Distinguishing fraud from a real emergency: Creating a Safety Passphrase

With the prevalence of fraudsters using social engineering and artificial intelligence (AI) to spoof voices and mobile numbers, creating a secure safety passphrase is vital. The safety passphrase is a unique, pre-staged conversation with unique words that, when used, or when improperly recited, can quickly alert family members to an attempted fraud or real crisis situation. Additionally, for other non-family groups, a safety passphrase can be valuable too. The most common non-familial safety passphrase I advise creating is for school sponsored, international field trips, where the members of that group, including the chaperones and school administrators not on the trip, have a tool to quickly be alerted to a developing danger or recognize a fraud.  

Telephone, texting and email scams have been the staple of criminal fraudsters for decades. Spoofing a family member’s mobile number, texting another family member, falsely reporting an arrest or hospitalization and demanding a quick money transfer to resolve the situation is a common scam. With the current application of AI voice spoofing technologies to make a call sound as though it is a distressed family member on the call, a safety passphrase will assist in quickly triaging an emergency call and potentially revealing a scam.

A safety passphrase is valuable and effective because the unique dialogue isn’t intuitive, so even if the fraudsters have done extensive research on you or your family, through publicly available searches (such as your Instagram or Meta accounts) or even through illegal hacking activity, the safety passphrase will be so obscure or irrational that research won’t provide clues to reveal the correct phrases and sequences. Inasmuch, the safety passphrase also won’t be decipherable through logic or artificial intelligence. One key caveat to securing the safety passphrase is that it’s not placed in the digital domain, that is, don’t email or text it to family members. It goes without saying that the safety passphrase also shouldn’t be discussed outside of the family or group members putting this plan in place.

The safety passphrase isn’t just a cute novelty I’m writing about on LinkedIn; in my 24 year career with the FBI, passphrases and codes were used routinely in our emergency personnel recovery planning where overseas kidnappings and hostage taking were daily threats.

The best safety passphrase will include topics of discussion or references that might typically be woven into a conversation, but not necessarily your family’s conversation. As an example, my family doesn’t own, and never has owned fish as a pet.

If a fraudster were to call or text posing as a family member and implying that that he or she had been arrested and authorities needed $500 wired (or sent through crypto, a payment app or some other method), our reply would include our family safety passphrase: “Do you need me to feed your fish?” 

Unless we receive the reply, “you know Nemo died on my birthday,” I will be suspicious that the person on the other end of the communications is not my family member. This safety passphrase is sufficient enough to raise concerns and prompt further investigation.

The other application of the safety passphrase allows a family member to covertly signal for help. In our situation, a text reading “I need somebody to feed my fish” from my daughter would be an indicator that she needs intervention or help. Our reply to let her know we were springing into some form of action would be, “Ok, I know you’ve loved Nemo ever since you got it on your birthday.”

Please note that the safety passphrase isn’t an exact recitation of dialogue, but instead, a contextual combination of words. In the initial communication, the words feed and fish are present—those are the key elements of the phrase—along with a request to have the fish fed. Under stress, a family member might communicate “feed the fish” rather than “feed my fish.” You don’t want to complicate this simple triage tool having to wonder if the use of “the” instead of “my” is relevant or not, because it probably isn’t.

Similarly, in the reply, Nemo and birthday are present---those are the key words. Because every crisis scenario is different, there needs to be some flexibility in the response. It would sound odd to have my daughter ask me to feed her fish and then reply “I thought the fish had died”---it may alert a savvy abductor, therefore my reply still uses Nemo and birthday to convey that her message has been received.  

I wouldn’t dismiss creating additional, longer, more complex safety pass codes, but I discourage them because it diminishes the simplicity and effectiveness of the primary purpose of the safety passphrase concept, which is to alert family members or some other defined group to an attempted fraud or crisis situation. Also, if an actual scenario is unfolding where a family member is in a true crisis, the ability recall multiple stages of the passphrase while under stress may be difficult.

The safety passphrase is a simple tool used to quickly triage a voice, text, email or other communication where pressure, either from the fraudsters or a family member in the midst of a true emergency, will require quick and deliberate action. Have this discussion with your family members or specific group, but remember, do it in person or over a call; don’t leave a digital trace in text or email communications.

This article is provided for personal use and should not be considered legal advice. The author holds no liability for actions taken as a result of this article.