While corporate phishing targets logins and treasury, family impersonation targets emotion: fear, shame, empathy. No fancy malware is required — just a compelling story and one transfer or OTP.
Plots repeat worldwide: “grandchild had an accident and needs bail”, “I’m abroad, wallet stolen, wire the hotel deposit”, or “Dad, new phone — send me the bank code”. Common threads: urgency + “don’t call my old number” (“phone broken,” “I’m with police”).
Why smart people still fall for it
Stress suppresses critical thinking. If the voice sounds like your grandchild and mentions school details (often public on social media), your brain fills in the rest. Scammers exploit respect for authority and the urge to help.
On WhatsApp, a stolen account sends messages in your contact’s name with their photo — message content alone does not prove identity. Use a shared secret nobody can Google, or call a number you already saved (not the “new number” from chat).
Household rules that work
- A family safeword for real emergencies.
- Hang up and call back on a stored number.
- Never relay SMS codes — banks do not ask you to forward OTPs to “verify” someone.
- Reduce public travel and family breadcrumbs scammers weave into stories.
Synthetic voice and deepfakes
Voice cloning from short clips is increasingly accessible. Fake voice + late-night panic can feel undeniable. Defense stays the same: no instant money moves, call back on a known number, ask something only the real person knows (and is not online).
At work, “the CEO” e-mailing from a personal address for an urgent wire is parallel. Dual approval and no payment changes without callback to a stored number block even polished scams.
If money already moved
Contact your bank immediately (payment recall where possible), law enforcement, and your national fraud reporting line. Earlier reporting improves tracing odds. Preserve screenshots and sender IDs.
Related: vishing, smishing, passwords and MFA.