Why I built SafePhrase: the scam that got my family

Every product page for SafePhrase says the same thing: scammers can fake a familiar voice.

I want to tell you how I know.

The message that started it and the situation that compounded it

Just before the weekend, in the run up to a family wedding, my Mum got a message from an unknown number claiming to be me and that this was my “new number”.

My Mum, being reasonably cautious, reached out to me on my original number by text. However, given my busy schedule and driving in and out of signal to the wedding venue (located in a beautiful but signal-less Devon valley) it meant that I didn’t get a chance to respond.

I note that had we had the app at the time, my Mum could have sent a SafePhrase challenge to this number and immediately discounted it.

However, that’s not how things transpired.

While I was enjoying my brother-in-law’s wedding, my Mum received a call from the number in question.

“Hi Mum, sorry, signal’s bad, but I need some funds quickly to settle an invoice.”

My Mum questioned what it was for. The answer sounded legitimate, and given I run businesses, this voice (my voice) sounded convincing enough.

Being the awesome parent she is, she rationalised that it must be important for me to call and ask, and despite me being a little rushed and short, she said goodbye and transferred a four figure sum to the details provided.

The part nobody talks about

When we finally spoke and it sank in, there was anger and disbelief, but what I wasn’t prepared for was everything around it: the embarrassment she felt, which to be honest she had no business feeling, and the quiet way a thing like this makes a capable person begin to doubt themselves.

I want to be clear about something, because it matters. My Mum did not do anything foolish. She received a plausible message, heard a familiar voice, and opted to help one of her family.

Every part of the scam was engineered to make a good person do exactly what she did. The scam did not defeat her judgement so much as it preyed on a family connection and used it as the getaway car.

If you’re reading this and this has happened to someone you care about, you’ll certainly understand. In the follow up and discussions with the bank, it became clear this wasn’t just a one off. Not only did the kind lady help my Mum get her money back (hooray), she also confided that this is something they are starting to see a lot more of. While that was some comfort for my Mum, or anyone else caught up in these situations, it did start to get me thinking.

Seeing the effect it had, combined with the trajectory of the AI space, my only conclusion was that this type of phishing and social engineering was only going to get more sophisticated.

The post-mortem

Afterwards I did what you’d expect: I sat down, systematically, and tried to think of what would actually have stopped it.

Caller ID? The whole scam was built on a “new number”, so no. Recognising the voice? But the voice was the weapon. Trusting your gut? Her gut said her family needed help, because that is what the call was designed to say.

The question that became an app

In my mind it needed something simple, reliable, and that could be used in the moment of doubt and pressure that my Mum experienced.

I did some research to see whether an app like that existed. The honest answer, after a lot of looking, was no (not yet at least). There were call blockers and spam filters, all busy solving the wrong layer, and there was the safe-word advice, wisely recommended but left entirely manual. There are even zero-knowledge proofs and passkeys, and way off in the future, rather Orwellian “proof of human” ideas that scan your iris and biometrics.

So, given I’m what you might call “a terminal tinkerer”, I built it. On my own, at nights, with (somewhat ironically) the help of AI and a level of stubbornness I can only attribute to the phone call that started all this.

In my original ideas I thought about a “safe word” and how sharing it could help in these situations. As I chatted it through with my wife, she mentioned something important in that off the cuff way that got my brain ticking: “what if someone hears it?”

This led me to remember my two-factor authenticator apps, where you have a rotating set of numbers to access your services. What if, instead of numbers, we had a rotating word to effectively 2FA humans? Bolt on a simple invite and verification system to orient everyone around a rotating phrase and eureka: a simple way to codify trust between a group and validate it at important moments.

It started to feel like a solid and coherent idea.

A few discussions later, in the van on the way back from a family trip to Wales, we arrived at SafePhrase.me. Purely because it is easy to say, and it’s also a statement, “safe phrase me”, which we thought would help with marketing. A quick check, the domain was free, yes! So we bought it right there, as we were travelling over the Bristol Channel bridge.

So that’s SafePhrase. The product of a rubbish experience and some intentional tinkering.

Your secret weapon in the AI age

In very simple terms, it gives your family or close circle of friends a shared phrase, three simple words, that every member’s phone computes privately and identically, changing every 60 seconds.

It never touches a server, so there is nothing to breach and nothing for anyone, including me, to read. And when a call feels wrong, or even slightly off, it provides a simple way to ask for the phrase (on the call, or with a SafeText or SafeVideo challenge).

A real family member can read it off their phone or respond to a challenge in five seconds flat. But a scammer with a cloned voice or video has nothing to read.

What I’d tell every family, regardless of my little app!

Two rules, starting tonight.

First: any urgent call about money gets verified before anything moves. Hang up and call back on the number you already have, or ask for your safe phrase and let them say it. A real family member might protest but they will never mind. That’s actually how you know they’re real family.

Second: agree that “a new number” plus “needs money” equals a full stop, every time, no matter how good the voice is. That combination is clearly a scam, and that, combined with some unavailability, is what caught us out.

The call that came for my Mum worked because it exploited the situation and her willingness to help the family. However, I’ve put some time into building a fix. I think it’s useful, and I’ve tried to hold it to a simple concept: it has to work the same way, in the same five seconds, for the same person.

Not for a security enthusiast.

But be simple enough to pass the Mum test!

That’s SafePhrase, and I hope your family never needs to find out how well it works.