How the Grandparent Scam Actually Works (And Why Anyone Falls for It)
How the Grandparent Scam Actually Works (And Why Anyone Falls for It)
A few years ago, my great grandmother answered her phone and heard that I'd been kidnapped.
The voice on the line told her they were holding me for ransom. They knew my name. They knew family names. They wanted money, wired, in exchange for me. And somewhere behind the voice doing the talking, she could hear a young man's voice that could have been mine.
She did everything right. She didn't pay. She called my dad, who confirmed I'd been at work all day. The scam failed at the very last step.
And she was still terrified, because the whole thing only needed to succeed on the first step, the one nobody talks about: the call got through.
What the script is built out of
Strip the fear off and the mechanics are almost boring. This scam is an assembly, four standard parts.
Real details, scraped. The caller knew my name and a couple of family names. That's not intelligence work. That's an afternoon on social media. The FBI has been saying it for years: the impersonation works because the raw material is public.
A performance, not just a pitch. The young man's voice in the background wasn't an accident. These calls are staged. Some versions run two people: a "grandchild" in distress, then a handoff to an accomplice playing a lawyer or a police officer, someone official who explains the money part. And it's getting worse, not better: regulators now warn that cloned voices of family members are the newest version of this trick.
Urgency plus secrecy. The script always has two clocks. The emergency itself (kidnapped, arrested, in an accident, usually far away, always right now) and the isolation instruction: don't tell mom and dad, don't call anyone, there's a gag order. The secrecy is the tell. Any real emergency survives one phone call to your family. This one can't.
Money that can't come back. Wire transfers, gift cards, cash stuffed inside magazines and mailed, couriers sent to the house. Payment methods chosen because once the money moves, it's gone. The FBI counted $1.9 million in reported losses in nine months of 2023 alone, and the FTC found that people over 70 tricked into sending cash lost a median of $9,000.
"Who falls for this?" is the wrong question
Here's the answer nobody wants to say out loud: almost anyone can fall for this, because it isn't built to beat your intelligence. It's built to skip it.
The scam works because it preys on people's trust in humanity. People are naturally good. They want to trust others, and they especially want to help when someone they love is in danger. That's not a character flaw. It's the best thing about a person, repackaged as an attack surface.
My great grandmother wasn't gullible. She had so much trust in the world and the people in it to do the right thing. The caller didn't defeat her judgment. He made sure she never got to use it, by aiming past it at the part of her that loves her family.
The details did the rest. She knew I worked a sensitive position, so the idea that foreign individuals had taken me wasn't absurd to her. It was coherent. The scam doesn't need you to believe something impossible. It needs you to believe something terrible.
What actually stopped it, and what didn't
The thing that saved her wasn't a tool. It was a relationship. She called my dad. He told her I was fine, at work, definitely not held for ransom. One call killed the whole performance.
Notice the order of events, though. The phone rang. She answered. The fear was fully real before the verification happened. Everything that saved the day came after the scam's only required step had already succeeded: a stranger reached a trusting person and got a fair hearing.
What to do with your own family, today
A few things, in order of how much they matter.
Build the kind of trust that gets reported. The scam's oxygen is secrecy, and secrecy runs on embarrassment. An elder who can call you and say "this was probably nothing, but" without shame is the best defense that exists. If that relationship between my dad and my great grandmother hadn't been there, would she have paid? Would they have come back for her another way? You combat this with relationships of trust and love, the opposite of what the callers run on.
Set a family safe word. The FCC recommends this now. Pick a word only your family knows. A caller claiming to be you who can't produce it is done, immediately. It's the analog version of an access code and it costs nothing.
Teach the verification reflex. Hang up, then call the real person at the number you already have. Not the number on the screen, because caller ID can wear a real person's digits. The one in your contacts.
Report it. reportfraud.ftc.gov, the FBI's IC3, local law enforcement. Reporting is how these operations actually get found.
The call reached her because calls are free to make
She picked up because she always picks up. That's what you do when the phone rings, when you're a person who trusts people. And there was nothing, no app, no feature, no setting on the phone she had, that could have protected her from that moment.
That's the part I couldn't get past. The scam didn't need her to be old, or trusting, or even home. It needed one thing: the ability to reach her without proving anything first. Phone calls are the one channel where that's still true. Anyone, anywhere, for any reason, can make a ring happen in your kitchen.
This is what Haloa does instead
Haloa is the maze the caller can't navigate. Unknown callers enter an access code before the call connects; the people she loves already have it and ring straight through like always. A stranger performing a kidnapping over speakerphone has the same odds as a stranger saying nothing at all: zero. No code, no ring.
It doesn't matter how convincing the script is, how many family names they scraped, or whose number they've borrowed for the occasion. Looking legitimate stops mattering when the door checks permission instead of appearances.
The trust stays. What goes is the free shot at it.