Of all the AI-related risks on this site, this is the one that's already happening — not in some hypothetical future. The FTC and the FBI's Internet Crime Complaint Center (IC3) have been warning for over a year about scammers using AI to clone voices and generate convincing fake emergencies. During a real disaster, when people are frightened and information is scarce, these scams get more effective, not less. The good news: the defenses are mostly free.
The Three Scams to Know
1. The voice-clone "family emergency" call. A scammer scrapes a few seconds of a family member's voice — often from social media, where people post plenty of clean audio — and uses AI to clone it. They call pretending to be that relative in a crisis: a car accident, an arrest, a medical emergency, being stranded. They're rushed, emotional, and they need money right now, usually by wire transfer, gift cards, or a payment app. The voice sounds exactly right. The story is plausible. The urgency is the trap.
2. Fake relief and charity scams. After any widely-covered disaster, fake fundraisers appear — on social media, in DMs, and via spoofed emails. Some are outright fraud; others are real-looking GoFundMe clones. During an emergency, when people want to help, these multiply. AI makes generating convincing appeals and fake news articles cheap and fast.
3. Fake evacuation info and emergency alerts. During a crisis, social media fills with both genuine help and fabricated instructions — fake evacuation orders, fake shelter locations, "this road is open" posts for roads that are closed. AI makes generating convincing fake text, images, and audio easy, so the volume of junk goes up. Acting on bad info during an evacuation is genuinely dangerous.
The Free Defense: A Family Code Word
This is the single highest-value thing you can do, and it costs nothing. Agree on a secret code word that only your household knows — something not guessable from your social media. The rule: any call, text, or message claiming to be family and asking for money, personal information, or a favor gets the code word test. If the caller doesn't know it, it's not them. Period.
Then verify through a second channel. Hang up and call the person back on the number you already have for them. If the "emergency" is real, they'll pick up. If a scammer is spoofing caller ID, calling the real number reaches the real person, who will (usually) be fine. The second-channel rule defeats nearly every version of this scam, because scammers rely on you staying on their call.
Teach this to older relatives and kids especially — they're the most common targets, and the defense is simple enough to explain in two minutes.
Locking Down Your Accounts
The other flavor of AI scam is account takeover — using AI-assisted phishing or leaked passwords to get into your email, bank, or social accounts, then using that access to scam your contacts (who trust you). The defenses:
- A password manager (1Password, Bitwarden) so you're not reusing passwords across sites. Reused passwords are how most account takeovers happen. Bitwarden has a solid free tier.
- A hardware security key (YubiKey) for your most important accounts (email, bank). A hardware key can't be phished the way a texted code can, which matters now that AI phishing is convincing. It's the strongest two-factor option available.
- Turn on two-factor authentication everywhere it's offered, even if you're not ready for a hardware key yet. Something is far better than nothing.
Giving Safely After a Disaster
If you want to donate after a disaster:
- Give to established, vetted organizations (the Red Cross, Direct Relief, GlobalGiving, local food banks) directly through their official websites — not through links in DMs or posts.
- Be wary of brand-new fundraisers with no track record, especially ones that pressure you to give "before it's too late."
- Confirm a charity's legitimacy via Charity Navigator or GiveWell before giving.
Verifying Emergency Information
During a crisis, treat unverified social media as tips to confirm, not facts to act on. Get your emergency information from:
- NOAA weather radio and official NWS feeds.
- Your local emergency management agency (county or city).
- Official government accounts (FEMA, state emergency management), not look-alike accounts.
- A battery radio if cell and internet are down. See our offline communication gear guide.
If you see an evacuation order or a road-closure post, confirm it through one of these before you move. Acting on fake info during an evacuation is how people end up driving into the hazard.
The Free Checklist First
Before you buy anything, do these — they close most of the gap:
- Agree on a family code word and write it down somewhere secure.
- Make the second-channel rule a household habit — hang up and call back on a known number.
- Turn on two-factor authentication on email, bank, and social accounts.
- Tell older relatives and kids about voice-clone scams in plain language.
- Bookmark your local emergency management agency and NOAA.
What to Buy (After the Free Steps)
- Hardware security key (YubiKey) ($25–$60) — for your email and bank accounts; the strongest defense against AI phishing. Check on Amazon →
- Password manager (1Password or Bitwarden) — for anyone reusing passwords; Bitwarden's free tier is enough to start. 1Password on Amazon → · Bitwarden (free) →
- NOAA hand-crank radio ($30–$60) — for verifying official info when the internet is unreliable. Check on Amazon →
The free steps matter more than the products. Do those first.
FAQ
How do AI voice-clone scams work? A scammer collects a few seconds of someone's voice — often from public social-media video — and uses AI to clone it. They then call pretending to be that person in an emergency, demanding urgent money. The voice sounds real, which is why the defense is behavioral (a code word and a callback), not technological.
What's a family code word and how do I set one up? Pick a word or phrase only your household knows — not guessable from your posts. Agree that any call asking for money or personal info requires the caller to know it. If they don't, hang up and call the person back on a known number. Write it down somewhere secure and tell every family member.
How can I tell if a charity is legitimate after a disaster? Check it on Charity Navigator or GiveWell, and give through the organization's official website, not links in DMs or social posts. Be wary of brand-new fundraisers that pressure you to give immediately.
Are AI deepfakes used to fake evacuation orders? Yes — fabricated emergency information appears during real crises, and AI makes generating convincing fake text and audio cheap. Always confirm evacuation orders and road closures through official channels (NOAA radio, your local emergency management agency) before acting.
Is a hardware security key worth it? For your email and bank accounts, yes — it's the strongest two-factor option and can't be phished the way texted codes can. If you're not ready for one, at least turn on any two-factor authentication; something is far better than nothing.
Related: how AI could worsen a disaster, internet outage preparedness, offline communication gear, and family emergency communication plan.