Scammers Are Calling Grandma and Grandpa

“Grandma, I’ve been in an accident and need help. Can you send money?”

Scammers have been using deceptive tactics like this to target older adults for years. In 2023, the FBI received nearly 200 reports of these so-called “grandparent scams,” resulting in nearly $2 million in reported losses—though the actual number is likely much higher due to underreporting. Recently, law enforcement has made high-profile arrests of these fraudsters, yet the scams continue to evolve. Even Hollywood has taken notice. The recent thriller Thelma begins with a chilling phone call: A scammer impersonates the main character’s grandson using AI-generated deepfake technology, claiming he’s been in a car crash and needs $10,000 for bail. The film is based on a real-life incident that happened to the filmmaker’s grandmother.

Protecting the Extended Family: Countering AI-Enhanced Grandparent Scams

For security awareness professionals, our mission often stops at the corporate perimeter. However, a “whole-of-person” approach to security means helping employees protect their most vulnerable points of contact: their families. The “Grandparent Scam” (or family emergency scam) has evolved from a simple script into a sophisticated, AI-driven threat that exploits the deepest emotional bonds of our workforce’s parents and grandparents. With the advent of AI-driven voice cloning, a scammer can now sound exactly like a distressed grandchild in a car accident or jail, making these attacks nearly impossible to detect through sound alone.

Guidance to Encourage in Your Security Awareness and Training Programs

To help your employees act as the “security leads” for their own families, prioritize these high-impact defensive strategies:

• Establish a Family Code Word: This is the most effective defense against voice cloning. Teach employees to create a secret phrase shared only among family members. If a caller claiming to be a relative in distress cannot provide the code word, it is an immediate signal to hang up.

• The “Hang Up and Verify” Protocol: Scammers rely on keeping the victim on the line to maintain emotional pressure. Instruct family members to hang up immediately—even if the caller sounds like a loved one—and call that relative back directly on a known, trusted phone number.

• Social Media Privacy Hygiene: Scammers “case” families by scraping social media for names, travel plans, and nicknames. Encourage employees to help their older relatives audit their privacy settings and avoid oversharing details that provide “ammunition” for a convincing scam script.

• Identify the “Untraceable” Red Flag: A demand for payment via gift cards, cryptocurrency, or wire transfers is a 100% guarantee of a scam. Legitimate legal or medical entities will never demand immediate payment through these methods.

• Break the Secrecy: Scammers often use a “gag order” or a plea to “not tell my parents” to isolate the victim. Awareness training should emphasize that transparency is the enemy of the fraudster—always check with another family member before acting.

By empowering your employees with these “at-home” security skills, you reinforce the vigilant mindset necessary to protect your organization’s data as well.

Read the full breakdown of grandparent scams and AI voice cloning here: Scammers Are Calling Grandma and Grandpa