Social Engineering & FraudMANIPULATIVE

Grandparent Scam

What it is

A fraud in which a caller poses as a grandchild (or an authority acting for them) in sudden trouble, using panic and secrecy to rush an older person into sending cash, gift cards, or a courier payment.

How it works

The scam weaponizes love and alarm to shut down verification. A shaky voice cries "Grandma, it's me, I'm in trouble," and the target's mind supplies the grandchild's name, which the caller then adopts. A supposed accident, arrest, or hospital emergency demands money immediately, and a co-conspirator often takes over as a "lawyer," "bail bondsman," or "police officer" to lend authority and dictate the payment. Secrecy is built in: "don't tell Mom and Dad, I'm so embarrassed," which isolates the victim from the one check that would end it. The tactic exploits the hot-cold empathy gap: a calm person knows to verify, but a frightened grandparent imagining a grandchild in a cell cannot access that judgment in the moment. AI voice cloning has made the voice itself convincing from seconds of social-media audio, prompting FTC and FBI warnings. Rings running this at scale, such as the Montreal call-center network charged in Vermont in 2025, have stolen tens of millions from older Americans.

Real-world examples

•A grandmother receives a sobbing call, believes it is her grandson after a car crash, and hands an "bail courier" thousands in cash at her door.
•U.S. prosecutors charged 25 Canadian nationals in 2025 over a Montreal-based grandparent-scam network that defrauded older Americans of more than 21 million dollars.
•The FTC warned in 2023 that scammers now clone a loved one's voice from a short online clip to make the emergency call sound unmistakably real.
•"Virtual kidnapping" variants, which the FBI traced largely to Mexican prisons, claim a relative has been seized and demand an immediate ransom before the family can think.

Ethical guidelines

●Impersonating a distressed family member to rob an older person is fraud that deliberately targets love; there is no honest version.
●Age-based blame is wrong and harmful; the tactic defeats verification by design, and anyone can be caught in a state of panic.
●Families and communities should discuss these scams openly so recognition, not shame, is the response when one arrives.

How to defend against it

►Hang up and call the grandchild or their parents directly on a known number, even if the caller begs you not to; a real emergency survives a two-minute check.
►Agree on a family "safe word" or a shared question only the real person could answer, so a cloned voice cannot pass.
►Treat any demand for gift cards, cash by courier, wire transfer, or cryptocurrency as proof of a scam; courts and hospitals do not collect that way.
►Recognize the secrecy request ("don't tell anyone") as part of the attack, and make telling someone the automatic next step.
►Report attempts to reportfraud.ftc.gov and the FBI at ic3.gov, and consider the AARP Fraud Watch Network helpline for guidance and support.

From the Defense Playbook

Affect Labeling (Name the Feeling)seconds

Putting the emotion you are experiencing into words ("I am frightened", "I am furious") reduces its intensity and restores deliberate thinking, which makes fear-, anger-, and shame-based persuasion less effective.

Bring a Second Personminutes

Insist on having a trusted third party present, on the call, or copied in before a significant decision, because a single ally breaks the isolation that most high-pressure and fraudulent persuasion depends on.

Out-of-Band Verificationminutes

Confirm any request that arrives through one channel (email, text, chat, a phone call) by reaching the supposed sender through a different channel you already trusted before the request existed.

The Callback Ruleminutes

When anyone contacts you claiming to be your bank, a government agency, a utility, or a company you deal with, hang up and call back on the number printed on your card, statement, or the organization's official website, never the number they gave you.

Gift Cards Mean Scamseconds

Treat any demand to pay a debt, fine, fee, bail, or "security deposit" with gift cards, cryptocurrency, a wire to a stranger, a payment app, or cash handed to a courier as proof of fraud, because no legitimate institution collects money that way.

Tell Someone Before You Send Moneyminutes

Before sending money or sharing account details in response to any unexpected request, describe the situation out loud to one person who is not involved, because scams depend on the target deciding alone.

Every playbook entry states how strong its evidence is and when not to use it. Browse the full playbook.

References

Puig, A. (Federal Trade Commission) (2023). Scammers use AI to enhance their family emergency schemes. FTC Consumer Advice · link
Warning that voice cloning from short online clips makes grandparent and family-emergency calls more convincing.
U.S. Department of Justice, District of Vermont (2025). 25 Canadian Nationals Charged in Connection with Nationwide Multimillion-Dollar Grandparent Scam. DOJ press release · link
A Montreal-based grandparent-scam network charged with defrauding older Americans of more than 21 million dollars.
Loewenstein, G. (2005). Hot-cold empathy gaps and medical decision making. Health Psychology, 24(4S), S49-S56 · link
The hot-cold empathy gap explaining why a frightened person cannot access the verification judgment available when calm.

Last reviewed 2026-09-07

Suggest a correction

Detect Grandparent Scam in any text

Paste any message, email, or article into our free Manipulation Detector to see if Grandparent Scam or other techniques are being used on you.

Try the Detector Free Create Free Account

Social Engineering: Why Smart People Fall for It

Social engineering does not target stupidity. It targets helpfulness, deference, and time pressure, which are the same habits that make people good at their jobs. Here is how the attacks are built and which procedures actually stop them.

7 min read

The Disinformation Playbook: How Campaigns Are Built and Where They Break

Disinformation campaigns follow a recognizable sequence: seed, launder, amplify, and let real people carry it the rest of the way. A field guide to the stages, drawn from the research, with the defences that work at each one.

8 min read