Playbook, safety

The five-minute check that catches AI fakes

Voice clones and flawless phishing beat instincts, not routines. Ours takes five minutes and two rules.

The Curio Team · 2 min readWritten with AI from the sources below and checked against them before publishing.

The scary version of AI fraud is already ordinary. The FTC warned back in 2023 that scammers clone a family member's voice from a short clip, often lifted from social media, then call with an emergency and a payment request. The voice is real enough to break your heart. The script underneath is the same one grifters have run for decades.²

That sameness is the good news. The FTC's phishing guidance keeps pointing at the constants: manufactured urgency, a story you cannot check, and payment by gift card, wire, or crypto. AI upgraded the costume, not the con. So we defend the checkpoints every con must pass through, not the channel it arrives on.¹

Protecting yourself is a five-minute setup plus one reflex. Here's ours. We'd run the setup tonight with the people most likely to get the call: parents, kids, whoever pays the family's bills.

1. Slow the moment down. Urgency is the tell that survives every technology shift. Real emergencies survive a five-minute pause; scams die inside it.
2. Verify out of band. Hang up and call the person back on the number you already have, never the one that called you. A real relative is not offended by a callback.²
3. Set a family code word now, before anyone needs it. Pick something no post or profile could reveal, and agree that money requests without it are fake, no matter how right the voice sounds.
4. Treat the payment method as the verdict. Gift cards, wire transfers, and crypto are how scammers collect precisely because those payments do not reverse. Nobody legitimate demands them under time pressure.¹
5. Decide what never gets pasted into a chatbot: passwords, card numbers, government IDs, medical details, client data. Conversations can be retained and, on some products and settings, used for training, so check the data controls on whatever you use.³

Verify the person, not the voice.

We ran the setup with our own family, and the code word conversation took four minutes, most of them spent laughing at rejected words. That is the entire cost. The benefit is a checkpoint a cloned voice cannot pass, because the one thing a scammer cannot scrape is a secret that never went online.

The paste rule deserves its own paragraph, because it is the one people break at work every day. A chat window feels private, like a notes app. It is a service with a data policy, and policies differ: some products train on consumer chats unless you opt out, while most business tiers promise they do not. We assume anything pasted could resurface, and we redact accordingly. Names become roles. Exact numbers become ranges. The advice still works; the secret stays home.³