With one in four Americans reporting that they’ve received a deepfake phone call in the past year, cybersecurity experts are urging families to set up a “safe word” to avoid being scammed.

Impersonation scams are nothing new. Criminals have long posed as relatives, colleagues, or authority figures to pressure victims into sending them their money. What changed is the technology, raising serious security concerns as AI fraud exploded into the mainstream.

A quarter of Americans now say they have received a deepfake phone call over the past 12 months, according to new research from Hiya, a cybersecurity firm that surveyed 12,000 consumers in the US, the UK, Canada, France, Germany, and Spain.

Americans reported receiving almost ten deepfake calls per week on average, suggesting that AI-powered impersonation scams are no longer rare or isolated. Furthermore, 24% said they are unsure if they can reliably distinguish between a real person and a machine on the phone.

The findings confirm warnings that advances in voice cloning and automation are making impersonation attacks more convincing, scalable, and harder to detect.

Seniors are particularly vulnerable, losing an average of $1,298 on scams, or three times more than younger adults. Generative AI could enable fraud losses of up to $40 billion by 2027 in the US alone, according to Deloitte’s Center for Financial Services.

“We cannot expect everyday people to outsmart artificial intelligence on their own,” according to Alex Algard, chief executive and founder of Hiya, which offers AI-powered solutions to fight AI-powered scams at the network level.

However, some cybersecurity experts also suggest a surprisingly simple solution to this high-tech threat – a family safe word.

If you hang up, scammers lose

Gabriel Friedlander, founder of Boston-based cybersecurity awareness firm Wizer, says families should use a specific word, phrase, or question to verify the identity of a loved one if a call seems suspicious.

According to Friedlander, even a child asking for a Netflix code should be able to verify themselves to their parents. It may sound trivial, but the practice builds awareness that could help prevent falling for scams in situations where much more is at stake.

“It all starts with awareness. We have to talk about it,” Friedlander says.

Deepfake calls share many of the same red flags as the age-old impersonation scams – victims are often told that a loved one has been injured, kidnapped, or urgently needs money. The goal is to create panic and force quick decisions before the victim has time to think.

The difference is that AI tools are available to anyone, and the voice on the other side of the line may sound much more familiar.

Voice samples for these scams can be collected from almost anywhere, including social media, old recordings, or even robocalls designed specifically to capture speech. Attackers can then clone a voice and deploy AI agents to run their schemes at scale, from initial contact to real-time conversations.

“Now I can have a full conversation using someone’s voice. The scams are getting sophisticated,” Friedlander says.

“The barrier to entry is so low – and the profits are skyrocketing.”

He adds that the rise of AI in both offense and defense means threat actors and defenders are often using “almost the same AI tools,” which risks levelling the playing field. This makes a family safe word system a simple yet effective way to slow down attackers.

“Time kills deals, time kills scams. If I hang up… They're going to lose their scam,” Friedlander says.

“Unlearning trust”

A family safe word can be an effective safeguard, but it’s not a silver bullet and should be seen as just one layer of protection.

Cybersecurity experts also advise trying to verify the caller’s identity through another channel, such as messaging them on a different platform or calling them back on their known number.

David E. Williams, chief executive of cybersecurity company Atumcell in Boston, says that a family safe word “works in theory,” but warns that an experienced scammer can figure it out or pretend to be under so much distress they can’t remember it.

Calling back could also prove tricky if the caller’s number is not a known family number. It’s important to look it up online because scammers can rig up the call back number and attach the scam bot to it, according to Williams.

“The main remaining practical approach is awareness. These calls almost always have some time pressure associated with them, and they want you to pay right away. That's a red flag telling you to slow down or stop,” Williams says.

“Sadly, all of these approaches require unlearning trust."

Unlock more exclusive Cybernews content on YouTube.