Also called: grandparent scam · family in need of bail · emergency scam · bail scam · ore-ore sagi
A family emergency scam is a call claiming a relative has been arrested, injured or detained and needs money urgently. A second voice — a lawyer, a bail bondsman, a police officer — takes over, asks for secrecy, and sends a courier to collect cash. Agreeing a family code word in advance defeats the entire category.
Key facts
Category
Impersonation
First documented
2008
Typical loss
$2k–$50k USD, per victim
Main channels
phone call, SMS, WhatsApp, voicemail, video call
Who is targeted
People over 65 with grandchildren, targeted by name where possible; Anyone who answers a landline, which is how most of these calls arrive; People living alone, where nobody else is present to ask a question; Increasingly, parents contacted by text rather than grandparents by phone
Documented origins
Dominican Republic, Canada, United States, Mexico, Japan
Main targets
United States, Canada, United Kingdom, Australia, Japan, Ireland, New Zealand
Case files
7 documented cases
Last reviewed
2026-09-06
The stages of the scheme, in order, with the point where it can still be stopped.
What it is
The phone rings. A young voice, crying, says “Grandma? It’s me.” There has been an accident. Or an
arrest. Or a detention at a border. They are frightened, they are in trouble, and they need money
before something irreversible happens — and please, please do not tell Mum.
That is the whole scheme, and it is over inside an hour. There is no relationship phase, no fake
platform, no weeks of grooming. It is built for speed, because everything it needs — panic, urgency,
secrecy — decays the moment the victim has a chance to think or to reach anyone else.
The mechanics are cheap. The caller often does not know the grandchild’s name; the classic opening
invites the victim to supply it. A second voice takes over — a public defender, a bail bondsman, a
police sergeant — which conveniently explains why the first voice sounded unfamiliar and adds the
authority the story needs. Then a courier arrives at the door for the cash.
That courier is the part that distinguishes this from almost every other scam on this site. It
requires a person, physically, at a known address, at a known time — which is a vulnerability, and one
that enforcement has used.
How it actually works
A distressed voice, and a name you supply
“Grandma? I’m in trouble.” Crying, muffled, on a bad line. When the victim says a name, the caller
takes it. Where names are known in advance they come from social media, obituaries or data
brokers — not from knowing your family.
Where it could have stopped
A family code word, agreed in advance and never posted online, ends this call in ten seconds. It survives spoofed numbers, voice cloning and a genuinely convincing story, and — unlike every other defence — it works on a frightened person who has just been told their grandchild is in a cell.
Something shameful, and time-limited
A car accident with an injured passenger. A drink-driving arrest. Detention on holiday. The
scenario is chosen to be embarrassing, which supports the request for secrecy that follows.
Handed to an authority
“I’m putting you on to my lawyer.” The second voice is calm, procedural, and knows what happens
next. It also resolves the one loose end: the first voice did not sound quite right because it
was distressed, and this voice is not supposed to be familiar at all.
Secrecy, framed as protection
Please don’t tell my parents. There is a publication ban. The court requires confidentiality.
Every version removes the person who would have called the grandchild directly.
A deadline that cannot move
Arraignment is at noon and bail must be posted first. The medical procedure needs authorising now.
The flight leaves in two hours. The deadline exists to prevent the ten minutes of checking that
would end it.
Cash, collected at the door
A courier arrives, exactly as the lawyer said one would — which a frightened person reads as
confirmation that the process is real. Sometimes cash is sent by post inside a book or a magazine
instead, on instruction.
A second call
Complications. An additional charge. More bail. Victims who paid once are frequently returned to
until they run out or find out.
Why it works
It targets a real relationship, not a fake one. Most scams have to manufacture trust. This one
borrows trust that already exists and is unconditional. Nobody applies due diligence to a grandchild
in distress, and the scheme is entirely built on that.
Panic removes the checking step. The story is engineered to produce immediate fear, and fear
narrows attention to the problem in front of you. The details that would not survive a calm reading —
why is a court taking cash from a private home? — are never examined, because nothing is examined.
Speed is a design goal. From first call to courier is often under an hour. Every other scheme on
this site takes days or months; this one takes less time than it would take to call your daughter and
ask.
Secrecy is requested by the “victim”. This is the elegant part. The request not to tell the
parents comes from the person the grandparent is trying to protect, which makes complying feel like
loyalty rather than concealment.
The unfamiliar voice is pre-explained. Distress, a bad line, a broken nose from the accident.
Where AI voice cloning is used, no explanation is needed at all — a few seconds of audio from a social
media video is enough.
And the courier confirms the story. A stranger arriving to collect money should be alarming.
Inside this narrative it is the opposite: the lawyer said someone would come, and someone came.
Where it comes from
The documented production centres for the North American version are call centres in the Dominican
Republic, with couriers based in US cities to collect. The May 2025 New Jersey indictment described
on this page charges exactly that structure: an operation run from Dominican call centres, targeting
elderly Americans with the claim that a loved one had been arrested and needed bail, and a courier in
New York doing the collecting.
Canada has seen large domestic networks running the same script, and the Canadian data shows something
unusual: the scheme was pushed back. Reported losses rose from C$2.5 million in 2021 to C$11.6
million in 2023, then fell 72% to C$3.3 million in 2024 and further in 2025. Reports and victim counts
fell alongside the dollars, which argues against it being a reporting artefact.
The likely reason is the courier. It is the one point where the crime has to touch the physical world
— a person, at an address, at a time — and Canadian forces ran operations against exactly that, while
the CAFC pushed sustained public warnings about the specific script.
Japan has its own long-established version, ore-ore sagi — literally “it’s me, it’s me” fraud —
which has been a sustained national problem for two decades. It uses the same opening line and the
same courier collection, adapted to a country where cash withdrawal limits and bank staff training
have both been changed specifically in response to it.
The caution worth attaching: the decline in Canada may be partly migration rather than suppression.
The “hi Mum” text variant needs no courier, no accent and no acting, and it grew over the same period.
Between 2021 and 2025 the share of Canadian emergency scam reports arriving by text message rose from 1.2% to 17.7%, while the telephone's share fell from a peak of 71% to 56%. Losses through the text channel went from C$7,300 in 2021 to C$371,504 in 2024. The scheme did not change; its delivery did, and the change carries a different victim and a different defence.
The Canadian Anti-Fraud Centre files grandparent scams under "Emergency (Jail, Accident, Hospital, Help)", and its open dataset shows a category that rose fast and then fell just as fast. Reported losses went from C$2.5 million in 2021 to C$11.6 million in 2023, then dropped to C$3.3 million in 2024 and C$1.5 million in the first nine months of 2025. It is one of the clearest examples in any national dataset of a scam category being pushed back.
In May 2025 a grand jury in the District of New Jersey indicted Jhonny Cepeda of New York with wire fraud conspiracy. Prosecutors allege he worked as a courier in a "grandparent" or "family-in-need-of-bail" scam run from call centres in the Dominican Republic, which deceived numerous elderly Americans into believing a loved one had been arrested and urgently needed cash for bail and legal fees.
The FBI received more than 22,000 complaints reporting AI-related information in 2025, with adjusted losses of $893,346,472. Its breakdown is more useful than the headline: over $30 million in AI-linked business email compromise, over $19 million in romance and confidence scams with a likely AI nexus, over $5 million in voice-cloned distress scams, and almost $13 million in employment scams where voice spoofing was used in interviews.
Japanese ore-ore fraud nearly tripled in the first half of 2025 — 6,278 cases against 2,140 a year earlier — and the growth came almost entirely from young adults. Cases among people in their twenties rose 1,015.9% and among people in their thirties 918.6%. The share of all special-fraud victims who were elderly fell by 17.8 percentage points in a single year.
In May 2025 a grand jury in the Northern District of Florida charged Atharva "Andy" Sathawane with conspiracy to commit wire fraud and conspiracy to commit money laundering over a scheme that defrauded elderly victims across the United States into handing over money and gold in response to fraudulent phone calls and messages. The FBI recorded roughly 725 complaints and .8 million in losses to gold-courier schemes in 2025 — an average loss per complaint of over ,000.
The ACCC issued a formal alert on 23 August 2022 after more than 1,150 Australians lost A$2.6 million to family impersonation messages in seven months, most of them in June and July. It is the first national regulator to name and count the WhatsApp form of the emergency scam separately from the telephone one. Reports reached 9,307 in the first nine months of 2023.
A caller who does not identify themselves and waits for you to say a name.
An emergency requiring money within the hour. Real legal and medical processes survive a phone call to another family member.
A request not to tell other family members. The single strongest signal in this category.
Being handed to a “lawyer”, “bail bondsman” or “officer” who takes over the conversation.
Anyone offering to collect cash from your home. No court, police force, lawyer or bail bondsman does this, anywhere.
Instructions to send cash by post, concealed in a book, magazine or gift.
A request for gift cards or cryptocurrency for bail. Courts do not accept either.
Pressure not to hang up, or to stay on the line while you go to the bank.
A story you cannot verify because the person is “not allowed” to talk — in custody, in surgery, in transit.
A second call asking for more after the first payment.
If it’s happening to you
On the call now. Hang up. Then call your grandchild — or their parent — on the number you already
have. That is the entire defence, and it takes two minutes.
If you cannot reach them immediately, that is not evidence the story is true. Call someone else in the
family. Ask a question only the real person could answer, and be aware that a caller who deflects it
(“I can’t think straight, Grandma”) is telling you something.
Do not let the caller keep you on the line while you go to the bank. Do not let anyone come to your
home.
If money has gone.
Call your bank’s fraud line immediately. A transfer that has not settled may be recallable, and
a cash withdrawal at least tells the bank to watch the account.
If a courier is coming or has come, call the police. This is one of the few scams where there
is a physical person to identify, and courier arrests are how these networks get dismantled. If a
collection is still expected, say so — police have run controlled operations on exactly this.
Keep everything. The number that called, the times, the names used, any packaging if cash was
posted.
Expect a second attempt. Households that paid once are called again.
Preventing it. Do the two things that actually work, now rather than later.
Agree a family code word. Something not guessable and never posted anywhere. Tell the older
members of the family what it is for: any caller claiming to be a relative in trouble who cannot say
it is not one.
Agree a rule: we always call back. Not because anyone doubts anyone, but because that is simply
what this family does. Framing it as a household rule rather than as suspicion is what makes it stick
when someone is frightened.
Where the money goes
This is one of the few schemes still running substantially on physical cash, and that is a deliberate
choice rather than a legacy. Bank transfers get flagged, delayed and questioned by fraud teams. A
grandmother withdrawing $8,000 from her own account is an ordinary transaction that no system stops.
The courier consolidates collections and passes them up — sometimes converting to cryptocurrency,
sometimes moving cash physically, sometimes buying goods for export. Gold has become an increasingly
common intermediate step for larger sums, for the same reason cash is used for smaller ones: it is
outside the banking system’s view.
Because the courier layer is domestic, it is also where prosecutions start. The couriers are usually
the only participants standing inside the country the money was taken from.
No agency publishes a line item for most of the schemes on this site, so these charts show the
official categories that contain this scheme. Each series is labelled with the agency's
own category name. See how the mapping works.
Canadian Anti-Fraud Centre Fraud Reporting System Dataset.
Canadian Anti-Fraud Centre / RCMP. Accessed 2026-09-06. Supports: Canadian Emergency-category reports, victims and losses 2021 to 30 September 2025, including the 2023 peak and subsequent decline.
2025 Internet Crime Report.
FBI Internet Crime Complaint Center. Accessed 2026-09-06. Supports: Gold courier complaint volumes and losses, and the age distribution of US fraud losses.
Consumer Sentinel Network Data Book 2024.
US Federal Trade Commission. Accessed 2026-09-06. Supports: 34,377 Family & Friend Imposter reports in 2024, and median losses by age band.
Report fraud and cybercrime.
Canadian Anti-Fraud Centre. Accessed 2026-09-06. Supports: Canadian reporting routes and the CAFC's statement that most fraud is never reported.
Common questions
How did they know my grandchild's name?
Often they did not. The classic opening is a distressed 'Grandma, it's me' and the victim supplies the name themselves. Where a name is used, it usually came from social media, an obituary, or a data broker — none of which requires knowing your family.
It really sounded like him.
A frightened, crying voice on a bad line is hard to identify even when it is genuinely someone you know, and the story explains the distortion in advance. AI voice cloning now also exists and needs only a few seconds of reference audio. Neither possibility is worth arguing about in the moment: hang up and call the person on their own number.
What is the single best defence?
A family code word, agreed in advance and never shared online. Any caller claiming to be a relative in trouble who cannot produce it is not one. It costs nothing, it survives spoofed caller ID and voice cloning, and it works when the person answering is frightened — which is when nothing else does.
Would a court or a lawyer ever send someone to collect bail money in cash?
No. Bail is paid at a court or a custody facility, by the person paying it. No court, police force, bail bondsman or lawyer sends a courier to a private home to collect cash, and a real legal process can survive a ten-minute delay while you check.
They begged me not to tell their parents. Should I respect that?
No. The request for secrecy is the scam protecting itself from the one person who would immediately know the truth. A real grandchild in real trouble is not harmed by their parent finding out; a scam is ended by it.
Is the 'hi Mum' text the same scam?
It is the same structure with a cheaper delivery: a text from a new number claiming to be a child who has lost their phone, followed by an urgent payment request. It needs no courier, no accent and no acting, which is why it has grown in several countries while the phone version has declined.
Where the money goes after it leaves, and where it becomes hard to recover.
Reporting is what produces the enforcement data on this page. Find the right agency and phone
number for your country on the report page. If money moved in the last
few hours, call your bank first.