Voice expert urges family code words after mother loses $5,400 in fake kidnapping scam

A voice that sounds like family should not be the only identity check during an emergency, University of Cincinnati researcher Kimberly Hyun told Fortune on October 24. Her advice—agree on a private code word—follows Deborah Del Mastro’s account of sending $5,400 to callers who claimed to have kidnapped her daughter and used a voice she recognized.

Del Mastro believes she heard an AI-generated version of her daughter Sarah’s voice. That explanation has not been independently confirmed. In an October 7 account, Kurt Knutsson described interviewing her for The CyberGuy Report podcast. She recalled five and a half hours of threats before learning Sarah had been safe at work throughout.

Recognition was the opening

Voice cloning uses a recording of someone’s speech to produce audio that sounds like them. The FTC warns that scammers can use short clips, including recordings posted online, Knutsson wrote. Hyun, an assistant professor of marketing who studies voice and persuasion, told Fortune that familiar vocal qualities can lower a listener’s defenses and make a message easier to believe.

For Del Mastro, recognition had a specific emotional context. Sarah had recently gone through a breakup, and her mother had heard her sobbing only days earlier. The distressed voice on the call matched that memory. The caller claimed ties to a Mexican drug cartel and said her 37-year-old daughter had witnessed something in a parking lot that she should not have seen.

The open line kept the pressure on

The caller initially demanded $20,000, Del Mastro said. He instructed her to bring a phone charger and threatened that she would never see Sarah again if the phone died. When she muted the call to speak privately with her husband, he noticed and screamed at her. The voice was only part of the ordeal; the caller also monitored her movements and conversations.

He wants to keep my phone open right here so he can hear everything.

Deborah Del Mastro, speaking to Kurt Knutsson on The CyberGuy Report podcast

He also supplied a cover story for the money transfers: she should say she was helping a relative with medical expenses. Del Mastro said she ultimately sent $5,400 in four transactions through MoneyGram and Western Union. That exhausted the money she and her husband could readily access. Asked whether anyone challenged her during the transfers, she told Knutsson nobody did.

Only after the caller said Sarah had been released, and Del Mastro could not find her, did she call her daughter directly. Sarah answered from work. The family subsequently reported the scam to local police. Fortune’s October 24 account said Martinez police were investigating the incident, which it dated to May.

A second check, not a listening test

The FBI calls this kind of extortion virtual kidnapping: criminals demand payment for a kidnapping that never happened. Its warnings describe efforts to keep victims on the phone so they cannot check a loved one’s whereabouts. The agency has also warned about altered media in these schemes. The verification advice addresses both the convincing sound and the pressure to keep listening:

• Agree on a private family code word that someone could not easily discover through social media. Hyun recommends a shared code; the FBI also recommends one for virtual kidnapping situations.
• Contact the loved one using a number you already know belongs to them. The FTC recommends this independent check. If they do not answer, try someone who should know where they are.