Deepfake Safety Checklist: How to Protect Yourself and Your Family From AI Scams

The deepfake safety checklist

Use this checklist whenever a call, voice note, video or message asks you to act quickly, especially when it involves money, passwords, one-time codes, personal documents or secrecy. Each step works even if the fake is perfect, because none of them depends on spotting it.

• Pause. Urgency, secrecy and emotion are the scammer's tools; a real emergency survives a five-minute check.
• Hang up and call back on a number you already have saved, or find it on an official website you type in yourself.
• Ask for your family safe phrase, or a detail only the real person would know from private life.
• Do not send money, gift cards, crypto, one-time codes or passwords while identity is unconfirmed.
• Do not click links, scan QR codes or install apps that the caller sends.
• Save the evidence: screenshots, phone numbers, account names, links and any recording.
• Tell your bank immediately if money or card details have already gone, then report the scam.

Why a familiar voice or face is no longer proof

AI tools can now copy a voice from a short recording and swap a face in a live video call. The FBI's public service announcement I-120324-PSA of 3 December 2024 says criminals generate short audio clips of a loved one's voice to impersonate a relative in a crisis, and create videos for private communications to prove an online contact is a real person.

People are already being targeted. Starling Bank's survey, published on 18 September 2024, found that 28% of UK adults thought they had been targeted by an AI voice cloning scam at least once in the previous year, nearly half had never heard of this kind of scam, and only 30% said they knew what to look out for. The bank's release also states that criminals can clone a voice from as little as three seconds of audio.

Caller ID offers no protection either. Numbers can be spoofed so that a call appears to come from your bank, your child's phone or a government office.

How to set up a family safe phrase

A safe phrase is a word or short sentence that everyone in the family knows and that never appears online. Choose something odd and specific, such as the name of an imaginary pet or a nonsense pair of words, rather than a birthday, school or street that can be found on social media.

Agree on it in person, not by text or email. Include older relatives and teenagers, who are frequent targets of fake emergency calls and fake friend messages. Practise once: one person calls with a made-up emergency and the other asks for the phrase. Change it if it is ever said in a public place or written down where others can see it.

Can you stop scammers from cloning your voice?

You cannot completely stop scammers from cloning your voice if recordings of it exist online, but you can reduce the material available and make a clone useless. Set social media accounts that contain videos of you speaking to private, remove old public videos you do not need, and be cautious with voicemail greetings and calls from unknown numbers that try to keep you talking.

The more effective step is to make your voice worthless as proof. If your family, bank and employer know that you will never ask for money or codes by voice alone, and that a call-back or safe phrase is always expected, a cloned voice achieves nothing. Ask your bank whether it still uses voice recognition for phone banking and whether you can switch to another factor.

The scam scripts to watch for

Most deepfake scams aimed at individuals reuse a few stories. Knowing them makes the first few seconds of a call easier to recognise.

All five scripts share the same structure: a trusted identity, a reason to act now, and a reason not to check. The trusted identity is the part AI now fakes well. The other two parts are where you can break the scam, by slowing down and by checking through a channel the caller did not give you. Share these scripts with older relatives, who are often targeted with the family emergency and bank versions.

If you have already sent money or details

Call your bank or card provider straight away using the number on your card; quick action gives the best chance of stopping a transfer. Change any password you shared, starting with email, and sign out other sessions. If you gave a one-time code, tell the service it belongs to.

Then report it. In the United States use ReportFraud.ftc.gov and the FBI's ic3.gov; in the UK, the police Report Fraud service; in India, the 1930 helpline or cybercrime.gov.in. Expect follow-up scams from people who claim they can recover your money for a fee.

What banks, platforms and employers can do

Individuals should not have to carry this alone. Banks can stop accepting voice as an authentication factor, warn customers during unusual transfers and analyse suspicious media that customers report. Platforms can screen profile photos and ads for generated faces. Employers can make out-of-band verification normal for any payment request.

Neural Defend builds tools for those organizations. NeuroVerify checks a face image, video or audio for deepfakes in one API call and returns a risk score the organization's policy acts on. NeuroDetect lets fraud and investigation teams analyse reported images, audio, video and documents and produce a forensic report. NeuroCall, currently in Beta, focuses on detecting voice deepfakes in calls. These help organizations protect customers; for an individual, the checklist above remains the first line of defence.