Deepfake scams might use your voice, but they don't know what's in your head. Five minutes of preparation could save your loved ones from falling for fraud.

"It was the most terror I've ever felt," says Elizabeth Benz, a mother from Buffalo, New York.

In September 2025, she got a phone call. "It was my 16-year-old-son, John," she says. "He was sobbing, 'Mom, my friend is dead. He's dead.'" She panicked, but things were about to get even worse.

A stranger took the phone. Over the course of 20 minutes, the man told her he'd just murdered her son's friend, and he'd do the same to John if she didn't meet him with $7,500 (£5,570) in a Walmart parking lot.

"He said, 'We are going to kill your son,'" Benz says.

Soon she was driving over. But just in time, John's brother got hold of him. He was at a football game. John wasn't in danger, and that wasn't his voice on the phone. It was all an AI deepfake scam. "I couldn't believe it," she says.

If you think you or your loved ones are too savvy to fall for a deepfake, you're wrong. AI is so good now you can no longer trust your senses, and criminals are perpetrating scams like these on a massive scale.

Thankfully, it's a high-tech problem with a low-tech solution – one that could save you a lifetime of regret.

Your family needs a codeword that you use to verify each other's identity in a crisis. The scammer might have your voice. They don't know your secrets. Experts and victims say this is one of the single most important things you can do to stay safe. But the password alone isn't enough.

Just ask Benz. One of the craziest parts of her story is her family already had a password for this exact scenario when she got the scam call.

"It just didn't occur to me to ask for it," says Benz. "These scams get you to an active place of panic where you can't think straight." It means you also need mental preparation. That's a little more complicated, but the tips below can help.

If you get targeted, it could be some of the most important advice you'll ever read.

What's the codeword?

Americans alone lost an estimated $148.2bn (£110.1bn) to online scams and crimes in 2025, up nearly 26% from the year prior. AI-enabled scams accounted for $6.3bn (£4.7bn) of that. Experts say they're growing exponentially.

"This is not hypothetical," says Hany Farid, the co-founder of GetReal Security and one of the world's leading experts on AI deepfakes. "These scams are being perpetrated all over the world.

"Imagine getting a call at 02:00, a voicemail, a video call, a loved one saying they're in trouble," he says. "Or maybe it's your CEO, screaming that he needs help logging in. The average consumer is not ready for this."

Farid and other experts agree a codeword is the easiest way to protect yourself. "My wife and I have a password. If either of us gets an unusual call, we use it to verify identity," he says.

Pick something that's easy to remember and hard to guess. Inside jokes are a safe bet.  

"If my wife calls and asks me to pick up milk, I'm not asking for the password," Farid says. "But if I happen to know she's in a meeting, or she says been in an accident and needs me to transfer money, anything unusual, that's when you use it."

But when you get that phone call and hear a loved one in crisis, pressure can tear your plans apart. You need to know how and when to be ready.

Know the red flags

Gary Schildhorn, a lawyer from Philadelphia in the US, dodged a deepfake scam of his own in 2023. The experience was so jarring he now works as a scam-safety advocate in his spare time.

"There are three red flags," Schildhorn says. They all have the same goal: scammers want you isolated and afraid, so there's no time to think.

"One red flag is time. Everything has to be done right away," he says. "Two is they never ask for traceable funds. If they need Bitcoin or gift cards or cash, you know the agenda. And three is they try to control who you speak to."

Knowing the hallmarks of a classic scam are crucial, but awareness alone isn't enough.

"One of the most important things is how you react," says Brian Long, co-founder of Adaptive Security, which makes AI-security training programs for companies. "You need to train your mental model to prepare for this scenario."

And of course, you need to make sure you and your loved ones don't forget the codeword.

The best way to do that is practice, but it doesn't have to be exhaustive.

I've been talking to experts about scams for years, and I've got a simple system for myself: I set up an alert on my phone that goes off every three months.

It reminds me to bug my family to make sure we remember the codeword. And it prompts me to rehearse a little protocol for emergency calls: stay calm, ask for the password and consult someone I trust before acting.

"I share my story because I want people to know how urgent and scary and psychological and realistic these calls can be," says Benz. "Awareness is the greatest tool."