Someone else pointed out how easy it would be to make a video of anyone having a finger cut off, or similar torture, to scare the victim into believing that the “grandchild” forgot their password and needs you to override the password protocol to save their other 9 fingers. I have to agree. That’s like 80¢ of compute to do. If that’s effective even 30% of the time, it means “just have a password” doesn’t make you safe.
I mean that's a pretty extreme example though. It can be mostly gotten past by using the method used with alarm companies. One "danger" password and one "safe" password.