Voice clones and fake calls: a protocol for families and finance teams.

How the scams work (what is documented)

• Voice clips of a relative are used in a made-up crisis to demand money. AI audio is used to impersonate someone to a bank, and real-time AI video chats pose as executives or officials ¹.
• The FTC says scammers use voice cloning to make requests for money or information more believable. A familiar voice is not proof ².
• ENISA notes that AI is notably used in vishing and online impersonation fraud ³.
• In June 2026 a Ukrainian deputy minister of digital transformation stated that social-engineering fraud is currently more dangerous than classic viruses ⁴.

Family protocol

1. 1Agree a secret word or phrase now, and require it for any request for money ¹.
2. 2The rule: hang up and call back on a number you already have or look up yourself ¹.
3. 3Wait 10 minutes before any transfer.
4. 4No gift cards or wire transfers to “family” under pressure ².
5. 5Reduce public voice and video: make social accounts private and limit the samples available ¹.
6. 6Teach older relatives the rule, and practise it once with a pretend call.
7. 7If you have already paid, call your bank at once (use the number on your card), then report to the Cyber Police ⁵.

Finance-team protocol

These are NAK's recommendations, built on documented attack patterns ¹.

1. 1No payment, change of bank details or credential reset on the strength of a voice, video or chat message alone.
2. 2Verify by callback to a number from the verified internal directory, not the number in the request.
3. 3Two-person approval above a set threshold, with no “urgent” exception.
4. 4Name a verifier and keep a log of every unusual request.
5. 5Run short drills twice a year, including a cloned-voice scenario.
6. 6If a fraud succeeds: freeze the payment route, ask the bank to recall the transfer, preserve evidence (see the guide “The first 24 hours after a deepfake”), report to the Cyber Police ⁵, and inform CERT-UA if systems were accessed ⁶.

Ready-made wording

• Callback: “Thank you. I will call you back in a few minutes on the number in our directory.”
• Safe word: “What is our safe word?”
• Message to staff after an incident: “Today someone tried to defraud us in the name of [name]. No payments or changes of bank details without a callback and a second signature. Report any similar request to [named person] immediately.”

Limits