A request to move money or grant access used to be safe the moment you recognized the voice on the phone or the face on the screen. That is quietly no longer true. With a few seconds of public audio or video, a familiar voice can be cloned and a trusted face reproduced on a live call. The fraud that follows does not look like fraud. It looks like your son, your assistant, or your advisor, asking for something reasonable, with a good reason to hurry.
The defense is not a sharper ear or a more careful eye, because the fakes are already good enough to pass both. It is a small set of habits, agreed in advance, that an impersonator has no way to satisfy. This is the protocol we establish for every household we work with, and you are welcome to adopt it on your own.
Why recognizing the voice is no longer enough
A convincing clone needs very little to work: a podcast clip, a voicemail greeting, a few seconds of a published talk. Once it exists, the attacker does not need to defeat you with technology. They use it to deliver an ordinary request, money, access, an urgent favor, in a voice you trust. The weakness is not your hearing. It is the assumption that a familiar voice has already been verified. So the protocol stops verifying by recognition and starts verifying by a step the impersonator cannot reproduce.
1. A family verification phrase
Choose a private word or phrase known only to the family. Use it to confirm identity on any unexpected request that involves money, access, or an emergency. If someone calls or writes asking you to act and cannot give the phrase, you do not act. A cloned voice will sound exactly right. It will not know your word. Keep the phrase off your devices and out of email, and change it if it is ever spoken where it could be overheard or recorded.
2. A duress phrase
Agree on a second, different phrase that means one thing: I am being forced to do this. It lets a family member who is being coerced, in person or on a call, comply on the surface while quietly signaling that something is wrong. The person on the other end of the line will not know it has been used. Most families never need it. The ones who do are very glad it exists.
3. The out-of-band rule
Any request to move money or change account or access details is confirmed on a second channel, agreed in advance, and never on the channel the request arrived on. If a call asks you to send a wire, confirm by a message or a callback to a number you already trust. If an email gives new payment details, confirm by voice with a person you know. The request and its confirmation should travel by two separate paths. This single habit defeats both classic wire fraud at a closing and the newer deepfake version of it.
When to use it
Apply the protocol whenever a request carries any of these signals, because they are the conditions impersonation depends on:
- an urgent request to move money, or to send a wire, gift card, or cryptocurrency;
- a change to payment instructions, account numbers, or login details;
- an emergency or travel crisis, a relative who is suddenly in trouble and needs funds;
- a request to grant access, reset a password, or approve a new device;
- pressure to act immediately, or to keep the request quiet.
Urgency and secrecy are not signs that something is important. They are the most common signs of fraud.
How to put it in place
The hard part is not understanding the protocol. It is choosing the phrases, distributing them to the right people, setting the out-of-band rule across the accounts and family members that matter, and rehearsing it until it is routine. That is part of every Private Cybersecurity Engagement, and the result is recorded in the household's plan so it endures across staff changes and the years.
If you would like the one-page version to keep or share with your family and advisors, you can download it as a PDF. And if you would like help establishing it for your own household, you are welcome to request a private consultation.