The "Mum, I have lost my phone" scam

A message from an unknown number: *Mum, I have lost my phone, this is my new number.* Then a problem, then a payment that needs making today.

This is an old scam. What changed is that a few seconds of someone's voice from a video they posted is now enough to clone it, so it can arrive as a voice note, or a phone call, in your child's actual voice, crying.

Every piece of advice built on "you would know their voice" stopped working.

The pattern underneath

It has not changed, which is the good news:

1. Contact from a number you do not recognise, explaining why. 2. Distress, and a reason it is urgent. An accident, a phone stolen abroad, a bill that will bounce. 3. A payment that must happen now, usually by bank transfer, sometimes to "a friend's account". 4. A reason not to check. They cannot talk. The phone is nearly dead. Please do not tell Dad.

Point four is the one to hold on to. Every version of this scam contains a reason you should not do the one thing that would end it.

The thing that still works

Agree a family password. One word, chosen together, never written down anywhere online, never used for anything else. Anyone claiming an emergency has to say it.

Set it up over Sunday lunch. It takes a minute, it works on grandparents and teenagers alike, and it defeats a perfect voice clone completely, because a cloned voice does not know it.

If you have not agreed one and you get the call: hang up and ring the number you already have for them. Not the number that contacted you. If they genuinely have no phone, ring someone who would know where they are. The ten seconds of awkwardness if it turns out to be real is worth nothing against the alternative.

Ask something the internet does not know

If you cannot agree a password in advance, ask something only they could answer, and make it specific: not "what is my middle name" — findable — but "what did we have for dinner on Tuesday" or "what is the dog scared of".

Reduce what is available

Voice cloning needs a sample. Public videos of your children talking are the supply. Locking down who can see them is worth doing, and is also a losing battle in a family with teenagers, which is why the password matters more.

If you have already paid

Ring your bank immediately and say the words "authorised push payment fraud" — that phrase starts the right process. There is more on what happens next in getting your money back. Then report it to Action Fraud.