A call comes from what sounds exactly like your brother. He has been in an accident, the police are involved, and he needs ₹20,000 on UPI right now. The voice is his. It might not be him. On 16 October 2026, State Bank of India warned customers that fraudsters are using AI to clone the voices of relatives and officials, and said that "simply recognising a familiar voice over the telephone is no longer sufficient proof of a caller's true identity."
That sentence is the whole point. Here is how the scam works, why it is so convincing, and the one habit that defeats it: a family safe word.
How AI voice-cloning scams work
Voice cloning software can produce a convincing copy of someone's voice from a short recording. The US Federal Trade Commission explained the basic method in a consumer alert: a scammer needs only "a short audio clip of your family member's voice," which can come from content posted online, and a voice-cloning program. When they call, the voice sounds like the person you know.
Where does the clip come from? Think about how much of your family's voice is already public: Instagram reels, YouTube videos, WhatsApp voice notes forwarded to groups, a recorded speech at a wedding. SBI's January 2026 warning, reported by Angel One, noted that fraudsters gather personal information from social media and public sources before they strike, so they often know names, relationships and where someone is travelling.
Then comes the script. According to SBI's October advisory, as reported by The420.in, the usual stories are:
A road accident that needs money for a hospital or a "settlement."
A police detention, with a demand for "bail" or a fine.
Trouble while travelling: a lost wallet, a stuck booking, a problem at an airport.
A caller posing as a bank, regulator or police official, citing "verification" or a "criminal case" and threatening penalties unless you pay or share details.
Why this scam works on careful people
Most scam advice teaches you to spot something off: bad grammar, a strange link, an unknown number. This one removes those signals. The voice is familiar, the story is plausible, and the emotion is real.
The attacker relies on three things:
Urgency. You are told there is no time, so you do not stop to check.
Fear for someone you love. Your instinct is to help first and ask questions later.
No time to check. SBI notes that the pressure is designed to stop you verifying the story with the rest of the family, the one step that would expose the lie.
Once you understand that, the defence is obvious. You need a way to check identity that does not depend on the voice, and you need permission, agreed in advance, to slow down.
Do this today: set up a family safe word
SBI's advisory recommends setting up private verification phrases within families for emergencies. It takes ten minutes, and it is the single most effective step.
Pick a word or short phrase that is easy to remember and impossible to guess from social media. Not a pet's name, not a birthday, not the family surname. Something odd works best: a food nobody likes, an in-joke.
Share it in person or on a call, not in the family WhatsApp group. Group chats get forwarded and phones get lost.
Agree the rule out loud: "If anyone calls asking for money in an emergency, I will ask for the word. If you can't say it, I will hang up and call you back. I won't be offended, and neither will you."
Include the people most likely to be targeted, especially parents and grandparents. SBI has flagged senior citizens and first-time digital users as more vulnerable.
Change it if you think it has leaked, or once a year anyway.
What to do if you get a call like this
Keep this short enough to remember under stress:
Do not pay during the call. No real emergency is made worse by a three-minute check.
Ask for the safe word. If they cannot say it, or they get angry that you asked, you have your answer.
Hang up and call back on the number saved in your phone, not one the caller gives you. If you cannot reach them, call another family member or a friend who would know where they are.
Never share an OTP, UPI PIN, card PIN or CVV, even if the caller says they are from your bank or the police. SBI's advisory is explicit on this.
If you have already sent money, call your bank immediately and report it on the national cybercrime helpline, 1930, or at cybercrime.gov.in. Quick reporting gives the best chance of the money being stopped.
Reduce how easy you are to clone
You cannot remove your family's voice from the internet, but you can make the attacker's job harder:
Set personal Instagram and Facebook accounts to private, especially if they include video of you talking.
Avoid posting real-time travel details. "Just landed in Goa!" tells a scammer exactly which story to use.
Keep calls from unknown numbers short. There is no reason to give a stranger a long sample of your voice.
Voice cloning makes a familiar trick sound far more convincing, but it has not changed the basic weakness of the scam: it falls apart the moment you check. Set up the safe word this week, tell your parents why, and give everyone in the family permission to hang up and call back.
