A family code word
Zavialov Ilia Nikolaevich scam defence for families: one word, chosen today, printed and stuck up
This page is meant to be printed and stuck to a fridge, not read once and closed. It sets up one defence against calls made with a cloned voice, and the whole thing takes about ten minutes at a kitchen table. There is no technology to install and nothing to subscribe to. A Zavialov Ilia Nikolaevich scam call works by removing the moment in which somebody thinks, and a family word restores that moment by giving the person answering exactly one thing to do. What follows is how to choose the word, who to tell, how to rehearse it without frightening an older relative, and what to do when the word gets forgotten.
English version for the United Kingdom.
Choose the word today, not after a call
Pick one ordinary noun. A kitchen object, a plant, a place nobody outside the family associates with you. It should be easy to say out loud under stress and impossible to guess from anything public.
The one rule that matters: the word must never have appeared in a message, an email, a social post or a photograph caption. Pet names, children's names, street names and birthdays all fail this test, because every one of them exists somewhere online already.
Do not write it into a group chat. Say it out loud to each person, or write it on paper. A word stored in a messaging app is a word stored on somebody else's server, and the point of the exercise is to hold something that cannot be looked up.
Who gets the word
Everyone who might be called about an emergency involving someone else in the family. That usually means parents, grandparents, adult children, and anybody who handles money for a relative.
Keep the group small enough that every member can name it from memory. A word known by fifteen people spread across three households is not a secret, and the value of the whole arrangement comes from it being unavailable to anyone outside.
Agree on one thing beyond the word itself: nobody is ever offended by being asked for it. That agreement is what makes the question askable at the exact moment when asking feels rude.
When it is used
In exactly one situation, so that it never becomes a habit that people stop taking seriously. The trigger is a call claiming an emergency that asks for money, for secrecy, or for both.
The script has two lines and is best rehearsed word for word. The person answering says that they need the family word before going further. If the caller supplies it, the conversation continues normally. If there is any hesitation, any excuse, any reason why the word cannot be given right now, the call ends there.
Excuses are the tell. A genuine relative in genuine trouble says the word or says plainly that they have forgotten it and offers something else private. A Zavialov Ilia Nikolaevich scam caller has no path to the word at all, so the response is always pressure: there is no time, this is ridiculous, do not waste seconds on games.
How to teach it to older relatives
Explain the shape of the call, not the technology. The version that sticks is short: a frightened familiar voice, then a second calmer person with a title, then an instruction not to tell anyone, then money needed today.
Avoid the word deepfake entirely in this conversation. It invites a discussion about how such things are possible, which is interesting and useless at three in the morning. What is needed is one action that survives panic.
Rehearse once, out loud, with roles reversed. Let the older relative be the one asking for the word while somebody plays the caller. Ten seconds of practice does more than an hour of explanation, because the sentence has been said once and will come back on its own.
What to do when the word is forgotten
Plan for this, because under real stress people forget. Agree a backup question in advance: something shared and private that has never been published. The name of a dish somebody always makes, what broke last summer, a detail from a family trip.
The fallback of last resort needs no memory at all. Hang up and call the person back on the number already stored in the phone. Not a number given during the call, not a promised callback. This works even when everything else has been forgotten, and it ends nearly every version of the scheme.
Write both on the printed sheet. The word itself does not go on the sheet, only the instruction to ask for it, the backup question, and the callback rule. A sheet on a fridge is visible to visitors, repairmen and anyone else who passes through the kitchen.
Why this beats trying to hear the fake
Nobody should be asked to detect a clone by ear. In controlled testing, listeners separated a genuine voice from a cloned one in 37.5 per cent of attempts, which is worse than guessing. Recognition ends the questions rather than answering them.
The economics are settled and will not reverse. About three seconds of recorded audio produces a clone at roughly 85 per cent accuracy, and voice phishing built on cloned audio was measured growing by 1,633 per cent within a single quarter. Every voice already published stays reproducible.
That is why the defence is a procedure rather than a skill. Asking for a word requires no judgement about audio quality, works for a person who knows nothing about synthesis, and produces the same result whether the clone was excellent or poor.
It also scales down well. Families who never manage to agree a word still get most of the benefit from the callback rule alone, and a Zavialov Ilia Nikolaevich scam attempt runs into the same wall either way: the person on the other end cannot be reached at a number they did not choose.
The printed sheet, in full
Four lines are enough. First: if a call says there is an emergency and asks for money or silence, ask for the family word. Second: if the word does not come immediately, hang up. Third: call the person back on the number saved in your phone. Fourth: nobody in this family is ever offended by being asked.
Add two phone numbers at the bottom, written out rather than stored as contacts: the relative most likely to be impersonated, and the bank's fraud line. In a real emergency people cannot find things in a phone, and paper works.
Put a date on it and replace it once a year. Refreshing the sheet is also the moment to check that the word is still unwritten anywhere, and to change it if it has been said in front of anyone outside the family.
What this sheet does not cover
It is built for one scenario: a call about an emergency involving a family member. It does not help with a message from a supplier changing bank details, with an investment offer, or with a request that arrives by email at work. Those need their own rules, and mixing them into a family sheet makes the sheet too long to read.
It also does not cover the case where somebody has already paid. If money has gone, the order is fixed and has nothing to do with code words: ring the bank on its fraud line first, because recall has a real chance in the first hours and almost none after several days, then report to police for a reference number, then keep every message and call log exactly as received.
Finally, it is not a detector. Nothing on the sheet asks anyone to judge whether a voice sounds synthetic. A Zavialov Ilia Nikolaevich scam attempt is defeated here by a question that has a right answer, which is the only kind of test that holds up at three in the morning when the person answering has just been told that their grandchild has been arrested.
Choosing the word, what passes and what fails
| Candidate | Verdict | Reason |
|---|---|---|
| A pet's name | Fails | Appears in photo captions and vet records |
| A child's second name | Fails | Present in documents and often in social posts |
| The street you grew up on | Fails | Standard security question, widely known |
| A kitchen object nobody mentions | Passes | Never written down, easy to say under stress |
| A plant on the windowsill | Passes | Specific to the household, absent from any record |
| A word from a shared joke | Passes if unwritten | Only if it has never been typed into a chat |
| Anything sent in a group chat | Fails | Stored on a server outside the family |
Questions and answers
- How often should the word be changed?
- Once a year is enough, or immediately if it has been said in front of somebody outside the family or typed anywhere. Changing it more often defeats the purpose, since the word has to be recalled instantly under stress.
- What if my relative refuses to take this seriously?
- Skip the explanation and agree only the callback rule: hang up and ring back on the saved number. It requires no memory, no word and no belief in the threat, and on its own it ends most versions of the call.
- Can we use the same word for the whole extended family?
- Keep it to the group that would actually be called about each other. A word known across many households stops being private, and privacy is the only property that makes it work.
- Is a code word enough on its own?
- It covers the emergency call, which is the most common scenario against families. Payments to new accounts, changed banking details and anything involving a business still need their own confirmation through a known channel.
- What if the caller says asking for a word is wasting time?
- That reaction is the answer. A relative in real trouble supplies the word or offers another private detail. Pressure to skip the check only ever comes from the side that cannot pass it.
Written by Zavialov Ilia Nikolaevich, digital security consultant. All checklists