hard to get your money back”, such as wire transfers, cryptocurrency or gift cards.

Why it matters to you: You do not need to spot the fake. You only need to notice the pressure, because that is the moment to use the habits. A genuine caller can wait two minutes while you check.

C. A practical example: Gianni’s Thursday

Gianni is 50 and runs a small business. He approves the payments, and the company website says so, with his photo and direct line.

On Thursday afternoon a call comes from a number he does not recognise. The voice is clearly that of the sales manager at a supplier he has worked with for years. Their bank has changed, she says: could this month’s invoice go to the new account today?

That evening a voice message arrives, apparently from his brother. His phone has broken, he is borrowing a friend’s, and he needs money for an emergency. Please do not tell their mother.

Both requests sounded real. Both came with a reason to hurry and a reason not to check.

What changed the outcome

• Gianni told the caller he would ring back, and hung up. He took the supplier’s number from an invoice in his own files and asked for the sales manager. She had not called him, and the bank had not changed.
• He did not reply to the voice message, but called his brother’s usual number. His brother answered from his sofa: his phone was working perfectly.
• At Sunday lunch, Gianni, his brother and his mother chose a safe word together, said it aloud, and agreed never to write it in a message.
• On Monday he told his staff that any change to a supplier’s bank details would be confirmed by phone, on a number from their own records, and approved by a second person. Checking a request from him was not rude: it was the rule.

None of this needed technical skill: only routes he already had, made ready for next time.

D. Try it yourself: set up a safe word and a call-back list (20 minutes)

Four steps. Steps 1 and 2 you can do alone; steps 3 and 4 can wait until you are with the people you will share the word with.

Step 1 — Write your call-back list (6 minutes)

• List who might urgently ask you for money or information: close family, your bank, your employer, main suppliers.
• Next to each, write a number you already know: saved long ago, from your bank card, an old invoice or the official website. Never copy one from a message you have just received.
• Keep a paper copy at home, in case your phone is lost.

Step 2 — Choose the word (4 minutes)

• Pick something easy to remember under stress and hard to guess from anything about you online: not a pet, a birthday, a street or anything you have posted.
• One approach is two or three unrelated words, such as an object, a colour and a place. Another is a question whose answer has never been posted anywhere.
• Plan a different word for each group, as the National Cybersecurity Alliance advises: “Don’t reuse between groups.”

Step 3 — Share it offline (5 minutes)

• Tell it face to face, or in a call you started yourself to a number on your list.
• Do not send it by text, email or chat, or keep it in shared notes. If you write it down, use paper kept at home.
• If the word may have been overheard, simply choose a new one.

Step 4 — Agree the rule and try it once (5 minutes)

Say the rule out loud, together:

1. Any urgent request for money, codes or personal details by phone, voice message or video: ask for the safe word.
2. Whoever receives the surprising call asks for the word, and the caller says it. Never say it first, never share it in writing online, and never give it to someone who contacts you out of the blue to ask for it.
3. If the word is wrong, or the caller avoids the question: hang up and call back on a number from your list.
4. Checking is never an insult.

Then practise once: one person calls another with a pretend urgent request, and the person receiving it asks for the word. The National Cybersecurity Alliance suggests testing it regularly, so it is not forgotten.

The Offline Defence course goes deeper into the physical side of these habits, such as confirming who someone is in person.

E. Videos, articles and further resources

Institutional sources first, then UK fraud prevention guidance and a safe word guide.

Institutional sources

FTC (US) — Scammers use AI to enhance their family emergency schemes
Why a familiar voice is not proof, and how to verify on a number you know.
https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes

FBI Internet Crime Complaint Center (US) — Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
How AI-made audio, images and video are used in fraud, with seven tips including a family secret word.
https://www.ic3.gov/PSA/2024/PSA241203

NCSC (UK) — How to spot a scam email, text message or call
Contact the organisation directly, using details from its official website rather than the message.
https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams

Police Scotland — Voice cloning scams
What voice cloning is, with practical steps: the usual number, code words, protecting your voice.
https://www.scotland.police.uk/advice/scams-and-frauds/voice-cloning-scams/

Swiss National Cyber Security Centre — Week 4: “Urgent money transfer” – CEO fraud remains a persistent threat to SMEs
How fake-manager payment requests work, including deepfake calls, and four safeguards for small organisations.
https://www.bacs.admin.ch/en/26w4-en

Fraud prevention guidance

UK Finance — Take Five to Stop Fraud
The Stop, Challenge, Protect approach, and where to report fraud in the UK.
https://www.takefive-stopfraud.org.uk/

Get Safe Online — Mandate fraud
How criminals pose as suppliers to divert payments, and why changes should be checked using established contact details.
https://www.getsafeonline.org/business/articles/mandate-fraud

Setting up a safe word

National Cybersecurity Alliance — Safe Word
A short guide to choosing, sharing, keeping and using a safe word.
https://www.staysafeonline.org/campaigns/safeword

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Secure Behaviour pillar at level FL2 – Beginner: two habits, agreed in advance and used without hesitation.

Skills

• Building a call-back list from contact details you already trust.
• Choosing a safe word that is hard to guess and has never been posted anywhere.
• Verifying a request through a separate channel, at home and at work.

Awareness

• Recognising that a familiar voice or face is no longer proof of identity on its own.
• Understanding that scams are built from findable information, and that a safe word works because it is kept out of it.
• Treating urgency and secrecy as the moment to check, not a reason to hurry.

Secure Behaviour

• Hanging up and calling back on a number from your own records.
• Asking for the safe word when a call surprises you, never saying it first, and never giving it to someone who contacts you out of the blue.
• Confirming any change of bank details by phone, with a second person approving.

G. Questions to sit with

• If a voice you love asked you for money tonight, which number would you call, and where did it come from?
• What could someone learn about your family, or your business, from what is already public?
• Who would you most like to agree a safe word with, and when will you next see them?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Checking before you act

• R16 — Treat emails pretending to be your bank as a reason to verify, not to act: go in through the official app, a saved bookmark or an address you type yourself. The page also covers the call from a fake bank adviser that can follow such a message: never call a number given in the message; use the one on the back of your card.

At work, the Swiss National Cyber Security Centre recommends a second person’s approval for changes to a supplier’s bank details, and adds that “healthy scepticism should be recognised as a strength in organisational culture, not as disobedience.”

Minimum commitment: write your call-back list today, with at least your closest family member and your bank, and keep a copy on paper.

2. When your name is the one being used

• R29 — Take seriously a warning about messages sent in your name: check your account’s sessions and linked devices, close any access you do not recognise, and tell your contacts what to ignore.

Minimum commitment: agree a family safe word in person with at least one person this week.

If money or bank details are involved, contact your bank straight away on the number on the back of your card. In the UK, Take Five lists reportfraud.police.uk and 0300 123 2040 for reporting fraud to the police.

In short

• A familiar voice is no longer proof of identity. Do not judge it: check the request.
• Use a separate channel: hang up and call back on a number you already know, never one from the message.
• A family safe word works because it is kept offline. Choose it together, share it in person, ask for it when a request is urgent, and never say it first.
• At work, confirm any change of bank details on a number you already know, with a second approver.

Related resources in this course

• Voice Cloning Scams: How Deepfakes Use What You Post
• Spear Phishing: Why Scam Messages Know So Much About You
• Spam Calls: How Your Number Spreads and How to Cut Them
• Oversharing Online: What Your Last Ten Posts Really Say

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.