In this guide 10 sections
At a glance
The short version.
Watch for
- A sudden emergency, disciplinary threat or confidential business request
- Instructions to stay on the line, keep the situation secret or avoid colleagues and relatives
- A payment by wire, cryptocurrency, gift card or a newly supplied account
Already acted?
Contact your bank or payment provider immediately if money was sent.
See every recovery stepWhat is changing now
The current pattern.
Recent official warnings describe scammers combining AI-generated voices or videos with spoofed websites, government branding and urgent requests. The synthetic media builds confidence, but pressure, secrecy and payment instructions still do most of the manipulation.
How it works
How the scam unfolds.
A scammer collects public audio, video, photographs or biographical details about a person. Generative tools can then produce a convincing voice message, live-call effect or video that appears to show that person speaking.
The contact usually supplies an emotional story: a relative is in trouble, an executive needs an urgent transfer, or an official says you are under investigation. The request may move across email, messaging apps, calendar invitations and voice or video calls so that each channel appears to confirm the others.
Visual glitches and unnatural speech can be clues, but they are not a dependable test. High-quality synthetic media may look or sound normal, while a genuine call can lag or distort. Independent contact is more reliable than trying to become a deepfake detector.
Warning signs
Reasons to stop and verify.
- A sudden emergency, disciplinary threat or confidential business request
- Instructions to stay on the line, keep the situation secret or avoid colleagues and relatives
- A payment by wire, cryptocurrency, gift card or a newly supplied account
- A new number or messaging account claiming an old identity
- Resistance when you suggest ending the call and contacting the person separately
- A request for identity documents, account credentials or a one-time code
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
Incoming call · unknown mobile number
CallerMum, it’s me. I’ve had an accident and my phone is broken1 (warning sign 1) — I’m calling from a nurse’s phone.
CallerI need £2,400 for the hospital deposit. Please don’t tell Dad yet, he’ll panic.2 (warning sign 2)
YouLet me call you back on your own number.
CallerNo — this phone can’t take calls.3 (warning sign 3) Send it to the account the nurse gives you4 (warning sign 4) in the next twenty minutes5 (warning sign 5), please.
- A reason your saved number will not work
A broken or lost phone explains why the call comes from an unknown number. It also quietly removes your easiest check: calling back.
- Secrecy from family
Asking you not to tell another relative removes the person most likely to know where your child really is.
- A blocked callback
Refusing a callback keeps verification inside the channel the caller controls. A genuine relative can wait a few minutes while you check.
- A new payment destination
Money sent to an account introduced during the call — not one you already know — is a strong reason to stop.
- A short deadline
Twenty minutes is designed to stop you thinking, checking or asking anyone else.
The voice may sound exactly like your relative. None of these warning signs depends on noticing that the audio is synthetic — they are all in the request.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
A familiar voice asks for an unfamiliar payment
- 01The opening
A caller sounds like a relative and says they have lost their phone while travelling. They know a family nickname and mention a real upcoming event, which makes the story feel private and current.
- 02The escalation
The caller says they cannot speak for long, asks for secrecy and needs a transfer to a new account before a deadline. When offered a callback, they say their replacement phone cannot receive calls.
- 03The decision point
The decisive clue is not whether the voice sounds synthetic. It is the attempt to keep verification inside a channel controlled by the caller while introducing urgency, secrecy and a new payment destination.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Separate identity from the story
Write down who the caller claims to be and what they want. Do not treat a familiar voice, face, number or biographical detail as independent proof.
- 02
Start a clean contact
Use a saved number, an existing account conversation or a second trusted person. Do not use a callback number or account introduced during the request.
- 03
Verify the event and the payment separately
Confirm both that the emergency exists and that the named person controls the destination account. Verifying only one of those facts is not enough.
- 04
Use a family or team protocol
Agree in advance that urgent money requests require a callback and a second person. A private phrase can help, but it should supplement—not replace—a separate contact route.
Prevention
Make the next attempt harder.
- 01
Agree a family money rule
Decide together that any urgent request for money is confirmed by calling back on a saved number, however distressed the caller sounds. A rule agreed in a calm moment is easier to follow than a decision made mid-call.
- 02
Save verified numbers now
Make sure relatives, your manager and your bank are saved under numbers you confirmed yourself. You will need them at the exact moment a caller says their phone is broken.
- 03
Reduce the raw material
Consider limiting who can see videos and voice notes on public profiles, and avoid posting travel plans in real time. Less public detail makes a personalised story harder to build.
- 04
Add a second person at work
For payments or data requests that arrive by call or video, require confirmation from a second colleague through a separate channel, however senior the requester appears.
If you already acted
Protect access and contact the real provider.
- Contact your bank or payment provider immediately if money was sent.
- Change exposed passwords from a trusted device and end unfamiliar account sessions.
- Tell the person or organisation being impersonated so they can warn others.
- Preserve the original contact details and report the incident to the relevant platform and local authority.
- Be cautious of anyone who later promises recovery for an upfront fee; previous victims are often targeted again.
Common questions
Short answers to real doubts.
Can scammers really clone a voice from a short clip?
Voice-cloning tools can produce a convincing imitation from publicly available audio, such as videos posted online or a recorded voicemail greeting. Quality varies, and over a phone line you cannot reliably tell a clone from the real person. That is why the dependable test is a callback to a number you already have, not listening harder.
Is a family code word enough protection?
A private phrase is a useful extra check, but it should not replace a callback. A phrase can be forgotten under stress or overheard, and a scammer can claim the person is too upset to remember it. If the phrase is missing, stop. If it is correct, still confirm any request for money through a known number.
What if it is a video call and I can see their face?
Real-time face and voice manipulation exists, and a short, low-quality video call can hide imperfections. Seeing a face is not proof of identity when the call came from a new account or number. End the call and contact the person through an account or number you used before this contact began.
Sources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.