Threat Alert: AI Kidnapping Scams

Law enforcement agencies are warning people about the possibility of AI kidnapping scams. Let’s take a look at how these scams leverage your deepest fears against you, as well as the surprisingly easy solution to protect yourself. 

What are AI kidnapping scams? 

Imagine you receive a call from an unknown number. An unfamiliar voice on the other end tells you the caller has kidnapped one of your friends or relatives and will kill them if you don’t pay. 

At first, you don’t believe it — until you hear your loved one’s voice on the phone pleading for help. You pay the $5,000. It all happens so fast. In reality, your relative was never kidnapped, and you’ve been scammed. 

That’s exactly what happened to Deborah. She paid a scammer $5,000 to secure the safety of her daughter after receiving a ransom call that included her daughter’s panicked voice. 

AI kidnapping scams are effective because they target big emotions, but the mechanics are the same as many other scams where the goal is to create a sense of urgency. To get you to act before you have a chance to think. Cybercriminals especially seem to target parents and grandparents, and you don’t have to be wealthy or important to gain their notice. 

You just have to be easy to find online. 

How do AI kidnapping scams start? 

The con starts long before you accept that call from an unknown number, and it comes in three basic stages. 

1. Step one: Reconnaissance

The threat actor begins researching your life and relatives to find a weak point. One common source is social media with poor privacy settings. Another major resource for this kind of reconnaissance is people search sites, also known as data brokers. 

Data brokers are the bigger problem because they collect your personal information from a variety of sources, including public records, the apps on your phone and many other sources. They compile that data, creating detailed profiles, and share it with anyone who is willing to pay. As a result, a fake kidnapper can easily obtain your phone number, your family members’ phone numbers, ages, names, social media handles, and much more. 

2. Step two: Obtain a voice recording

Once a fake kidnapper has your phone number and information on your relatives, the real work starts. The cybercriminal needs a recording of the “kidnapping victim’s” voice in order to make the scam convincing. 

Just three seconds of audio is enough to create a convincing voice deepfake. That means a 30-second video on social media or a short voicemail box message is more than enough. Cybercriminals can also call your relatives and pretend it’s a wrong number while recording the conversation. 

3. Step three: Call from a spoofed or unknown number

Cybercriminals spoof legitimate phone numbers, including those of your relatives. But often, these scams aren’t quite that sophisticated. You’ll likely see a call from an unknown number, possibly from a foreign country, and when you pick up, the con starts. 

The fake kidnapper will tell you that your relative or friend is in immediate danger and won’t be returned to you unless you pay. Often, they will ask that you pay in the form of bitcoin or gift cards. If they do ask for gift cards, they won’t meet you face-to-face; they’ll just ask for the numbers off the back, drain the cards, and vanish with the money. 

Cybercriminals will often keep asking for money until you’re wise to the scam. For Deborah, that cost $5,000. For others, it could be their entire life savings. 

How to prevent AI kidnapping scams

Most people haven’t even heard about the “AI voice kidnapping scam,” so of course they’re unprepared. You don’t have to be. 

1. Create a family safe word. Your family members should have a specific word they can say if they’re in serious trouble. If the would-be kidnapping victim doesn’t say that word, you know it’s a scammer on the other end of the line. 
2. Automate your voicemail box message. When you set up your voicemail box, don’t record a new message. The default message is a robotic voice that can’t be used against you in an AI deepfake scam. 
3. Keep your information off data broker sites. Let us help you start to remove your personal information from the internet, or check out our DIY opt-out guides to start shrinking your digital footprint manually. Be warned: data brokers regularly reupload profiles, so you’ll need to keep checking back to make sure you stay private. 
4. Audit your social media profiles. We all love to share about our family members and friends on our social media. The problem is, that’s exactly what cybercriminals are looking for. Set your profiles to private and reduce the amount of information you share. 
5. Warn your relatives. It’s no surprise that many are falling for this kind of scam. How many people have even heard of AI voice deepfakes or fake kidnappings? You can help your loved ones protect their finances by educating them about the latest threats. 

If you do run across an AI kidnapping scam, keep a cool head. Ask for a safe word. If it’s a scam, hang up and report it to the IC3 and any other relevant authorities. 

AI kidnapping scam FAQs

If the above didn’t answer your questions or you just want the quick version, read through our Q&A below. 

1. What is an AI kidnapping scam? 

An AI kidnapping scam occurs when a cybercriminal uses a deepfaked recording of your relative’s voice to try to convince you to pay a ransom. 

2. What should I do if I get a fake kidnapping call? 

Ask for a safe word. If none is forthcoming, hang up and report the incident to the authorities immediately. Inform other relatives in case they also get targeted. If you don’t have a family safe word, hang up anyway and call the supposed kidnapping victim directly to make sure they’re safe. 

3. Can I get my money back after falling for an AI kidnapping scam? 

Unfortunately, recovering money after a scam is very rare. Cybercriminals will even take advantage of scam victims by promising to recover the money for a fee and then running off with the fee. Tread carefully and only work with legitimate authorities to recover funds. In most cases, you’ll have to cut your losses. 

Learn more

• Discover how to take control of your data privacy online.
• Learn about data brokers and how they misuse your data.
• Read through our five-minute privacy tips to reduce your digital footprint.