The phone rings. On the line is the voice of your son, or your granddaughter, or a brother who lives abroad. The voice sounds stressed: there was an accident, or he was arrested, or he lost his wallet. He needs money now, by fast transfer, and don't tell anyone. Except it isn't him. It is an AI-generated voice built from a few seconds of audio taken from a social media video or a voice message.
This scenario no longer belongs to science fiction. Tools for cloning voices and producing fake videos are available to anyone, some for free, and they keep improving. The head of the Israel Police cyber unit, Chief Superintendent David Katz, has warned that criminal organizations in Israel are already adopting AI for impersonation and extortion, and that the threat is active, not theoretical. In May the Israel National Cyber Directorate issued an urgent warning about a scam using deepfake videos of Chief Rabbi David Yosef to lure people to fake sites that steal personal and payment details.
The good news is that most of these scams, even the most sophisticated, rely on the same old psychological tricks: pressure, urgency, secrecy and fear. Even better: a few simple steps, taking less than an hour, can protect most of the family from most scenarios. This guide explains what has changed, why it works, and exactly what to do.
What has changed
In the past you could spot a phishing message by its broken language, blurry logo or strange sender. AI imitates all of that away. It writes fluent text, adapts its style to the recipient, and can weave in real details about you gathered online or from data leaks. In recent weeks, for example, a breach was reported at Amadeus, the booking-system provider for many airlines, exposing passengers' booking references, names and flight details. That is perfect raw material for a fake message that appears to come from the airline.
Voices and faces are no longer proof either. A few seconds of audio can be enough to clone a voice; a handful of existing photos and videos can be enough to fake a video of a familiar person. The result is not always perfect, but on a stressful phone call in the middle of the night, with a voice that sounds like someone you love, few people stop to check the audio quality.
The three common scenarios
The first is 'family member in trouble': a call or voice message from someone who sounds like a relative, urgently asking for money. The second is 'authority figure': a video or message from someone who looks like a celebrity, rabbi, politician or bank manager recommending an investment, app or link. In Israel, investors lost hundreds of thousands of shekels in a scheme in which fake ads impersonated public figures to pump a stock and then crash it.
The third is 'official body': a message that looks like it is from the bank, the card company, Israel Post, an airline or a government agency, with a link to pay, update details or 'verify' an account. This scenario is old, but AI makes it far more convincing and lets attackers send thousands of different versions, each tailored to its recipient.
Ten steps for this weekend
Step one, the most important: set a family code word. A word or phrase only close family knows and that does not appear online. If someone calls in a relative's name urgently asking for money, ask for the code word. It sounds too simple, but it is one of the most effective defenses against voice cloning, because AI can imitate a voice but cannot know a secret that was never said in public.
Step two: hang up and call back. If you get an alarming call, even from a number that looks familiar, hang up and call the number saved in your phone yourself. Numbers can be spoofed, and they are. Thirty seconds of checking beats a transfer that cannot be reversed.
Step three: never hand over codes. Your bank, card company, WhatsApp and Google will never ask you to read out a verification code you received by SMS. The Bank of Israel explicitly advises never sharing verification codes or sensitive data. Anyone asking for such a code is almost always an impostor.
Step four: turn on two-step verification wherever you can, especially for WhatsApp, email and your bank. In WhatsApp it is under Settings, Account, Two-step verification, and it stops someone from taking over your account even if they tricked you into giving up the SMS code. Where passkeys are offered, use them; they are much harder to steal than a password.
Step five: slow down. Almost every scam relies on urgency: 'now', 'within an hour', 'or your account will be blocked'. When someone pressures you to act fast, that is exactly the moment to stop. A real organization will give you time to check.
Step six: don't click links in messages. Even if the message looks entirely genuine, go to the website or app yourself through your browser or the official app. If there is a real problem with your account, you will see it there.
Step seven: beware of investment tips on social media. A video of a celebrity recommending a stock, crypto or a trading app is almost always a scam, even if it looks completely real. Real public figures do not personally recommend investments to you in Facebook ads.
Step eight: talk to your parents. Older relatives are not the only target, but they are a preferred one, partly because they are more likely to answer unknown numbers and to trust a familiar voice. A fifteen-minute talk explaining the scenarios and agreeing on the code word can save a lot of money and pain.
Step nine: talk to your children too. Children and teenagers are targets for other kinds of scams, such as extortion with fake images or 'work from home' offers. They need to know that if something like this happens, they can tell you without fear of punishment. Most extortion damage happens because the victim is too ashamed to tell.
Step ten: know where to turn. If you suspect a scam, or fell for one, contact your bank or card company immediately to try to stop the transfer, and report it to the National Cyber Directorate's 119 hotline and to the police. Speed matters: sometimes a transfer can be stopped if you act within minutes or hours.
What about what we post? There is no need to vanish from the internet, but it is worth thinking before posting long videos of yourself talking to the camera, or voice messages to open groups. Check your privacy settings on Facebook, Instagram and TikTok and limit who can see your friends list and family details. The less information an attacker has about you, the harder it is to build a convincing story.
Anyone running a business, even a small one, should know they are a preferred target. The 'fake CEO' scam, in which an employee gets a call or message from the 'boss' asking for an urgent transfer to a new supplier, has existed for years, but with a cloned voice it is far more convincing. The rule is simple: every request to transfer money or change a supplier's bank details is verified by calling back a known number, ideally with a second person's approval. No real manager will be offended by that.
Most important
There is no need to panic. Most calls and messages you receive are genuine, and most people will not fall for a sophisticated scam. But the world has changed, and the old instinct, 'I know that voice, so it must be him', is no longer enough. The best defense is not technology but a habit: stop, check, and ask a question only the real person can answer. This coming Friday dinner is a good time to set it up.
