Your Household Needs an Identity Verification Protocol. Here's How to Build One.
There was a reasonable filter that most people used for most of the past decade. It wasn't formal. Nobody taught it explicitly. But it worked often enough that it became habit: if something looks professional, reads well, and sounds like the person you know, it's probably legitimate.
Microsoft's Digital Defense Report 2026 — based on the company's own telemetry — documents that AI is systematically removing the signals this filter depended on. AI-enhanced phishing tripled its share of observed intrusions year-over-year. The grammar errors are gone. The robotic voices are smoother. The tell that used to give fraud away has become unreliable.
This is not a reason to panic. It is a reason to replace an informal habit with a deliberate system. The good news: that system is not complicated, and once it's in place, it requires very little ongoing effort.
What you're replacing — and why
The old filter was: does this look right? It worked because fraud used to be detectable by surface quality. It no longer works because surface quality can be manufactured.
What you need instead is a process that doesn't depend on appearances at all. A process that works whether the email is polished or rough, whether the voice sounds exactly right or slightly off, whether the lure is convincing or not.
The question isn't does this look legitimate? The question is: have I verified this through a separate channel?
Four things to put in place this week
1. A household codeword.
Agree on a single private word or short phrase that any member of your household can use in an unexpected call to confirm their identity. It should be memorable, completely private, and never sent by text or email. The codeword serves one purpose: if someone calls in an apparent emergency, asking for the codeword confirms the call is real without giving an impersonator anything useful. Set it up this week. Have the conversation with the people it covers.
2. A callback rule.
Establish a household rule: any unexpected request that involves money, account access, passwords, or personal information is automatically subject to a callback verification. The caller — regardless of who they appear to be — is told you'll call them back on a number you already hold. Then you end the call and do exactly that. This rule should be applied consistently, including when the caller seems entirely genuine. Consistency is what makes it protective.
3. A short list of verified numbers.
Write down or save the official contact numbers for your bank, key service providers, and the most important people in your life — separate from what appears in an incoming call. When you need to call back to verify, these are the numbers you use. Not the number that called you. Not a number provided during the call. A number you already hold independently.
4. An agreement about emergency communications.
Discuss with the people you care about — particularly older family members — how you would genuinely communicate in an emergency. Which channel would you use? What would you say? Who would you contact first? A pre-agreed emergency communication pattern makes unexpected-channel requests immediately suspicious, because you'd already know what a real emergency contact from that person looks like.
What preparation actually gives you
None of these steps are complicated. None require technical knowledge. All four can be completed in a single family conversation. But their value compounds over time, because the risk they protect against is not static.
Microsoft's analysis characterises AI-enhanced intrusions as a growing share of observed attacks — suggesting this is a trend, not a one-time event. The technical capability to generate convincing voices and polish phishing lures will not become less available. More threat actors will access it, and the quality will continue to improve.
What that means practically: a household that makes these arrangements now is protected not just against today's lures, but against increasingly sophisticated versions of them.
Preparation and monitoring
Preparing your household — building these protocols, having these conversations — is something you do once and maintain lightly. It doesn't require you to monitor cybersecurity news, track Microsoft reports, or stay current on how AI capabilities are developing.
That's what ongoing monitoring is for. When a development crosses the threshold where it changes what you should do or how you should behave, you should know about it — without having to go looking.
That is exactly what AI Failsafe is designed to provide.
Know what changed. Know what matters. Know what to do.
AI Failsafe monitors important developments in AI, digital trust, cybersecurity and infrastructure and translates them into practical intelligence for ordinary people and households.
Prepare now. Then let AI Failsafe keep watch.
Choose the protection that fits you:
