YOUR FAMILYYOUR DEFENCE.

Your family needs an agreed way to verify urgent requests before somebody imitates one of you. A criminal might pose as a child in trouble, a parent needing help, a police officer, a bank employee or an employer. They may use a familiar phone number, copied profile picture, an AI-cloned voice or an edited video. The fraud can feel personal because the attacker has learned enough details to make the story plausible.

By 2026, this threat is no longer hypothetical. The UK's City of London Police intelligence assessment discusses fraudsters using AI-generated video, cloned voices and manipulated images. The Report Fraud service warns specifically about AI voice cloning in phone scams. In the United States, the FTC recommends independently calling the purported relative rather than trusting a familiar voice.

Most families know that scams exist. Far fewer have decided who calls whom, what happens if the person cannot answer, and whether a money request can ever be approved during an incoming call. This article turns awareness into a small working system the household can practise.

What is an AI impersonation scam?

Impersonation fraud occurs when an attacker pretends to be someone else to obtain money, information, access or compliance. AI can help produce plausible text, voice and video, but the harmful decision generally comes from believing an identity claim without independent verification.

Not every impersonator uses AI. A spoofed caller ID, compromised messaging account or convincing human actor may create the same problem. Your family plan should therefore work even when nobody can tell how the scam was produced.

The central rule is simple: no high-stakes request is approved solely on the channel that delivered the request. “High-stakes” means money, banking details, authentication codes, access to devices, sensitive documents, unexpected travel, or instructions to keep a supposed emergency secret.

The four impersonation routes your family should expect

These routes can be combined. A fraudulent text may be followed by a familiar-sounding voice message, then a call from someone claiming to be a lawyer or investigator. The second contact does not necessarily make the first story genuine if it comes from the same attacker.

Build a three-contact verification chain

For each close relative, identify three ways to establish a genuine connection before an emergency: their ordinary number, a second trusted contact who knows their whereabouts and an alternative verified channel or institution where appropriate.

For example, a couple might each know the other's primary number, a sibling or friend who could check on them, and the main number of their workplace or accommodation when travelling. A family with children might include school contacts and the adults authorised to collect a child. Avoid gathering unnecessary private details; keep the information proportionate and protect the list.

A name and number saved inside the suspicious message do not count as an independent contact. Neither does a website link provided by the supposed official. The verifying person must be reached using contact information the family had before the incident or obtains directly from a trustworthy source.

Agree the household's non-negotiable payment rule

Unexpected demands for money are especially dangerous because a transfer can be difficult to recover. Agree the rule in advance so nobody has to debate it with a frightening voice on the phone:

No unplanned transfer, gift card, cryptocurrency payment, change to payee details or release of a one-time code is authorised until the underlying identity and need are checked independently.

That does not prevent you from helping a relative in a genuine emergency. It means help begins with confirming what happened. Somebody who is genuinely injured or stranded does not gain safety from you sending a bank transfer to an unknown account before checking the claim.

The UK Take Five campaign advises people to stop, challenge suspicious requests and protect themselves by contacting their bank immediately if a payment is involved. The US FTC also highlights pressure to pay by a particular hard-to-recover method as a common scam sign.

Should your family use a code word?

Yes, a private phrase can be one useful part of the plan, and UK Report Fraud recommends a safe phrase. But use it sensibly.

Agree a phrase in person or through a secure, trusted conversation. Do not include it on public social-media profiles or in an easily shared screenshot. Avoid something that can be guessed from your birthday, pet's name or favourite football team. Make sure the people who need it can remember or securely access it.

Then treat the phrase as an additional check, not an automatic payment authorisation. If someone knows the phrase but asks you to transfer money to a new account or disclose a one-time code, verify through a second independent channel anyway. The phrase might have been leaked or overheard.

If a family member forgets the phrase during a real emergency, that does not prove they are a criminal. Contact an independent verifier or relevant emergency service instead. A good family system allows for stress, illness and technical difficulties.

Who should be responsible for checking an emergency?

Decide this before the phone rings. The person receiving the suspicious contact should not have to manage every task alone. A small family can assign simple roles:

• Receiver: ends the incoming conversation and records only what was claimed, without making a payment.
• Verifier: calls the supposed relative or another trusted contact using saved details.
• Support person: helps a distressed or less digitally confident family member and can contact an institution or emergency service when appropriate.
• Financial contact: knows how to reach the bank promptly if money or account details have already been exposed.

One person can hold several roles. The aim is to make the next action clear, not create bureaucracy. A household of two may simply agree that they will always check an urgent request with each other before authorising money.

How to protect older relatives without taking away independence

A defensive family plan works only if every participant feels respected and is willing to use it. Avoid implying that older people cannot make decisions. People of any age can be persuaded by a convincing message, especially one involving a loved one's safety.

Have a direct conversation about why modern impersonation is difficult to detect. Then practise one short response: “I need to check this. I'll ring you back.” Make that an ordinary rule the whole family follows, not a test imposed only on grandparents.

Put the most important numbers on an easy-to-find card if that helps. Avoid storing passwords or private security answers alongside the card. Ask whether the person prefers a phone call, printed list or help from a specific trusted contact. Consider hearing difficulties, language needs and accessibility when designing the plan.

If you have concerns about financial exploitation, support the person in contacting their bank about available account alerts or protective measures. Do not secretly seize account access; seek appropriate advice and consent.

What if an impersonator uses a genuine WhatsApp account?

A message from a familiar profile can be fraudulent if an account has been compromised. Social-media photos and existing conversations are not sufficient identity proof for an unusual request. A scammer may write in a plausible style because they can see previous messages or public posts.

If the message requests money or a verification code, switch to another established contact method. A separate saved phone number is more useful than sending a reply to the same chat. If the person confirms their account has been taken over, warn relevant contacts through secure channels and follow the service's recovery process.

For recognising suspicious links and account-reset traps, read AI Phishing: How to Check an Email or Message. For the first actions after suspected account exposure, use What to Do After a Data Breach.

Three realistic family scenarios to rehearse

These examples are fictional exercises. They can be read aloud without making real emergency calls or transferring any money.

Scenario A: “Mum, I've been arrested”

A late-night call sounds like an adult child. A supposed solicitor takes the phone and demands an urgent payment. The child's ordinary phone is unanswered. The receiver refuses to pay, calls the child's partner and seeks to verify the alleged incident through an independently located official route. The scenario ends when the independent contact confirms the person is safe.

What you practise: not interpreting an unanswered callback as proof the original caller was genuine.

Scenario B: “We've changed our bank details”

A familiar-looking message claims a family member's rent or care payment must go to a new account today. The sender knows the usual payment amount and due date. The receiver checks through the existing provider's verified contact route before changing anything.

What you practise: checking the actual transaction instructions, not just whether the sender appears familiar.

Scenario C: “It's me, send this code”

A message from a known account asks for a six-digit code that has just arrived on your phone. The explanation is that the person is recovering access to their own account. The receiver refuses to share the code and contacts the person separately.

What you practise: recognising that authentication codes are security credentials, not harmless proof of friendship.

A printable five-line family verification card

You can write the following instructions on a small card and keep it with your household contact list. Replace the blanks with your own appropriate contact details; do not publish private information online.

The useful part is not the printed card itself. It is that every person has rehearsed what it means. A short card somebody actually uses is more protective than a sophisticated plan nobody remembers.

If a family member has already been deceived

Respond to the practical risk first. If money was sent, contact the bank immediately through a verified route and ask about recovery. If passwords, verification codes or documents were shared, follow the appropriate account-protection steps from a trusted device. Preserve dates, call records, messages and payment details without circulating them more widely than necessary.

Do not allow shame or arguments to delay the response. The criminal has deliberately used fear and apparent trust to influence the victim. Useful questions are “What was shared?”, “Where did the money go?” and “Which account needs securing?” rather than “How could you believe it?”.

In England, Wales and Northern Ireland, Report Fraud is the police reporting route; Scotland uses Police Scotland. The service replaced Action Fraud in December 2025. The FTC's family-emergency scam guidance covers the US approach. If a real person is in immediate danger, contact emergency services directly.

How to review your family defence plan every three months

A contact list becomes less useful if phone numbers change or a child moves away. Set a short review every few months and after major changes such as a house move, overseas travel or an important change in care arrangements.

1. Confirm the primary and backup contact details still work.
2. Ask whether anybody has received a suspicious message they want to discuss.
3. Rehearse one short scenario, with the person who received the last scam taking the verifier role.
4. Check whether bank alerts and account protection remain appropriate.
5. Refresh the private verification phrase if you believe it has become widely known.
6. Make sure every family member—including anyone with limited internet access—knows the basic rule.

The routine should take minutes, not become a major household project.

The bottom line

AI impersonation makes familiar voices, faces and written messages less reliable as proof. The defence is not trying to outsmart every technology used by a criminal. It is agreeing, ahead of time, that consequential requests must survive independent checks.

A trusted contact chain, a clear money rule and one short practice conversation can turn a frightening call into a manageable verification problem. Make those arrangements while everyone is calm.

Frequently asked questions

How do I protect my family from AI impersonation scams?

Agree a rule against approving unexpected money or access requests on the incoming channel, save independent verification contacts and practise the procedure together.

Is a family code word a good idea?

It can provide an additional check, but should not replace a callback to a known number or independent confirmation. Code words can be leaked or forgotten.

Can scammers use a relative's real messaging account?

Yes, if an account is compromised. A familiar profile or conversation history is not sufficient proof of a new money or authentication request.

What if the person cannot answer a verification call?

Try another established method, a trusted relative or the relevant institution using independently sourced details. Do not treat silence as proof that the suspicious caller is authentic.

Who should I contact if money has been sent?

Contact the bank or payment provider immediately. In the UK use Report Fraud where applicable, and in the US use the FTC and appropriate law-enforcement route.

Sources and further reading

• Report Fraud — Vishing and AI Voice-Cloning Fraud.
• City of London Police — AI-Enabled Fraud Intelligence Assessment (2026).
• FTC — Scammers Use AI to Enhance Family Emergency Schemes.
• Take Five to Stop Fraud — Protect Yourself.
• Report Fraud — Reporting Cybercrime and Fraud.

Research reviewed 6 November 2026. Scenarios are fictional. Identity checks are layered safeguards, not guarantees against fraud.