Cybersecurity Geniuses

Learn / Threats explained

Deepfakes and AI-powered scams

Cloned voices, fake video calls and flawless AI-written phishing. What AI changes about scams, what it does not, and the verification habits that still beat it.

2 min read · Updated October 2026

What has changed

Generative AI tools can now write fluent text in any language, clone a voice from a short audio clip and produce convincing fake images and video. Criminals use the same tools:

  • AI-written phishing without spelling mistakes, tailored to your job or interests.
  • Voice cloning to imitate a relative, a boss or a bank employee on the phone.
  • Deepfake video calls in which a "manager" or "colleague" appears on screen to approve a payment. In a widely reported case in Hong Kong in early 2024, an employee was tricked into transferring about 25 million US dollars after a video call with deepfaked colleagues.
  • Fake endorsements: synthetic videos of celebrities promoting investment schemes or giveaways.
  • Fake documents and IDs to pass identity checks.

What has not changed

The scam still needs you to act quickly, secretly and through an unusual channel. AI improves the costume, not the request. A cloned voice still has to ask you to wire money, buy gift cards or share a code, and that request is where you can stop it.

Spotting deepfakes (and why you should not rely on it)

Older deepfakes showed odd blinking, blurry edges around the face, lip movements out of sync and strange lighting. Newer ones may show none of these. It is useful to notice glitches, but the reliable defense is verification, not detection.

Verification habits that beat AI

  1. Family code word. Agree a word or question that only your family knows. If a "relative" calls in distress, ask for it.
  2. Call back. Hang up and call the person on a number you already have saved.
  3. Ask something only the real person would know, and not something visible on social media.
  4. For business payments, require a second approver and a call-back to a known number for any new or changed bank details, regardless of who appears on the call.
  5. Slow down. Any request that forbids you from checking with someone else is a red flag.
Tip

Reduce the raw material: set social media accounts that show your voice and family to private, and be thoughtful about posting long voice clips publicly.

For businesses

  • Treat voice and video as insufficient authorisation for payments or password resets.
  • Train finance and help-desk staff with real examples of deepfake fraud.
  • Use phishing-resistant multi-factor authentication for staff, so a convincing call alone cannot get someone into your systems.
  • Have a clear, blame-free way for staff to pause and verify a request from a senior leader.

If you are targeted

End the call, verify through a trusted channel, and report it: to your bank if money moved, to the FTC (ReportFraud.ftc.gov) or IC3 in the US, or to Action Fraud in the UK. If someone made a deepfake of you, report it to the platform where it was posted; most major platforms have specific policies against impersonation and synthetic media.

PreviousData breachesNextIdentity theft

Keep learning

THREATSmishing andvishingThreatSmishing and vishingPhishing by text message and phone call. Fake delivery texts, "your bank's fraud team" and toll-road scams explained, plus how to verify any caller safely.THREATSocialengineeringThreatSocial engineeringHacking people instead of computers. The psychological levers attackers pull, from pretexting and baiting to tailgating, and how to build habits that resist them.THREATPhishingThreatPhishingFake emails, texts and websites built to steal your logins, money or data. Learn the tell-tale signs and the one habit that defeats almost every phishing attempt.