A Familiar Voice, a Strange Request: The Family Password Plan for UK Voice-Cloning Scams

It starts with a call that sounds like your mum, your son or your partner. The voice is panicked. There has been an accident, a arrest, a lost bag, a payment that must go through now. They say not to tell anyone. They give a new number or a bank account. And because the voice is familiar, your brain wants to believe it before your common sense has caught up.

That is the trick. Voice cloning is no longer science fiction. A short clip from social media, a voicemail or a video is often enough for a fraudster to produce a convincing imitation. Banks and police consistently warn that urgency, secrecy and unusual payment methods are the red flags — but a cloned voice can make all three feel real.

Why it works

Humans are wired to trust familiar voices. We recognise tone, rhythm and accent before we analyse the words. Fraudsters exploit that gap. They create panic, keep you on the line and move you towards a payment before you have time to check. Caller ID can be spoofed, so a familiar name on the screen proves very little. A good clone may have no obvious tells at all.

Red flags worth naming

Be wary of any call that combines urgency with secrecy: ‘don’t tell Mum’, ‘don’t call the police yet’, ‘just send it and I’ll explain later’. Watch for requests to move money to a new account, buy gift cards, use crypto, hand cash to a courier or share a one-time passcode. A request to stay on the line while you ring the bank is another warning sign. And if the caller cannot answer a simple question that your real relative would know, slow down.

The family password protocol

Agree a family password before you need it. Choose two or three words that are not on social media, not in an email signature and not obvious from family history. ‘Fluffy’ is a bad password. A random phrase — ‘blue kettle window’ — is better. Write it down somewhere offline for older relatives, and make sure everyone in the family knows the rule.

The rule is simple: if someone calls claiming to be family and asks for money or sensitive information, ask for the password. If they cannot give it, hang up and call the person back on the number you already have saved. Never text the password. Never leave it on voicemail. If it has been shared by mistake, change it. For children, use a shorter code word and practise it. For an elderly parent, put a one-page plan by the phone: password, callback rule, bank number and Action Fraud number.

First ten minutes after a suspicious call

1. Stop talking. Do not send money, share codes or allow remote access to a device.
2. Hang up. Do not use the number that called you. Call your relative on their saved number, or through a trusted app.
3. If they do not answer, call another family member, neighbour or friend who can check on them.
4. If money has gone, call your bank immediately using the number on your card or website, or ring 159. Ask about recalling the payment and securing the account.
5. If you shared a one-time passcode or remote access, call the bank and change your passwords from a different device.
6. If you feel threatened or someone is at risk, call 999. For non-emergencies, use 101.

How to report it

Report the scam to Action Fraud online or on 0300 123 2040, even if you lost nothing. Reports build the intelligence picture. Tell your bank immediately if money or account details are involved. Keep the caller’s number, any messages, timestamps and bank references. If the call was on a mobile, tell your provider about nuisance calls. The Take Five campaign’s advice still holds: stop, challenge, protect.

A family password will not stop every scam. But it gives you a pause — and a pause is often enough to turn a frightening call into a story you can report rather than a loss you cannot undo.