Skip to content
Practical technology, explained simply

Learn · security

They call with your child's voice: the clone scam

How the fraud that uses AI to impersonate a relative's voice works, why a family code word stops it dead, and what to do if you have already sent money.

Ibrahin·Published on 3 September 2026·6 min read

Text drafted with artificial intelligence. The topic, the angle and the final review are Ibrahin's. How AI is used here

An older woman looks warily at the phone screen in her hand, in her living room: an incoming call from an unknown number, with no contact name
Illustration generated with AI for this article. The number shown on screen is invented.

You pick up a number you do not recognise and you hear the voice of your husband, your daughter or your mother. They say very little and hang up fast. It sounds like them. It is not a resemblance: it is their voice, generated by software from a recording.

This is not hypothetical. INCIBE, Spain’s national cybersecurity institute, published a real case handled by its 017 helpline: a woman picked up and heard her husband’s voice saying “Hi! I can’t call you, send me a message on this number ______”. It sounded like a recording to her, she did not write to that number and she called her husband on his usual phone. He had not called.

One thing is worth saying from the start, because it takes one click to check: this is not brand new. That case is from June 2024. What has changed in 2026 is how often it gets reported.

The short answer

Hang up and call the number you already had saved. Do not answer the number that called you and do not write to the one they give you. And this evening, over dinner, agree a code word at home: a single word only you know, used to check over the phone that the caller is who they say they are. INCIBE recommends it, and it takes five minutes.

What the call is really like

The script is not a film scene. It is short and designed to get you off the phone as fast as possible:

  • An unknown number.
  • A voice you recognise, saying one or two sentences.
  • An excuse not to keep talking there: I can’t call, my phone is broken, write to me on this other number.
  • And from then on, in messages, the request: details, a transfer, an urgent payment.

The trick is the change of channel. The voice only has to hold up long enough for you to trust it. The rest of the deception happens in writing, where there is no longer a voice that might sound odd.

Where they got the voice

With today’s tools, a few seconds of recording are enough to generate audio impersonating that person. INCIBE says exactly that.

And those seconds are easier to get than it seems. In the documented case, the husband had previously received strange calls: he picked up and nobody spoke, or there was a beep, or he was asked for personal details. INCIBE points to those calls as a possible source of the recording. That call where you pick up and nobody speaks may not be a switchboard error.

The other route is better known: any public video on social media where you can be heard speaking.

The family code word

This is INCIBE’s central recommendation and the part of this article I want you to act on today.

It means agreeing a word known only to the people you trust most. When an odd call or message arrives asking for money or details, you ask for it. Whoever is on the other end either knows it or does not.

For it to actually work:

  • Make it unguessable. Not the dog’s name, not the grandmother’s village, not the football team. Nothing that is on your social media or that a neighbour would know.
  • Do not write it on your phone. Do not keep it in notes, and do not send it round on WhatsApp so everyone has it. It is said in person once and remembered.
  • Make sure the older members of the household know it, not just the young ones. This fraud targets whoever has the savings and the fright, not whoever has the newest phone.
  • Use it without embarrassment. Asking your own child for the code word in the middle of an emergency feels ridiculous, right up until the day it is not.

And a rule that goes with it: the code word is asked with you calling, not answering. If it really is your child, picking up the phone to you costs them nothing.

What to do at the time

INCIBE sums it up in three things, and the user in the real case did all three right:

  1. Check with the person who claims to be calling, through the usual channel: their saved number, not the one on your screen and not the one they give you.
  2. Do not give out personal or banking details. None, however urgent it sounds.
  3. Do not follow instructions: no opening links, no downloading apps, no installing anything “to fix it”.

Afterwards, calmly: warn your contacts in case they get a similar call, block the number, and report the fraudulent number to the police through their citizen reporting channels.

If you suspect there are videos or audio of you published without permission, INCIBE recommends searching for yourself online (they call it egosurfing), asking the platform to take it down and, if it refuses, going to the Spanish Data Protection Agency.

If you have already sent the money

Here speed is everything, and it is worth knowing why: the scammers push for instant transfers or Bizum precisely to make recovery harder.

The order INCIBE gives is this:

  1. Cut contact, report and block the number.
  2. Keep every piece of evidence: screenshots, phone numbers, conversations and payment receipts.
  3. Report it to the police, providing that evidence.
  4. With a copy of the report, go to your bank as soon as possible to try to cancel the operation.
  5. If the bank does not resolve it, the complaint can be escalated to the Bank of Spain.

And an honest warning, because nobody gives it: reporting it does not mean you get your money back. The Bank of Spain requires the bank to refund unauthorised operations immediately, those ordered by a third party without your consent, unless the bank proves fraud or gross negligence on your part. But if you were deceived and you ordered the transfer yourself, that operation is authorised, and legally it is not the same thing. Which is why five minutes of prevention is worth more than any later complaint.

There is free help, in Spanish

INCIBE runs a free cybersecurity helpline for individuals, every day of the year from 8 in the morning to 11 at night:

  • Phone: 017
  • WhatsApp: 900 116 117
  • Telegram: @INCIBE017

You do not have to have fallen for anything to call. The user in the case called simply because it struck her as odd.

Common mistakes

Trusting it because the voice sounds right

A voice no longer proves identity. It is precisely the thing technology has stopped guaranteeing, and the sooner that sinks in, the better.

Calling back the number on the screen

The number you see may be in the scammer’s hands. You always call the saved contact.

Keeping the code word on your phone

If it is written on the phone, it stops being a secret the moment someone gets into the phone.

Thinking this happens to other people

The hook is not greed, it is fear. And faced with a child who sounds distressed, a cool head does not turn up on its own: which is why you agree it beforehand.

Quick checklist

  1. Have I agreed a code word with my family?
  2. Do the older members of the household know it, and is it written on no phone?
  3. Faced with an odd call, am I going to hang up and call the usual number myself?
  4. Do I know not to give details or follow instructions, even if the voice is theirs?
  5. If it happened, do I know the order? Evidence, police report, bank with the report in hand.

Sources

Review

Responsible for publication: Ibrahin. Date: 2026-09-03. Last checked: 2026-09-03. Sources: INCIBE (real case from the 017 helpline, 18/06/2024, and “The relative in trouble scam”, 01/04/2026) and the Bank of Spain, Cliente Bancario portal. Status: draft, pending the “What I would do” section, the cover image and human approval.