PL
HU
EN
A new face of an old scam
"Grandma, I've had an accident, I need money" | this sentence has for years been one of the most dangerous tools in scammers' arsenal in Poland. The "grandchild scam" appeared in Polish crime over a decade ago, and despite numerous awareness campaigns, it still takes a tragic toll. According to National Police Headquarters data, in 2024 alone this type of scam caused losses in the tens of millions of zloty. But what really worries experts isn't the method's persistence, but the speed at which it's changing.
The classic version of the scam looked relatively simple: someone claiming to be a grandson, daughter, or son would call, saying they urgently needed money | for bail after an accident, for treatment, to pay off sudden debt. The victim, acting under the influence of emotion and time pressure, would hand cash to a "courier" or transfer it to a given account. Now this scenario looks completely different.
AI voice cloning
Modern artificial intelligence technology allows a person's voice to be cloned from just a few seconds of recording. A short fragment of a phone call, a voice message on a messaging app, or even a clip posted on social media is enough. Voice synthesis tools | which just a few years ago were available only in research labs | are now widely available online, often for free or for a small fee.
For an older adult who picks up the phone and hears their grandson's voice | his intonation, his characteristic phrases | recognising the scam is extremely difficult. This is no longer a stranger's voice pretending to be someone close. It's a technologically generated copy of a voice that sounds exactly like the person it claims to be. Research shows that even people aware this technology exists have great difficulty telling a cloned voice from a real one in a stressful situation.
Multi-channel attacks
Another evolution is combining several attack channels at once. A modern scam scenario might look like this: first, the victim receives a text about an alleged incident on their bank account. A few minutes later, the phone rings | the bank's number appears on screen (spoofing). Someone claiming to be a bank employee confirms the "incident" from the text and asks for an urgent transfer of funds to a "security account". At the same time, the victim may receive an email with a fake login link.
This multi-channel attack is especially effective because each new element lends credibility to the last. The text confirms the call, the call confirms the text, and the email looks like official bank correspondence. Instead of becoming suspicious, the victim grows more confident the situation is real | because "if they're texting and calling from the bank, it must be true".
Spoofing | when the bank's number appears
One of the most dangerous tools in modern scammers' arsenal is phone spoofing | a technique for faking the number displayed on the recipient's phone. Using it, a scammer can make an older adult's phone screen show their bank's helpline number, the police emergency number, or the number of any public institution.
Spoofing is especially insidious because it undermines one of the basic verification methods older adults have been taught for years: "check who's calling". If the bank's number appears on screen, the natural instinct is to trust the caller. Yet the mere fact that a particular number is displayed guarantees absolutely nothing. Spoofing technology is so cheap and accessible that even small-time scammers use it.
The Financial Ombudsman's Office has repeatedly warned about this phenomenon, emphasising that no bank ever initiates a phone call asking for full login details, authorisation codes, or a transfer of funds to another account. If someone calls with such a request | no matter what number appears on screen | it's a scam. Without exception.
How to defend yourself? The Z-Z-Z rule
For several years, the National Police Headquarters has been promoting a simple but remarkably effective rule for responding to suspicious situations. This is the Z-Z-Z rule | Stop, Think, Call. Its strength lies in being easy to remember and interrupting the automatic reaction scammers rely on.
Stop
The first step is interrupting the automatic reaction. Scammers deliberately trigger panic | they talk about accidents, arrests, account freezes, and threaten the loss of savings. Their goal is to make you act immediately, without thinking. So the most important thing you can do is simply stop. Put the phone down for a moment. Take a deep breath. Don't make any financial decisions during a call that triggers strong emotions.
Think
The second step is critically analysing the situation. Ask yourself a few key questions: Would the bank really call me asking to transfer money? Would my grandson really call from an unknown number instead of his own phone? Would a real police officer really ask for cash to be handed to a courier? Would anyone honest force me to act immediately under threat of consequences? The answer to each of these questions is no. No institution, no loved one will put you in a situation where you must hand over money immediately with no chance to think it over.
Call
The third step is independent verification. But be careful | don't call back the number the suspicious call came from. Scammers can set up the call so that calling back sends you right back to them. Instead: look up the bank's number yourself on their official website or on the back of your payment card. Call your grandson on the number you have saved in your contacts. Contact the police on the emergency number. One independent verification call can save a lifetime of savings.
The golden rule
There's one rule that should be etched into the memory of every older adult, every caregiver, and every educator. It's worth repeating at every opportunity, printing out and hanging next to the phone, or setting as a reminder on a smartphone:
No institution | not a bank, not the police, not a government office, not the post office, nor any other organisation | will ever ask you over the phone to transfer money, provide authorisation codes, or install remote desktop software.
This rule is absolute and has no exceptions. There's no situation in which a bank employee would need to ask a customer to transfer money to a "technical account", a "security account", or a "temporary account". There's no police procedure that requires a citizen to hand cash to a courier. If someone claims otherwise | they're lying. Always.
The Financial Ombudsman's Office emphasises that even if the caller knows your name, your national ID number, or your account number | that's no proof they're calling from the bank. Personal data leaks from many sources and is traded on the black market. Knowing someone's personal data is not proof of identity.
What are we doing at ODYSSEY?
In the ODYSSEY project, we set ourselves the goal not just of imparting knowledge, but above all of building habits. We know from research that simply informing an older adult about threats isn't enough | repeated practice of the correct responses is needed, until they become automatic.
Educational videos
We've created a series of short educational videos in which we act out real scam scenarios. The videos show step by step what an attack looks like | from the first contact, through building emotional tension, to the attempt to extract money. Every video ends with instructions on the correct response. The materials are available for free in Polish and Hungarian on our website and on YouTube.
Simulations and practical exercises
As part of the online course, we've prepared interactive simulations that let older adults practise responding to suspicious situations in a safe environment. The participant receives a fake email, text message, or description of a phone call and has to decide how to react. The system immediately tells them whether their decision was correct and explains what they should have watched out for. Repeating these exercises builds a habit of critical thinking | exactly the habit that blocks the scam mechanism.
In addition, as part of our in-person workshops, we organise paired exercises in which participants play the roles of scammer and victim. This method, inspired in part by the Czech prevention programme "Nedame se" described by Mazalova (2016), has proven remarkably effective | participants who themselves "played" the scammer recognise manipulation techniques far better in the future.
Our course is available for free to anyone who wants to learn to recognise threats and respond to them effectively. It requires no prior technical knowledge | just a willingness to learn and a few hours of time.