By: Emily Parker
Tom Arnold has led breach investigations involving more than 7,000 servers. He has testified before the U.S. Senate and House on cybersecurity legislation. He sits on the steering committee for the Las Vegas branch of the U.S. Secret Service Cyber Fraud Task Force. He has seen, in granular technical detail, what the online world does to people who don’t know how to protect themselves.
And the thing that disturbs him most isn’t the sophisticated nation-state attack or the complex financial fraud. It’s something much closer to home.
It’s the AI-generated voice of a mother’s daughter calling to say she’s been kidnapped.
The Phone Call That Wasn’t
Tom describes a case from near where he lives that illustrates exactly how far cybercrime has evolved. A mother dropped her daughter off at school. Thirty minutes later, her phone rang. It was her daughter’s voice, panicked, saying she’d witnessed a drug deal and been grabbed by a gang. A male voice came on. Wire ten thousand dollars to Mexico, or the daughter gets hurt.
The voice was perfect. The mother went to the bank. She wired approximately $2,000 before the call dropped. When she called her daughter directly, she discovered the girl was sitting in class. The entire incident was fabricated using AI voice cloning.
Tom offers three practical defenses. Text the supposed victim directly during the call to verify they’re safe. Recognize that fear and urgency are the primary tools bad actors use, and treat that pressure itself as a red flag. And establish a secret code word with family members that can be slipped into conversation to prove identity, something AI won’t know.
The Defender’s Impossible Standard
One of the most striking things Tom says about cybersecurity comes from his years on the defensive side of investigations. A cybersecurity defender must be perfect, achieving 100% effectiveness every single time. The bad actor only needs to find one open vulnerability.
That asymmetry is the defining reality of the cyber threat landscape. Even the very best defensive strategy can be penetrated. It doesn’t mean defense is futile. It means vigilance isn’t optional.
What People Don’t Understand About Privacy
Tom raises a question most people would answer incorrectly. If someone asks your name, is that private information? What about if they ask what the weather is like where you are?
His answer is that both might be private, depending on context. Information not directly related to the topic at hand should be protected. A teenager playing an online multiplayer game who shares their location, schedule, or daily routine in voice chat isn’t just oversharing. They may be handing someone a blueprint who is actively looking for a target.
The teen who posts everything they’re currently doing can result in the whole family being targeted. That’s not a hypothetical. Tom has worked the cases.
If the AI voice scam story made you stop and think, The Digital Detective: First Intervention by Tom Arnold is available now on Amazon. Real threats, real tools, real lessons, wrapped in a story kids ages 10 and up won’t want to put down.
