A face on a screen used to settle the question. It doesn't anymore. On my Sunday LIVE I told you about two people on a Zoom call that a lot of viewers could not tell were fake, and I gave you the one fix I trust: a family safe phrase, agreed in person, spoken first by whoever is in trouble.
What I saw on that Zoom call, and what I know from cloning myself
I watched two people going back and forth on Zoom. I had no idea who they were. The word going around afterward was simple, and it stuck with me all weekend.
"A lot of people couldn't tell that they were fake."
I'm not reporting that from the outside. I've cloned myself. I have a video avatar of my own face and my own voice, and I've tested what it can do. It was pretty good. It still wasn't me, and I said so on the LIVE: "It's just not quite there for me yet."
Remember the first time you heard your own voice played back? For me it was a cassette tape when I was a kid, and it sounded funny because I was used to hearing it from inside my own head. Watching my avatar is that feeling turned up. I notice the tiny things that are off, because nobody on earth has studied my face more than I have.
That's the catch. The person a scammer wants to fool is not me checking my own clone in a quiet room. It's my mother, my kid, or my bookkeeper, on a bad day, with a phone ringing and somebody crying on the other end.
They are not grading pixels. They are scared. And the Zoom pair I watched had already cleared the bar for strangers who were paying attention.
The video meeting that cost about US$25 million
If you think this is a someday problem, here is a yesterday problem. In 2024 the engineering firm Arup confirmed that an employee in Hong Kong sent HK$200 million, about US$25 million, after a video conference where the chief financial officer and other colleagues on the call were deepfakes. The worker believed the people on screen were real.
Read that again and notice what was faked. Not an email with a typo. Not a stranger with an accent asking for gift cards. A meeting, with the boss and familiar coworkers, the exact setting most of us were trained to treat as the safe way to confirm something. The scam used our best verification habit as the delivery truck.
I don't think that employee was careless. I think that employee did what nearly everyone would do when a room full of known faces agrees on something. Group agreement feels like proof. Put several familiar people on one screen and the pressure to go along gets heavier, not lighter.
So the lesson I take from Arup is not "be smarter." It's that seeing and hearing someone has been demoted. It's one signal now, and sometimes it's the easiest one to fake. You need a check that a camera and a voice model can't produce, and that is what the safe phrase is.
How a con works on good people
I served 20 years with LAPD, 17 years plus 3 as a reserve. The tools change. The script mostly doesn't. Whether it's a phone, a letter, a knock on the door or now a video call, the con leans on the same three levers, and once you can name them you start to hear them.
Urgency. You have to act now. The bail is due in an hour, the tow truck is leaving, the deal closes today. Urgency exists to take away the minute you would have used to think. Anybody who refuses to give you that minute is telling you something.
Isolation. Don't call anyone else, don't hang up, stay on the line with me. A con needs you alone, because the second person in the room is the one who says, "Wait, that doesn't sound right." Cutting you off from that person is the whole game.
Secrecy. Don't tell Mom, she'll be furious. Keep this between us. Secrecy does double duty: it stops you from checking before the money moves, and it keeps you quiet afterward out of embarrassment. That silence is how the same crew hits the next family.
Here's why I like the safe phrase so much. AI upgrades the costume. It gives the con artist your grandson's face and your daughter's voice. It does nothing to the script. A pre-agreed phrase attacks the script, because the one thing the costume can't carry is a secret that was never written down anywhere.
Pick a phrase, not a single word
On the LIVE I came back to this point later in the show, because it matters. The family code should not be a single word.
"I think it should be a phrase, not just a word. I think that's important."
A single word is easy to guess, easy to say by accident, and easy to fish for. A short phrase made of words that don't normally go together is much harder to stumble into and much harder to pull out of your life online. Here are the rules I'd use when your family picks one.
- Nothing anyone could find on your social media: no pet names, old street names, school mascots, favorite teams or anniversary dates.
- Three to six ordinary words in an odd combination, something like "the blue canoe owes me lunch." Don't use that one, it's printed here now.
- Easy to say under stress by the youngest and oldest person in the circle, with no spelling and no numbers to remember.
- Never typed. Not in a text, a notes app, an email, a calendar entry or the family group chat.
- Never reused as a password, a security answer or a Wi-Fi name.
- One phrase per circle, so if it ever leaks you know exactly which group needs a new one.
The "never typed" rule is the one people break first, because they're afraid they'll forget. You won't, if you practice it out loud a couple of times at family dinners. And a phrase that lives only in people's heads can't be stolen out of a hacked phone.
Agree on it where no device can hear
This is the part people think I'm joking about. I'm not.
Go in the bathroom with the people closest to you. Turn on the faucet, turn on the shower and flush the toilet while you say the phrase. No Apple Watches, no other watches, nothing on your wrist or in your pocket. Just you and your people.
Is that overkill? Maybe. I don't know what every phone, speaker, watch or smart TV in your house keeps, and you don't either. When you can't know, you take the devices out of the equation.
It costs you ten awkward minutes and a little water. The whole value of the phrase is that it was never captured anywhere, so the setting where you create it has to match.
If someone in your circle lives far away, you travel. On the LIVE I used Miami and Los Angeles. If your sister is in Miami and you're in Los Angeles, the phrase doesn't get set over a phone call or a video chat, because those are the exact channels a scammer would later use to impersonate one of you. You go there, lock yourselves in her bathroom, run the water and say it.
Make the trip count. Pair it with a visit you were going to make anyway: a birthday, a holiday, a graduation. The safe phrase can be one quiet ten minutes on a weekend that was already about family. That's how it sticks.
The handshake deal: whoever is in trouble says it first
The phrase alone is half the system. The other half is the agreement about how it gets used, and everybody in the room has to shake on it.
"You don't have to call for it. The agreement should be that everybody's just going to say it."
Why unprompted? Because if you have to ask for it, the scammer gets a turn. They stall. They cry. They say "I can't think right now, just help me."
Now you're the one coaching them, filling the silence, maybe even giving away a hint. When the rule is that the person in trouble says it in the first breath, there's nothing to negotiate. Either the phrase shows up at the top of the call, or it doesn't.
I told a story on the LIVE to make the point. Picture your kid calling to say they broke down in East Texas with a flat tire, in the middle of nowhere, at the only gas station for miles, under a weird flashing neon sign, with a thunderstorm in the distance and big bugs everywhere.
They need a thousand dollars sent by Western Union so they can get the tire fixed. Sounds plausible. Sounds urgent. Sounds like your kid.
If it really is your kid, the phrase comes out of their mouth first, before the flat tire, before the dollar amount. You hear it, you relax, and you go send the money with a clear head. If the story arrives without the phrase, you have your answer about what comes next, and it isn't a trip to the wire counter.
I also talked about the extreme version, someone in real danger on a video call being forced to ask for money. The phrase helps there too, because it tells the family the danger is real so they can act. That's not the main point. The main point is the everyday case: making sure the emergency is real before anybody acts on it.
When the phrase is missing: slow is the shield
A missing phrase is a stop sign. Treat it that way even when the voice is perfect and the face is perfect. Here's the drill.
- Hang up. Politely or not, end the call. You are not obligated to keep a stranger on the line.
- Call back on a number you already had saved, not the number that just called you and not one the caller gave you.
- Call a second person in the circle who can check on the first, in person if possible.
- If the request involves a wire, crypto, gift cards or cash pickup, and it comes with a deadline, stop completely. That combination is the fingerprint.
- Give it time. A real emergency survives a ten minute callback. A fake one usually collapses.
Slow is the shield. Every lever the con artist pulls is designed to speed you up, and the cheapest defense in the world is to refuse. The callback works because the scammer controls the incoming line but not the number you saved years ago. That's the same move I lay out step by step in the guide to verifying an emergency call before you send money.
One more thing. If you hang up and it turns out it really was your nephew who forgot the phrase, nobody gets yelled at. You call him on his real number, he says it, and you help. The rule has to be safe to follow, or people will stop following it the first time it feels rude.
The business version: owner, bookkeeper and the vendor who "changed banks"
Arup was a business. If you run a small one, you are not too small to be worth the effort. A scammer doesn't need US$25 million. A single invoice paid to the wrong account can wreck a month for a five-person shop.
Start with the two people who can move money. Usually that's the owner and whoever does the books. They agree on a phrase the same way a family does, away from devices, and they agree on a rule that matters more than the phrase: no money moves on a video call, voice message or text alone. If the boss appears on a screen asking for an urgent transfer, the bookkeeper hears the phrase first or makes a callback to the boss's saved number before touching anything.
Then deal with vendor bank changes, which is where small businesses get hit. A "new account" notice from a supplier you've paid for years is a classic setup.
The fix is boring: confirm any change of payment details by calling the vendor on the number already in your files from before the request arrived. Never the number in the email. Never a link. And if the change shows up with a deadline, that's the urgency lever wearing a suit.
I wrote more about keeping a human hand on these decisions in AI can help, but you still need to be in control. If you want help putting a verification workflow in place for your team, the callbacks, the two-person rule and the scripts your staff can use without feeling rude, you can pick a time on my calendar at BookWithHonor.com. I'm not your attorney or your accountant, and none of this is legal or financial advice. It's a habit that keeps money where it belongs.
The escrow version, for anyone buying or selling a home
I've been in real estate since the late 1990s, and the one rule I'd tattoo on every buyer and seller is this: if you get wiring instructions that changed, by email, you call your escrow officer on a number you already know. Every time. No exceptions for how official the email looks.
"A number you already know" means the one from your opening escrow paperwork, or the one you saved when escrow opened, or the one your agent gave you in person. It does not mean the phone number in the signature of the email that just told you the account changed. Whoever faked the email can fake the signature too, and with voice tools they can answer that phone sounding perfectly professional.
This is the same idea as the family phrase, applied to the biggest check most people ever write. You set the trusted channel at the start, before any pressure exists, and you refuse to let a message in the middle of the deal replace it. I wrote about how these scams target local sellers in a cop's read on the real estate scams hitting Santa Clarita.
Talking to older parents and teenagers without scaring them
This conversation goes sideways when it sounds like "you're the weak link." Nobody wants to hear that, and an older parent who feels talked down to will nod and forget the whole thing.
So don't frame it as their vulnerability. Frame it as protecting the grandkids. Somebody could fake Grandma's face to scare the kids, and the phrase protects them from that too. Now Grandma is the guardian, not the target.
With older parents, keep the rule tiny. One phrase. One instruction: if anybody calls in trouble and doesn't say it first, hang up and call me on my real number. Practice it once, out loud, the way you'd practice a fire drill. Then bring it up casually at the next holiday so it stays fresh.
Teenagers are the opposite problem. They already know deepfakes exist and may think they could never be fooled.
Don't lecture them. Hand them the job. Let them help pick the phrase and run the bathroom ritual, because it's ridiculous and they'll enjoy that. Then point out it works for them as well: if someone sends them a fake video of a sibling in trouble, or pressures them to keep something secret, they have a tool to check it.
For both groups, say this part out loud: if you ever get fooled, you will not be in trouble. Shame is the secrecy lever doing the scammer's work after the fact. A family where nobody gets punished for reporting a mistake is a family where the second attempt fails, because everybody talks.
What I expect next: AI faces in customer service and in your news feed
My prediction, and it's mine, not a fact: you're about to see completely AI-generated people in customer service and sales. You'll hop on a call from a social media ad and the friendly person walking you through the offer won't be a person at all. On the LIVE I guessed that within three or four months there would probably be some kind of "this is AI" overlay or label required for safety. I also said I'm not sure who would be monitoring that. Treat my timeline as a guess.
I'm not against AI. I use it in my own work constantly. On SantaClaritaOpenHouses.com my assistant, Clara, tells you she's an AI first thing, before she gives you the market update with a date and time stamp. That's the standard I'd like to see everywhere: the machine says what it is up front. I explain why I'm careful with avatar video in why AI avatar videos can hurt real estate agents.
The same caution applies to the news. A clip of a familiar anchor or a famous person saying something outrageous could be real, could be edited, could be fully generated. You might be watching a snippet on a video site with no idea where it came from. Don't knee-jerk yourself into a frenzy over a clip. Find the original source, give it a day, and see if it holds up.
"Seeing is no longer believing."
A low-tech answer to a high-tech problem
It's a little funny. The most advanced fraud tools ever built, and the best defense is a sentence your family says in a bathroom with the water running. No app, no subscription, no download. Nothing to hack because nothing was stored.
That's not an accident. High-tech attacks are built to beat high-tech checks: they fake the face because we trust faces, and they fake the number on caller ID because we trust caller ID. A shared secret that never touched a device, plus a callback to a number you saved long ago, sits outside the system they are attacking. They'd have to be in the room with you to beat it.
The habit underneath all of this is bigger than the phrase. When I closed the LIVE, I said it plainly.
"Verify everything, ask for proof, ask for receipt."
Do the phrase this week. Get your people in a room. Then make verification your default, at home and at work, so that when the perfect fake finally calls, it hits a wall it can't talk its way around.
Keep reading
Top 5 human concerns with AI, and the family safe phrase that beats a voice clone scam: the earlier episode where I first walked through voice cloning and why families need a phrase.
Before you send money, verify the emergency call: the callback routine, step by step, for when the phone rings with bad news.
AI can help. You still need to be in control.: how a business keeps a human hand on permissions, money and decisions.
A cop's read on the real estate scams hitting Santa Clarita: how the scams aimed at local sellers look to someone who spent 20 years at LAPD.
From iPod to AI: adaptability is the asset: the next segment from the same Sunday LIVE, on keeping up when every format changes.