A mother in California picked up her phone last spring and heard her daughter's voice, panicked, saying she had been kidnapped and needed money sent right away.1
The voice had the right pitch and the right tone, even the small verbal habits her daughter uses when she's upset. She wired $5,400 before learning her daughter was safe the entire time. What she'd heard on the phone wasn't her daughter. It was an artificial recreation of her voice, built from a few seconds of audio pulled from somewhere online.
Stories like this used to sound like science fiction. They don't anymore. Voice cloning has become one of the fastest-growing tools in a scammer's kit, and it's built to exploit something every family takes for granted: the ability to recognize each other by sound alone.
October is Cybersecurity Awareness Month, which has been observed every year since it was created in 2004.2
Most of what gets shared during the month is standard guidance on updating your software, using a stronger password, and watching for phishing emails. This year, the more urgent conversation has nothing to do with software. It has to do with the fact that a stranger with a laptop can now borrow your voice, or your child's, perhaps well enough to fool the people who love you most.
How Fast Is This Threat Actually Growing?
Fast enough that the projections keep getting revised.
Deloitte's Center for Financial Services projects that generative AI-enabled fraud could cost Americans as much as $40 billion a year by 2027, up from $12.3 billion in 2023, a 32 percent annual growth rate.3
Voice cloning is one of the fastest moving pieces of that trend, but it's no longer the only tactic families need to recognize.
One of the newest variants is what the FBI calls virtual kidnapping. Scammers contact a family by text or phone, claiming to have kidnapped a loved one. As proof, they send an altered photo or video, often edited from images the family already posted online, timed so there's no room to think clearly enough to check whether any of it is true.4 The FBI issued a fresh warning on this exact tactic in December 2025, noting that scammers now send these images through timed, disappearing messages so victims have less time to notice small inconsistencies, such as a missing tattoo or an odd proportion, that would otherwise give the fake away.4
The scam has also moved beyond audio entirely. In one instance, a finance employee at a global engineering firm joined what looked like a routine video call with his chief financial officer and several colleagues and was instructed to wire funds for a confidential transaction. Every person on that call was a deepfake. He sent $25 million across 15 transfers before anyone realized that none of the people he had seen or heard were real.3
None of this means every call or video should be treated as fake. It means the old test, “Does this sound and look like someone I know?” may no longer work on its own. We're raising it now, during Cybersecurity Awareness Month, because a family that's had this conversation in advance might handle the voice-cloned call better than a family hearing about the risk for the first time.
What Does an AI Voice Scam Actually Sound Like?
It sounds exactly like the person it's imitating. That's the entire point.
Researchers at McAfee tested this directly. In a recent global study of roughly 7,000 people, their team found that just three seconds of audio, about the length of a typical voicemail greeting or a clip pulled from a social media video, was enough to produce a voice clone with an 85 percent match to the original speaker.5 One in four people surveyed said they had personally experienced an AI voice scam call or knew someone who had. Roughly seven in ten said they weren't confident they could tell a cloned voice from the real thing.5
That three-second threshold is what makes this personal. Some of us may have already handed scammers what they'd need without realizing it: a birthday toast posted online, a voicemail greeting, a video from a graduation or a wedding. Any of it can become raw material.
How Big Has This Problem Gotten?
Big enough that federal agencies now track it as its own category of fraud.
The FBI tied 22,364 complaints and roughly $893 million in losses to schemes involving artificial intelligence in 2025, and voice cloning was one of the fastest-growing tactics behind that number.6
Of that total, about $352 million was reported by adults age 60 and older.7
The broader elder fraud picture is even starker. In 2025, people age 60 and older filed 201,266 fraud complaints with the FBI's Internet Crime Complaint Center, a 37 percent jump from the previous year. Total reported losses reached $7.7 billion, up 59 percent over the same period.8
More than 12,400 of those victims lost more than $100,000 each, and the average reported loss across elder fraud victims that year was $38,500.8
The Federal Trade Commission's numbers tell the same story from a different angle. Imposter scams, someone pretending to be a family member, a bank, or a government agency, are the most reported type of fraud and caused $3.5 billion in reported losses in 2025.9
Reports from older adults losing $10,000 or more to these scams have climbed more than fourfold since 2020. Losses of $100,000 or more among seniors jumped from $55 million in 2020 to $445 million in 2024.10
Why Are Families Such an Easy Target?
Because the entire scam is built around urgency, and urgency works against us.
The more frightened and rushed a request sounds, the less our instinct is to verify it and the more it is to act. A calm request invites questions. A panicked voice claiming an emergency shuts that instinct down before we've had a chance to think it through.
Add to that how much of our lives we now put online voluntarily. The audio scammers use rarely comes from anywhere sinister. It comes from a proud parent's video of a graduation speech, a voicemail saved in the cloud, or a clip recorded for a family group chat.
What Is a Family Password, and How Does It Work?
Some cyber professionals recommend the same simple fix: agree on a private code word or a specific verification question with the people you'd most likely get one of these calls from, and use it any time a request for money sounds even slightly off.11,12
The idea is straightforward. A cloned voice can sound exactly like your child, your spouse, or your parent. It cannot know a detail the two of you agreed on privately and never posted anywhere. The guidance suggests something as simple as asking, “What breed is the family dog?” or “Where do you and your spouse vacation during the holidays?” as examples.12
The word or question matters less than the fact that it was never said out loud over the phone, never texted, and never shared anywhere a scammer could find it.
A few rules make this work. Choose the word or question together, in person, not over the phone or by text. Don't save it anywhere digital where it could be found. Change it if you ever suspect it's been compromised. And treat "they didn't know it" as a hard stop, not a suggestion, even if the voice on the other end is crying and begging you to hurry.
What Should You Do If You Get One of These Calls?
Hang up. Then call the person back directly, using a number you already have saved for them, not a callback number the caller provides.11 In the time it takes to make that second call, some of these scams fall apart, because the person supposedly in danger often answers their own phone.
If you can't reach them right away, call another family member who might know where they actually are before sending any money. The FBI encourages people not to wire funds or send cryptocurrency based on a phone call alone, no matter how convincing it sounds, and to treat any request to pay with gift cards as an automatic red flag. If you do send money before realizing what happened, report it to the FTC and to the FBI's Internet Crime Complaint Center as quickly as possible. Reporting matters even after the money is gone. Both agencies use these reports to track new scam variations and warn other families faster.
This is exactly the kind of decision we'd rather talk through with you before it happens, not after. If your family hasn't discussed what you'd do if a call like this came in, it's worth ten minutes at your next gathering, well before anyone actually needs it.
Frequently Asked Questions
How Can a Scammer Clone Someone's Voice With So Little Audio?
Modern voice cloning tools only need a few seconds of clear audio to build a working model of someone's voice. McAfee's research found that three seconds was enough to produce an 85 percent match and that audio can come from something as public as a social media video or a saved voicemail.5
Are These Scams Only Targeting Older Adults?
No, but older adults report the highest losses. Adults 60 and older accounted for roughly $352 million of the $893 million in AI-related fraud losses the FBI tracked in 2025.6,7
Younger family members are targeted too, often through calls claiming a sibling or friend is in trouble.
What Is a Virtual Kidnapping Scam?
It's a version of this scam where criminals claim to be holding a family member for ransom and back it up with a doctored photo or video, often pulled from images the family already posted online. The FBI issued a new warning about this tactic in December 2025 after seeing scammers send the fake proof of life through messages that disappear after a set time, making it harder for a frightened family to spot the fake.4
Does a Family Password Need to Be Complicated?
No. It works best when it's simple enough to remember under stress and specific enough that it was never shared publicly. A short phrase or a private detail works better than something elaborate.
What If We Don't Have a Code Word and Get a Call Like This?
Hang up and call the person back on a number you already have saved.
Should We Report It Even If We Didn't Lose Money?
Yes. Reporting attempted scams to the FTC or the FBI's IC3 helps investigators track new tactics, and it may help other families in the future.
Sources:
1. Moneywise.com, June 5, 2026.
moneywise.com/news/top-stories/fbi-ai-deepfake-voice-cloning-scams-losses
2. Cybersecurity and Infrastructure Security Agency, 2026.
cisa.gov/cybersecurity-awareness-month
3. Deloitte Center for Financial Services, 2026.
deloitte.com/us/en/insights/industry/financial-services/deepfake-banking-fraud-risk-on-the-rise.html
4. Federal Bureau of Investigation, 2026.
fbi.gov/investigate/cyber/alerts/2025/criminals-using-altered-proof-of-life-media-to-extort-victims-in-virtual-kidnapping-for-ransom-scams
5. McAfee.com, 2026.
mcafee.com/blogs/privacy-identity-protection/artificial-imposters-cybercriminals-turn-to-ai-voice-cloning-for-a-new-breed-of-scam
6. Federal Bureau of Investigation, April 6, 2026.
fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions
7. Fox News, June 11, 2026.
foxnews.com/tech/grandparents-identity-thefts-biggest-payday
8. Federal Bureau of Investigation, 2026.
https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
9. Federal Trade Commission, June 15, 2026.
ftc.gov/news-events/news/press-releases/2026/06/ftc-data-show-people-reported-losing-3-point-5-billion-imposter-scams-2025
10. Federal Trade Commission, Imposter Data Spotlight, August 2025.
ftc.gov/system/files/ftc_gov/pdf/Imposter-Data-Spotlight-August-2025.pdf
11. Federal Bureau of Investigation, May 15, 2026.
fbi.gov/news/stories/scammers-target-older-adult-victims
12. Federal Trade Commission, 2026.
consumer.ftc.gov/all-scams/family-emergency-scams
Important Disclosures
This material is provided by True Private Wealth Advisors, LLC (“TPWA” or the “Firm”) for informational and educational purposes only. It does not constitute investment, tax, or legal advice, nor an offer or solicitation to buy or sell any security. Certain statistics and third-party findings referenced herein are derived from sources the Firm believes to be reliable and are attributed to their respective sources; however, the Firm makes no representations as to their accuracy, timeliness, or completeness, has not independently verified them, and assumes no liability for any resulting damages.
TPWA is an investment adviser registered with the U.S. Securities and Exchange Commission (SEC) that maintains a principal office in the State of Oregon. Registration with the SEC does not imply any particular level of skill or training. For additional information about TPWA, please consult the Firm’s Form ADV disclosure documents, the most recent versions of which can be accessed using the SEC Investment Adviser Public Disclosure website (www.adviserinfo.sec.gov) and may also be made available upon request.