It’s 11 PM. Suresh’s phone rings — an international number he doesn’t recognise. He almost ignores it, but his son Arun has been working in Sharjah for two years now, and sometimes the calls come late.
He picks up.
“Appa.” The voice is Arun’s. The Tamizh lilt, the exact way he says that word. “I’ve had an accident. I’m at the hospital. I need ₹2 lakh transferred tonight for the deposit — please, I can’t explain everything now, someone else will call you.”
A second caller takes over, calm and official. He gives a bank account number. He says not to call Arun back directly — the phone was damaged in the crash.
Suresh transfers the money.
His son Arun is fine. He was asleep in Sharjah. The voice his father heard was an AI clone built from Arun saying “Happy Diwali to everyone” on his WhatsApp status eleven months earlier. It was a ten-second clip, freely visible to every contact.
The short answer. Family impersonation scams use AI to clone a relative’s voice from a short public clip, then make a fake emergency call demanding money tonight. A familiar voice is no longer proof of identity. The one measure that stops the scam is a private family code word every member must give before you act on a distress call. Back it up by always calling the person back on their saved number before sending money, and by keeping WhatsApp Status and voice notes visible to contacts only. This is the same mechanism covered in the guide to AI voice-cloning scams.
Why Indian families are the target
Scammers running family impersonation attacks look for structural conditions that make the scam plausible — and Indian family arrangements provide several at once.
An estimated 9 million Indians work in Gulf countries. Millions more have migrated to Bangalore, Pune, or Mumbai, or are studying abroad. For a parent in Kerala, Rajasthan, or Tamil Nadu, a call from an unfamiliar international number is not suspicious. It happens regularly. Numbers change when phones are lost or SIM cards expire.
Joint family structures add another layer. In a genuine emergency, the natural response is to mobilise — call relatives, pool resources, act fast. Scammers intercept that instinct: “Don’t tell anyone else yet — it’ll worry them.” That single instruction cuts the target off from every person who might slow them down and ask a question.
WhatsApp is where the attack begins. It is the primary family communication channel, and it is also where voice samples live. Status updates, voice notes, birthday messages — a parent might have dozens of recordings of their child’s voice in group chat history, some of them publicly visible to every contact on the platform.
How the attack is built
Kerala Police documented multiple cases in 2024 where families of Gulf workers received calls using AI-cloned voices claiming accidents or arrests. In Rajasthan, cybercrime investigators confirmed a case where elderly parents in Jaipur received a call from a voice clone of their son in Dubai. The cybercrime cell confirmed it after ₹2 lakh was transferred for supposed bail money. UK’s Action Fraud has documented the same pattern targeting families of British-Indians.
The technical barrier is low. A scammer maps the family online — WhatsApp contact photos, Facebook posts, Instagram — then collects a voice sample. Tools like ElevenLabs and Resemble.ai produce a convincing voice clone from ~30 seconds of audio. (Research models such as Microsoft’s VALL-E demonstrated 3-second enrollment but are not commercial tools available to fraudsters.) A “Happy Diwali” status message is enough.
The call comes late, when alertness is low. The distress scenario — accident, arrest, medical emergency — bypasses critical thinking. A second caller playing a lawyer or hospital administrator adds official scaffolding. Money moves via UPI before anyone verifies anything.
The “don’t tell the rest of the family” instruction is the final piece. It eliminates the casual verification that would otherwise happen naturally.
The one protection that actually works
One measure stops this attack completely, costs nothing, and takes five minutes to set up.
Agree on a family code word.
Pick something arbitrary — a fruit, a colour, a random pairing of two nouns. Not a pet’s name, a childhood nickname, or a place with sentimental meaning, because those can be surfaced from social media. Write it down, share it only with immediate family, and keep it off any digital platform.
The rule: if anyone calls claiming to be a family member in distress, ask for the code word before doing anything else. If the caller cannot provide it, hang up.
AI cloning cannot defeat this. The clone sounds like your son or daughter. It does not know a word agreed upon privately and never written online. Scammers have no way to obtain it and no script that works around it.
The conversation with elderly parents matters here specifically, and there’s a full playbook in protecting elderly relatives from AI voice scams. Explain that a familiar voice is no longer proof of identity, because AI can build a convincing replica from ten seconds of audio. The code word is the only verification that counts when someone calls in distress. Practice asking it once so it feels normal rather than strange.
Change the word once a year.
Other steps worth taking
Always call back on the family member’s saved number before sending money. Any genuine emergency can wait five minutes. If the distress story is real, the person can confirm it. If the call was a clone, the real person will have no idea what you’re talking about.
Set up a secondary signal. Agree that in a real emergency, the family member will also send a specific message from their actual WhatsApp account. A scammer cannot send from your son’s or daughter’s real number.
Enable call screening where available. iOS has “Silence Unknown Callers.” Pixel phones have built-in screening that transcribes what an unknown caller says before you decide to pick up. Both add friction.
Do not send money based on a phone call alone. Genuine emergencies have paper trails and official contacts. Any real crisis can wait five minutes for verification.
If it happens
Report at cybercrime.gov.in or call the helpline at 1930. The offence falls under Section 66D of the IT Act — cheating by impersonation using computer resources. File with your local police as well; documented reports help investigators build patterns across cases.
If money has already moved, call your bank immediately. UPI fraud can sometimes be reversed if reported within hours through NPCI’s dispute process.
What you can do right now
The code word conversation costs five minutes. The scan below costs thirty seconds.
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.