I was recently at a security conference attending a presentation on AI risks. The presenter was running it as an open discussion rather than a straight lecture — throwing out topics and inviting the room to engage. When the subject turned to AI voice cloning scams, he asked the group: what would you actually do about this?
Imagine getting a call from your teenage daughter’s number. You hear her sobbing. Says she’s been in an accident, she’s scared, she needs you to wire money right now. The voice sounds exactly like her. Because it is her voice — just not her making the call. It was cloned from a few seconds of audio scraped off social media. It’s a computer. And it’s very convincing.
The room got quiet. This one seemed to hit home. A thought occurred to me–something I learned years ago when I was in the Army: the challenge password. I said to the room, “Who’s ever heard of a challenge-and-response used in the military?”
A challenge password in a military context is a pre‑arranged word or phrase used to quickly verify whether someone is friend or foe, especially in low‑visibility or high‑risk situations. One person issues the challenge, and the other must respond with the correct password; a wrong or missing response signals a potential threat and triggers heightened security action.
This concept shows up memorably in Saving Private Ryan. During the chaos of the Normandy invasion, there is a scene where soliders are advancing through a French town. They approach a building that is occupied by other Americans, and use a challenge-and-response system to identify each other in the dense urban setting — one soldier calls out “Thunder,” and the correct reply is “Flash.” Interestingly, the movie actually has the order reversed from the historical record: the real D-Day challenge was “Flash,” with “Thunder” as the countersign. But the idea is the same. Without it, you had no way to tell friend from foe in the confusion of battle.
The 101st Airborne took it a step further. Their paratroopers dropped behind enemy lines carrying small brass devices called crickets, made by a Birmingham, England company called ACME. One click was a challenge; two clicks was the response. This had the benefit of not using words that could eventually be deciphered by German soliders within earshot. A tiny metal toy became a life‑or‑death authentication system in the dense, hedgerow‑choked countryside of Normandy, where visibility was measured in feet and friendly forces were scattered in the dark. The crickets were intentionally discarded after D-Day, fearing the Germans would capture one and use it against Allied troops — which is why original examples are nearly impossible to find today.
The room liked that answer. Your family needs a cricket. Or more precisely, your family needs a challenge and response password.
The Scam You Need to Know About
Here’s how these attacks typically work:
A scammer calls you — or one of your family members — and plays a cloned audio clip of a loved one’s voice. It sounds panicked. Distressed. Real. The “voice” says they’ve been in a car accident, they’re in jail, they’re in danger. They need money right now. They beg you not to tell anyone else, to keep it quiet.
Then a second person gets on the line — posing as a lawyer, a bail bondsman, a police officer, a good samaritan — and walks you through how to send the money.
The voice clone is built from as little as a few seconds of audio scraped from social media, YouTube, TikTok, or voicemails. Tools to do this have become cheap and accessible. The FBI has received thousands of complaints about these attacks, and the numbers keep climbing.
The scam works because it exploits something primal: the sound of someone you love in distress. Your brain short-circuits. You don’t think; you react.
That’s exactly why the countermeasure has to be set up before you’re in that state.
Your Family Needs a Challenge Word
The fix is simple, low-tech, and borrowed from 80-year-old military doctrine.
Pick a word — or better, a word pair — that every member of your family knows. Something random enough that a scammer wouldn’t stumble onto it. Not your dog’s name. Not your street. Think more along the lines of: pineapple / umbrella. Or thunder / flash, if you want to pay homage to the paratroopers.
The rule is this: if you ever get a call from a family member claiming to be in trouble and asking for money or urgent action, you ask for the challenge word before you do anything. If they can’t produce it — even if the voice sounds exactly like the family member — you hang up and call them directly on the number you already have for them.
Set it up this way:
- Agree on the words at a calm, normal moment. Don’t wait until something feels suspicious. Discuss it over dinner or at a family get together.
- Tell every member of the family — including older relatives who are especially targeted by these scams.
- Write it down somewhere safe at home, not in your phone’s notes app where it could be compromised.
- Agree that no one will be offended if asked for the word — not even in a situation that sounds real. Especially then.
- Change it periodically, just like a password.
What About the Pressure?
Scammers are good at creating urgency. “There’s no time.” “Don’t hang up.” “If you call anyone else, it makes things worse.”
That pressure is the tell. Legitimate emergencies — real ones involving your real family members — will survive a 60-second pause while you call them back; or a verification of the pre-established family password (or word pair). A scammer depends on you not taking that extra few moments.
If someone is pushing you hard not to verify, that’s your signal to slow down, not speed up.
The Bottom Line
AI voice cloning has made the “family emergency” scam genuinely terrifying. The voice on the other end of the line may be indistinguishable from your child, your parent, your spouse. Technology has removed the most reliable signal you had.
But a simple shared secret — your family’s version of Thunder / Flash — restores it. The scammer can clone the voice. They can’t clone the word only your family knows.
Set it up this week. Have the conversation at dinner. It takes five minutes and could save your family thousands of dollars and a lot of heartbreak.
Your family needs a cricket. Pick one.
If you found this useful, share it with an older relative — they’re targeted most often and have the most to lose.