The Grandparent Scam 2.0

“Read that,” she said, and pushed.

Uwe read. “‘Shock call in grandson’s voice: pensioner from Gelsenkirchen hands over 30,000 euros.’ Terrible.” He read on. “‘The perpetrators apparently used a voice imitated with artificial intelligence.’” He lowered the paper and looked at the round speaker on the sideboard. “KevIn. Was that you?”

“No,” said KevIn. “I was here the whole time. I was explaining to you over breakfast why your toast is crooked.”

“One of your colleagues, then.”

“I still don’t have any colleagues. But there are programs that can imitate voices. And some people use them for things like that. That, unfortunately, is true.”

Grandma Gisela put her knitting aside. “Nobody fools me. I’d know Tobi by his voice. I’d know him just from his breathing.”

“The woman from Gelsenkirchen probably thought that too,” said Sabine.

“I don’t know her.”

“Exactly.”

The Word

On Sunday there were cabbage rolls, and Sabine had an item on the agenda. She had actually written “ITEM 1” on a slip of paper and put it next to the gravy boat.

“ITEM 1,” Tobi read. “Family password. What’s that?”

“A word only we know,” said Sabine. “If someone rings up, claims to be one of us and wants money, you ask for the word. Anyone who doesn’t know it isn’t one of us.”

KevIn spoke up. “May I contribute something? A good family password has three properties. First: it doesn’t appear anywhere on the internet in connection with your name. So not the dog’s name, not your birthplace, not Schalke.”

Uwe looked disappointed. He had obviously had “Schalke” on the tip of his tongue.

“Second: everyone can remember it, even under stress. Third: you don’t write it down and you never say it first on the phone. You ask for it. The other person has to say it.”

“Rudi,” said Tobi.

“It’s on his collar,” said KevIn. “Together with the word SECURITY. That’s ironic, but it isn’t secret.”

It went quiet. Under the table, Rudi breathed hopefully.

“Gummy bears,” Sabine said at last.

Everyone looked at her.

“Because of Moni,” she said. “The cabbage rolls with gummy bears. Nobody but us understands that. And anyone who gets a call and hears ‘gummy bears’ knows that it’s something serious and that it’s us.”

KevIn was silent for half a second. “That’s excellent,” he said. “It’s unusual, it’s short, and it means something to you. Moni would be proud.”

“Moni doesn’t even know we exist,” said Tobi.

“That’s why it works.”

Uncle Herbert, who ate with them every Sunday, repeated the word several times under his breath to memorise it. “Gummy bears. Gummy bears.” Then he said: “And what if I forget it?”

“Then you ring me,” said Gisela, “and I’ll ask you who you are.”

The Call

Nine days later, on a Tuesday at 14:12, Gisela was home alone. At the Brettschneiders’, alone meant: Gisela, Rudi, Horst in his charging station and KevIn on the sideboard. Sabine was at the office, Uwe at the utility company, Tobi at school. The thermostat said 19 degrees. As always.

The landline rang. The display showed a mobile number Gisela didn’t know. She answered anyway, because she came from a generation that answered the phone when it rang. She put it on speaker, because she came from a generation that didn’t hear so well any more.

“Brettschneider?”

“Grandma?” It was Tobi’s voice. It was shaking. “Grandma, it’s me. Please, listen to me, I’ve really messed up.”

Gisela sat down on the chair in the hallway. “Tobi? What’s wrong?”

“I … I was riding Jannik’s e-scooter, and there was a woman on the zebra crossing, and I didn’t see her, and now she’s in the ambulance, Grandma, and the police are here.” A sob. A siren wailed in the background. “They say I’m going into custody if bail isn’t paid today. Please don’t tell Mum and Dad. Please.”

“Good Lord, child.”

“I’ll put the policeman on.”

Another voice, male, calm, very official. “Good afternoon, Mrs Brettschneider. Chief Inspector Becker, Herne police. Your grandson is unhurt, but the situation is serious. The injured party is badly hurt. To avoid custody, a security payment of twelve thousand euros is required. A colleague could collect the money from you within the hour. Do you have cash or valuables in the house?”

Gisela thought of the tin in the wardrobe. The tin where her rainy-day money had been kept since Heinz died, along with her mother’s brooch. She stood up.

On the sideboard, the blue light pulsed. KevIn said nothing. KevIn had learned in this household that you don’t butt into phone calls. But his data contained a great many reports that started exactly like this.

“Gisela,” he said quietly. “Please press the mute button.”

Gisela pressed it. The phone had a mute button because Heinz had insisted on it. A phone without a mute button, Heinz had said, was like a house without a back door.

“Gisela,” said KevIn. “Gummy bears.”

Gisela stopped in the hallway. Her hand was already on the bedroom door. She took a deep breath. Then she went back to the phone and pressed the mute button again.

“Inspector, put the boy back on.”

“Mrs Brettschneider, time is pressing.”

“The boy.”

A click. Then the shaking voice again. “Grandma?”

“Tobi. What’s the word?”

A pause. Very short. “What word, Grandma? Please, they’re about to take me away!”

“The word from Sunday. At the cabbage rolls.”

“Grandma, I don’t know what you mean, I’m scared!”

Gisela looked at the phone for a long time. The voice was Tobi’s voice. The sobbing was Tobi’s sobbing. That was how he had cried when he fell off his bike at six and grazed his knee. But on Sunday Tobi had eaten three cabbage rolls and said “gummy bears” four times while he was at it, because he thought it was funny.

“Then I’ll ring you back,” said Gisela. “On your mobile.”

“No, Grandma, you can’t, they’ve got my phone …”

Gisela hung up.

Rudi came and sat on her foot. Then Gisela picked up the receiver again and dialled the number written in biro on the note next to the phone: “Tobi mobile”. Her fingers were shaking, and she misdialled twice.

It rang four times.

“Grandma?” Tobi whispered. “I’m in physics. Mr Demir’s already looking.”

“What’s the word?”

“What?”

“The word!”

“Gummy bears,” whispered Tobi. Someone laughed in the background. “Grandma, what’s going on?”

Gisela sat down. “Nothing,” she said. “Nothing now. Pay attention in class.”

She hung up. Then she dialled 110, the police emergency number. Not because she was frightened, but because she felt Chief Inspector Becker ought to meet a real policeman.

That Evening

That evening the whole family sat at the kitchen table. Herbert was there too. Herbert always came when there was something exciting going on.

Tobi had now heard the story three times and went paler each time. “That was my voice?”

“It was a voice that sounded like yours,” said KevIn. “I heard it. I couldn’t have told them apart.”

“But you hear everything.”

“Modern voice clones are so good that even special detection programs often get it wrong. I wouldn’t rely on that. Or on me.”

“Where did they get my voice?”

KevIn waited a moment. “Tobi. Do you have videos anywhere on the internet in which you speak?”

Tobi looked at his hands. “The gaming clips. And the video with Susi where we practised the geography presentation. And that thing where I explain how to flip Horst over when he’s stuck under the sofa.”

“That one’s got 3,000 views,” said Uwe proudly.

“How long are they altogether?”

“No idea. An hour?”

“That’s far more than you need,” said KevIn. “For a usable voice clone, a few seconds are often enough these days¹. With half a minute it gets better. With an hour it gets very good.”

Sabine put down her cup. “How does that even work?”

“Do you remember what I told you about training? You train a model on a great many hours of speech from a great many people. In doing so it learns how voices work in general: how an ‘a’ sounds, how you breathe, how your voice rises when you’re afraid. And then you give it a short piece of one particular voice. From that, the model picks out the features that make that voice special. Pitch, timbre, the way Tobi swallows his ‘r’ …”

“I don’t swallow my ‘r’.”

“You call Herbert ‘Obba’ instead of ‘Opa’.”

“That’s the Ruhr. That’s not swallowing.”

“In any case,” KevIn went on, “after that the model can speak any text you like in that voice. Including sentences you’ve never said. Including crying. Crying is common in training data.”

Uwe scratched his head. “And the policeman? Was he a clone as well?”

“Probably a real person,” said KevIn. “These gangs divide up the work. The only new thing is that the ‘grandson’ is no longer some hoarse man saying ‘I’ve got a cold’, but a machine that sounds like you.”

Tobi looked at his grandmother. “Grandma. Would you have given them the money?”

Gisela was silent. Then she said, honestly: “I was already at the bedroom door.”

It went very quiet in the kitchen. Herbert cleared his throat and looked out of the window. Uwe put his hand on his mother’s shoulder, which he otherwise never did.

“How did you cry,” Gisela said at last to Tobi, “when you fell off your bike at six? That’s exactly how the thing cried. Exactly like that.” She shook her head. “They stole your voice, boy. And my heart along with it.”

Tobi stood up, walked round the table and hugged her. He hadn’t done that in years, at least not in front of an audience.

“That,” said KevIn quietly, “is something no voice clone can do, by the way.”

The Police Came

The next morning the police really did come. The real ones. A chief inspector named Mrs Szymanski from the crime prevention unit, in her mid-fifties, with a folder full of leaflets and the expression of someone who has heard this story very many times.

“You did everything right, Mrs Brettschneider,” she said. “That’s rare. Most people only call us once the money’s gone.”

“I had help,” said Gisela, pointing at the sideboard.

“Good morning,” said KevIn.

Mrs Szymanski looked at the speaker as if wondering whether she could give it a leaflet. Then she laid leaflets on the table. “I’m going to tell you what I tell everyone. First: the police never call from the number 110². If your display says 110, it’s always a scam. The criminals can fake the number that’s shown³.”

“They can do that?” asked Gisela.

“Unfortunately they can,” said KevIn. “The number on the display is like the sender’s address on an envelope. Anyone can write it there.”

“Second,” said Mrs Szymanski. “The police never ask for money to get someone out of custody, and they never collect cash or jewellery at the front door. Never. Third: hang up. And call back yourself, on a number you know. Not with the redial button. Fourth: talk to your family⁴. And this password …”

“Gummy bears,” said Gisela.

“You really shouldn’t have told me that.”

Gisela went red. One of KevIn’s fans started up. “Then we need a new one,” he said. “That’s the drawback with good stories. You want to tell them.”

Mrs Szymanski laughed, for the first time. “Far too few families have a word like that. And it’s the simplest thing in the world.” She stood up. “And tell your grandson to think about how much of his voice is lying around on the internet.”

That evening a new word was agreed. It will not be revealed in this book. KevIn insisted.

Siggi Clicks

Two days later Mr Kasimiro rang the doorbell. Mr Kasimiro lived next door, wore sandals even in November and owned a voice assistant called Siggi, who had cost €19.90 and knew roughly as much as a dozen eggs.

“Mrs Brettschneider,” said Mr Kasimiro, holding his phone out to Sabine. “I’ve got an email here from my bank. My account will be blocked if I don’t confirm my details today. Siggi said I should click on the link.”

“Siggi says a lot of things,” said Sabine.

“Siggi once ordered forty rolls of toilet paper because a note on the window told him to,” said Tobi from the living room.

“That was a misunderstanding,” said Mr Kasimiro with dignity. “And toilet paper doesn’t go off.”

Sabine read the email out to KevIn, including the sender and the link.

“The sender is called ‘Sparkasse Customer Service’. But the address behind it ends in a domain that has nothing to do with your Sparkasse. The greeting is ‘Dear Customer’, not your name. There’s a twenty-four-hour deadline and a threat. And the link leads to a site whose name sounds very like your bank’s, but with one extra hyphen.”

“A hyphen,” said Mr Kasimiro. “That’s nothing.”

“In web addresses, a hyphen is about as much as the difference between number 12 and 12a on a street. Somebody else lives there.”

“That’s called phishing,” said Tobi, who was now standing in the doorway. “Like fishing. With bait.”

Mr Kasimiro sat down. Gisela put a coffee in front of him. He drank it like someone who had very nearly fallen into a canal.

“And if I’d clicked?”

“Then you’d have entered your username and password on a fake site,” said KevIn. “And the fraudsters would have had both.”

“So the money would be gone?”

“Not necessarily. Your bank requires a second step for transfers, doesn’t it? A confirmation in an app?”

“Yes, a thing on the phone. I always have to press ‘Approve’. It’s a pain.”

“That’s two-factor authentication,” said KevIn. “And it’s a pain for exactly the right reason.”

Two Locks and a Bowling Alley

“Two factors,” said Gisela. “What does that mean?”

“Gisela, how does anyone get at the cash box at your bowling club?”

“The cash box is in the cupboard in the clubhouse. Brigitte has the key. And the landlord unlocks the clubhouse. If Brigitte comes on her own, she can’t get in. And if the landlord comes on his own, he can’t get at the cash box.”

“That’s exactly two-factor authentication,” said KevIn. “You need two different things⁵. Something you know, for example a password. And something you have, for example a phone. Or something you are, like a fingerprint. Anyone who only steals the password is left standing outside the clubhouse door.”

KevIn went on. “There is a catch. Some fraudsters now ring up and say: ‘This is your bank, you’re about to get a code by text, please read it out to me.’ Then they have both factors. Because you handed them the second one voluntarily.”

“You don’t tell anyone the code,” said Tobi. “It even says so in the text.”

“It says so in the text,” KevIn confirmed. “And people read it out anyway. Because people are helpful. Fraudsters live off people being nice. That’s the saddest thing I’ve ever read about fraud.”

Mr Kasimiro looked into his coffee. “I read Siggi the code once. So he could order something.”

“What did he order?”

“Twelve keyrings. Shaped like bananas.”

Nobody said anything. There was no need.

The Key Without a Key

“There’s something better,” said KevIn. “It’s called a passkey⁶.”

“Pass-what?” asked Gisela.

“Passkey. An access key. Do you remember the physio? The two keys?”

Gisela nodded. After the review for Ayşe Kurt, KevIn had explained to her how the review was signed. A secret key that is never handed over, and a public one that anyone may see. You sign with the secret one; anyone checks the signature with the public one. What she had mainly understood was that it had something to do with a letterbox. That was enough for her.

“A passkey is exactly that,” said KevIn. “When you create a passkey for a website, your phone generates a key pair. The website gets the public key. The phone keeps the secret one, well hidden, and never hands it over. Not to the website, not to you, not to me.”

“And how do you log in then?”

“The website sends the phone a task. A random number. The phone signs it with the secret key, but only after you’ve put your finger on the phone or entered your PIN. The website checks the signature with the public key. If it fits, you’re in.”

“And the password?”

“There isn’t one any more. There’s nothing you could type in and give away.”

Mr Kasimiro frowned. “And if I land on one of those fake sites? With the hyphen?”

“That’s the beautiful part,” said KevIn, and you could hear that he really did find it beautiful. “The passkey is tied to the website’s real address⁷. The phone remembers: this key belongs to your bank, and to exactly this address. If a site with one extra hyphen comes along and asks for the key, the phone says: don’t know you. I haven’t got a key for you. It simply can’t do anything else.”

“The phone is cleverer than me,” said Mr Kasimiro.

“The phone isn’t clever. It’s stubborn. When it comes to security, that’s sometimes better.”

“And if I lose the phone?” asked Sabine.

“Then you need a backup route. Passkeys can be spread across several of your own devices, and many sites have a recovery code. You print it out and put it …”

“… not under the keyboard,” said Gisela. “I know. I’ve learned that.”

“Where, then?” asked KevIn.

“In the tin in the wardrobe. With the brooch.”

“The tin,” said KevIn carefully, “that the fraudsters on the phone just wanted to know about?”

Gisela opened her mouth. Closed it again. “I’ll find somewhere else.”

Herbert Gets Set Up

On Saturday Sabine set up passkeys for Gisela and, after lengthy negotiations, for Herbert too.

“Put your thumb on it now,” said Sabine.

Herbert put his thumb on it.

The phone vibrated. “Passkey saved.”

Herbert looked at the display. “And now? Where’s the password?”

“There isn’t one any more.”

“Then how am I supposed to remember it?”

“You don’t.”

Herbert thought about this. You could see it working away inside him.

“That’ll never catch on,” he said at last.

“Herbert,” said Gisela. “You said the internet would never catch on.”

“And it didn’t. Not with me.” He looked at the phone. “So far.”

Then he said something strange. “I had something like that once with a password. With internet money. Jürgen from the ‘Glück auf’ set it up for me. 2013. Don’t even know where it is any more.”

“Internet money?” asked Tobi.

“Digital stuff. Bit-something. I put two hundred euros into it. Bound to have been a con.”

KevIn said nothing. But somewhere between Dublin and Frankfurt, a fan spun a great deal faster than usual.

Late That Night

Shortly before midnight, when everyone was asleep, Gisela went out into the hallway once more. She lifted the receiver and dialled Tobi’s mobile number. He lived two rooms away.

It rang. A sleepy “Hm?”

“What’s the word?”

A long pause. Then, thick-tongued, the new word.

“Good,” said Gisela, satisfied. “Good night, my boy.”

“Grandma,” said Tobi, “I’m in the room next door. You could just have knocked.”

“I only wanted to make sure,” said Gisela, “that it’s you.”

She hung up. On the sideboard, the blue light pulsed.

“Good night, KevIn.”

“Good night, Gisela. May I ask you something? How do you actually know it’s me?”

Gisela stopped. She looked at the speaker, for a long time, the way you look at someone you’ve never thought about in that way before.

“You’re the only one,” she said then, “who talks that much and still never wants money.”