How to set up a safe phrase to stop AI scam calls

If you’ve seen the news lately, you’ve probably met the advice: agree a “safe phrase” with your family, so you can check that an urgent call is really from the person it sounds like. Banks recommend it. Police fraud campaigns recommend it. It is, for once, advice that is both official and actually good.

This guide covers what a safe phrase is, how to set one up properly, and the three quiet ways a homemade one fails, because the advice usually stops one step before the part that matters.

What is a safe phrase?

A safe phrase is a secret word or short phrase known only to a small, trusted group, used to confirm someone’s identity on the phone. If a caller sounds exactly like your son and urgently needs money, you ask for the phrase. A real son produces it, probably while rolling his eyes. A scammer produces excuses.

It works because it doesn’t rely on recognising a voice or a phone number. Both of those can now be faked convincingly, and cheaply, by software.

Why this advice exists now

Voice cloning went from lab demo to call-centre tool in about two years. Researchers have shown that a few seconds of audio, scraped from a voicemail or a social clip, is enough to produce a convincing clone. The result is the “Mum, it’s me, I’m in trouble” call, in a voice that genuinely is indistinguishable from the real thing.

The pressure is deliberate. An urgent, frightening story about a loved one is designed to stop you thinking. A safe phrase gives you one calm, pre-agreed question to ask before anything else happens. It moves the decision from your adrenaline to your preparation.

How to set one up (the right way)

Choose your group. Start with the people most likely to be impersonated or targeted: parents, grandparents, kids, and anyone who would wire money if a relative sounded desperate enough.
Agree the phrase in person, or on a call you started yourself. Never send it by text or email. A secret that travels in writing is a secret with copies.
Make it memorable but not guessable. Not the dog. Not your street. Not anything a stranger could harvest from a decade of family Facebook posts.
Agree the rule, not just the word. The rule is: any urgent call about money gets asked for the phrase. Every time. Yes, even when it’s obviously really them. Especially then, so asking never feels like an accusation.
Do one practice run. Thirty seconds of mild family awkwardness now beats a frozen silence during a real scam call later.

The three ways a homemade safe phrase fails

A fixed phrase you set up yourself is far better than nothing. But be honest about its weak points, because a scammer only needs one of them.

It gets forgotten at the worst moment. The one time you need the word is during a frightening call about someone you love, which is the single worst moment your memory will ever pick to go blank.

Once it leaks, it’s gone for good. Said in a cafe, overheard at a family barbecue, phished out of the least suspicious relative. A static secret fails permanently, and no family on earth holds a meeting to rotate their password.

It doesn’t scale past about four people. Getting one phrase agreed, remembered and updated across parents, children and grandparents is a coordination project. Most families do it once, feel responsible, and never touch it again.

And the stakes of “we sort of had one, once” are real: in Starling’s research, nearly one in ten people admitted they’d send money anyway, even if a call felt strange.

Making it foolproof

Every one of those failure modes comes from the same root: a single fixed word that a human has to remember and protect forever. Remove that, and the idea works the way the advice always intended.

That’s what SafePhrase does. Everyone in your family circle sees the same three-word phrase on their own phone, and it changes automatically every 60 seconds. Nothing to remember, because your phone always shows the current phrase. Nothing to steal, because an overheard phrase is worthless a minute later. Nothing to coordinate, because every phone stays in sync on its own. And it’s computed privately on each device, never sent to a server, so there is no database of family secrets waiting to be breached. It even works with no signal.

The bottom line

Agree a safe phrase with your family this week. If you do nothing else after reading this, do that; it’s free and it works. And when you want a phrase that can’t be forgotten under stress, can’t be reused once overheard, and keeps the whole family in sync without a rota, that’s exactly the job SafePhrase was built for.