Mom, Don't Wire That Money: The 6-Word Rule That Stops a $1M Deepfake Cold

Her name was Judy Skene. She was an elderly widow with no children nearby. She saw a video on Facebook — a crisp, convincing clip of Canadian Prime Minister Mark Carney endorsing a cryptocurrency investment opportunity. She trusted what she saw. She lost nearly a million dollars. And according to OrilliaMatters.com, the Canadian Anti-Fraud Centre says incidents exactly like this are becoming increasingly common.

Here's what should actually scare you. Not the technology itself. The technology is just a tool. What should scare you is that every habit you've built to protect yourself — recognize the face, trust the voice, believe the urgency — was designed for a world where faking someone's appearance in real time was basically impossible. That world is gone. The habits are still here.

Mark Carney didn't record that video. He had no idea it existed. Someone fed an AI system real footage of him speaking, and the machine produced a brand-new clip — his face, his mannerisms, his vocal patterns — endorsing something he'd never touched. Judy Skene had no reason to question it. Neither would most of us.

The Numbers Are Worse Than You've Heard

Fraud and cybercrime cost Canadians $638 million in 2024. Nearly 40 percent of those losses came from people over 60. That stat alone would be bad enough. But zoom out to the U.S. and the picture gets darker fast.

Read that last part again. Fewer than 5 percent of voice-clone victims report their loss. Which means the $893 million figure is almost certainly a fraction of what's actually happening. The real number is invisible — paid out quietly, in shame, by people who are too embarrassed or too confused to file a report.

According to a Business Wire report on the Hiya State of the Call 2026 survey, one in four Americans say they've already received a deepfake voice call in the past twelve months. Seniors over 55 are losing an average of $1,298 per phone scam — triple what younger adults lose. And a voice clone convincing enough to fool a family member can be built from as little as three seconds of audio. Three seconds. Think about the last voicemail you left someone. This article is part of a series — start with Age Verification Identity Data Security Risks.

You Can't Out-Detect This With Your Eyes

There's a tempting response to all of this: "I'd spot a fake." Most people believe that. Most people are wrong.

"Americans are failing the deepfake test — even when they think they're winning." — Veriff Deepfakes Report 2026, via GlobeNewswire

That report found that when U.S. respondents were asked to tell real videos from AI-generated fakes, they scored an average of 0.07 on a scale from -1 to 1. That's basically the same as random guessing. Seventy percent of people looked at a deepfake video of a woman and called it real. Not a fringe group. Seventy percent.

And if you think the answer is "well, video calls are safer than static videos" — consider what happened at a firm called Arup. A finance employee got on a video call with his CFO and several colleagues. Everyone gave the green light on a large transfer. He sent $25.6 million. Every single person on that call, including the CFO, was an AI-generated deepfake. The live, interactive format overcame his initial hesitation entirely. (That detail, documented by CybelAngel, is worth sitting with for a moment. A whole fake meeting. In real time.)

TV presenter Piers Morgan recently shared that an AI deepfake of him — one he didn't create and never approved — was convincing enough to fool his own mother. His mother. The person who has known his face and voice his entire life.

The One Rule That Actually Works

Here's the thing about the Judy Skene case that most coverage misses. The deepfake didn't win because it was technically perfect. It won because it hit the right emotional triggers — authority, credibility, urgency, opportunity — and there was no second check in place.

The defense isn't sharper eyes. You don't have them. Nobody does. The defense is a behavioral rule, applied without exception: Previously in this series: Your Face Is Now Your Boarding Pass Good Luck Getting It Bac.

Emotional urgency + money request = stop, hang up, and call back on a number you already have saved.

That's it. That's the whole protocol. Not because you're suspicious of your family. Because the person telling you to act right now and not hang up is betting you won't. The second you hang up and dial a number you control, the scam collapses. A deepfake voice can't follow you to a different phone number.

Families who've thought about this ahead of time add one more layer: a code word. A silly, specific, private phrase that no one outside the family knows — agreed on calmly, not in a crisis. Something the AI can't guess from social media, old voicemails, or public footage. State of Surveillance flags exactly this as one of the only reliably scam-proof verification methods available to regular people right now. Not an app. Not a setting. A word you agree on over dinner.

This isn't paranoia. It's the same reason you have a fire escape plan. You don't expect a fire. You make a plan anyway.

What "Verify" Looks Like at Scale

Individual families need code words. Institutions need something more systematic. And this is where the parallel gets interesting — because the same trust problem that showed up in Judy Skene's living room also shows up in corporate finance departments, law enforcement case files, and online identity checks.

The core issue, whether you're a retiree or a fraud investigator, is identical: presentation quality is no longer proof of identity. A convincing face used to mean something. Now it means someone has access to decent software. What matters is whether the identity was verified through an independent channel — one the scammer doesn't control. Up next: Your Face Cant Be Reset The Hidden Cost Of Proving Youre Ove.

Investigators who work with facial comparison tools (software that cross-references images systematically, the way a detective might compare a suspect photo against records — but faster and without the human biases that make us say "yeah, that looks right") are essentially running the institutional version of a family code word: they're refusing to take visual "proof" at face value and instead demanding a repeatable, documented verification process. If you've ever wondered whether a photo or profile is really who it claims to be, that's the exact question this kind of systematic comparison exists to answer — not to replace human judgment, but to give it a reliable foundation instead of a gut feeling.

This week, sit down with whoever you'd call in an emergency — or whoever would call you — and agree on a code word. Make it weird enough that no AI trained on your social media posts would guess it. "Pineapple" won't cut it. "The summer we rented the orange kayak" is better. Then share this with them. Not because Judy Skene's story will happen to you, exactly. But because the scammers running these operations are counting on the fact that you never had this conversation.

The Canadian Anti-Fraud Centre says these scams are increasingly common. They are correct. But the scam only works because most families are still living by rules written for a world where a familiar face meant a safe call. That world closed quietly, without an announcement — and nearly a million dollars walked out the door with it.

So here's the question worth asking your family this week, not in a scary way but in a "what would we actually do" way: If your mom called in a panic asking you to wire money right now, what would you do before you did it? If the honest answer is "probably send it" — you just found your gap.