‘Hi Mum’ scams now come with a cloned voice: how to protect your family from the new wave of fraud

The text message that begins “Hi Mum, I’ve lost my phone” has been a staple of fraud for five years. This autumn it has acquired a voice. Banks and police say criminals are increasingly using software that clones a relative’s voice from a few seconds of audio taken from social media, then calling parents and grandparents to ask for money in an emergency.

UK Finance, the banking trade body, said losses to impersonation fraud rose 38% in the first six months of the year to £96m, and that voice-cloned calls, which barely featured in its data in 2024, now account for about one in eight reported cases. The average loss is £4,200. Victims are overwhelmingly over 60.

The pattern is consistent. The call comes from an unknown number, which the caller explains away: a borrowed phone, a cracked screen, a police station. The voice is distressed and the story urgent: a car crash, an arrest abroad, a hospital bill, a landlord threatening eviction. The caller asks for money to be sent to an account “a friend” has lent them, and asks the victim not to tell anyone else. Sometimes a second person comes on the line claiming to be a police officer or a lawyer.

“The technology has changed but the psychology has not,” said Detective Inspector Rachel Coombes of the City of London police, which leads on fraud nationally. “It is urgency, secrecy and a request for money by an unusual route, every time. If you hear those three things together, it is a scam, however much it sounds like your daughter.”

The single most effective defence is a family password: a word or phrase agreed in advance that a relative in real trouble would be able to give, and a fraudster could not. Banks have been promoting the idea for a year, and the police say they have yet to see a case in which a victim with a password lost money. If no password exists, hang up and call the relative back on the number already saved in your phone. A genuine emergency survives a two-minute delay.

Margaret Ellison, 74, from Harrogate, received a call in August from a voice she was certain was her grandson, saying he had been arrested in Lisbon and needed £3,000 for a lawyer. “It was him,” she said. “The way he said ‘Gran’, the little catch in his voice when he is upset. I had the banking app open. The only reason I stopped was that my neighbour had told me about a family password the week before, and I asked for it, and the line went dead.”

Banks are required under rules introduced in 2024 to reimburse most victims of authorised push payment fraud up to £85,000, provided the victim was not grossly negligent. Most refuse to treat falling for a voice clone as negligence, but the process can take weeks, and anyone who has sent money should call their bank immediately on 159, the fraud hotline that connects to most major banks, as recovery is far more likely within the first hour.

Reducing the raw material helps too. Voice cloning needs only a few seconds of clear speech, which most people have posted publicly in videos. Setting social media accounts to private does not stop a determined fraudster but removes the easiest targets. “They are not choosing you because you are special,” DI Coombes said. “They are choosing you because the audio was there and your number was in a leaked database. Make it harder and they move on.”