Family Code Word: How to Choose One Scammers Can't Beat
The FBI has one piece of advice it repeats in every briefing on AI voice cloning: agree on a family code word. The 2026 U.S. Senate report on AI and older Americans repeats it too. It's free, it takes five minutes, and it works — which is exactly why scammers have started planning around it.
This guide covers the whole setup: how to pick a word, where to keep it, how to drill it with your family — and, honestly, where a static code word fails against a clone that costs a scammer $30 a week to run.
What a family code word actually is
A pre-agreed secret word or phrase. When someone calls claiming to be your son, your mother, your grandchild — especially with an emergency involving money — the person who answers asks for the word. The real person knows it. A clone, no matter how perfect the voice, cannot.
If anyone calls sounding like one of us in trouble, ask for the family word. Then hang up and call us back on our normal number, no matter what the caller says.
That two-sentence script is the entire defense. Everything else is detail.
How to choose a good code word
Not all words are equal. A good code word is:
- Unguessable from public information. Not a pet's name, birthday, street, school, team, or anything that appears in your family's social media history.
- Not a security answer. Mother's maiden name, first car, high school mascot — these are sold in five-dollar background checks. If a stranger can buy it, it isn't a signal.
- Memorable under stress. A frightened 70-year-old has to recall it while her heart pounds. A private joke beats an abstract phrase; two unrelated words ("marble umbrella") beat both.
- Sayable over bad signal. No tricky spelling, no rhymes that collapse on a weak line.
- Never written down digitally. Not in a text, a shared note app, or an email — anything synced to the cloud gets breached eventually. Paper at home is fine.
Choose it together, in person, phones down. People protect what they helped create.
Where a static code word fails
Here is the uncomfortable part every "pick a word" guide skips. A static word is a single secret that lives forever, and secrets that live forever leak:
| Failure mode | How it happens |
|---|---|
| Overheard | Said on speakerphone, in a car with guests, at a family dinner someone recorded. One hearing is enough — from then on, the word works for the scammer too. |
| Learned | Scammers rehearse victims: "grandpa, what's our code word again?" on a call two months before the real attack. The victim verifies them. |
| Leaked from a device | The word sits in a notes app or family chat; that device or account is compromised years later. The word has no expiry date. |
| Reused forever | Families pick a word once and never rotate it. After any suspicion, the word should be dead that evening — most families never do this. |
These aren't hypotheticals; they're the standard failure paths of any static credential — the reason banks stopped issuing fixed PINs in favor of rotating codes.
The upgrade: a code word that rotates
The fix is the same one security engineering learned decades ago: don't protect a secret that never changes — use codes that expire.
FamWord applies that idea to the family code word. Every family phone shows the same three simple words — "cactus, window, orbit" — and every 30 seconds all three change together, derived from a secret that lives only on your phones:
- A clone can't learn what changes every 30 seconds. Yesterday's words don't open today's call.
- Nothing is stored in the cloud, so nothing leaks from ours. The family secret never leaves the phones.
- No accounts, no phone numbers — setup is a QR scan, face to face, five minutes.
- Works fully offline during the call, like a bank token that needs no signal.
Physical code-word kits exist too — a fridge card plus a private hotline, roughly $59 plus a $19 annual fee. They protect one static word. The rotating version costs $9.99 once, needs no delivery, and the word defends itself.
The 5-minute setup, step by step
- Gather the phones. Everyone who might be called in an "emergency": parents, grandparents, adult children, the babysitter.
- Create the family on one phone (FamWord or a paper word — the drill is the same).
- Scan the QR code on each family phone. From this moment every screen shows the same words.
- Agree on the rule out loud: "Any unexpected call about an emergency or money gets the word question. No word, no money — hang up and call back."
- Drill it once. A 30-second fake call at the dinner table: "Hi Mom, quick check — what are your words?" First time anyone asks must not be the moment hearts are pounding.
FAQ
Where should we store the code word?
In people's heads or on paper at home. Never in a text, shared note, or email — anything synced to the cloud can be read in a data breach. FamWord's words live only on the family's phones and rotate, so there is nothing static to store.
How often should it change?
Immediately if it was ever said on a suspicious call, plus a refresh every 6-12 months. With FamWord the rotation is automatic: three new words every 30 seconds.
Can't a scammer just overhear it once?
Once is fatal for a static word — it can be reused forever after. For rotating words it's useless: the overheard words die in 30 seconds.
What if my parent isn't good with technology?
They only read three words aloud. The setup is done for them, on their phone, in person — the entire interaction during a call is "say the words on your screen."
What if they don't know the word?
Hang up, then call back on a number you already have saved. Never accept a callback number from the caller, and never stay on the line "because the lawyer is waiting."
Set up rotating family words in 5 minutes
FamWord gives your whole family the same three simple words, changing every 30 seconds. QR setup, works offline, no accounts. Free for 7 days, then $9.99 once for everyone.
Try FamWord free →