AI scams and deepfakes are no longer niche threats aimed at celebrities or politicians. Ordinary people now encounter them in job interviews, phone calls, video chats, and social media feeds. The technology that generates convincing fake audio, video, and text has become cheap and widely accessible, which means the volume of AI-powered fraud is rising sharply. Understanding how these scams work is the first step to not falling for one.
What deepfakes actually are
A deepfake is synthetic media produced by an AI model trained on real images, audio, or video of a person. The model learns the subject's voice, face, and mannerisms well enough to generate new footage that never happened. Early deepfakes required thousands of source images and expensive hardware. Today, some tools need fewer than 30 seconds of audio to clone a voice, and free apps can swap faces in real time on a live video call.
Scammers use deepfakes for two broad purposes. The first is impersonation: faking a family member in distress, a company executive authorising a payment, or a government official demanding compliance. The second is fabricated evidence: creating fake videos of a person saying something they never said, then using that footage to extort, discredit, or defraud them.
How to recognise a deepfake video or audio
Perfect deepfakes exist, but most circulating in the wild still have tells. Look for unnatural blinking. AI face-swap models historically struggle with eyelids, producing either no blink or a blink that looks mechanical. Watch the edges of the face, especially around the hairline and ears, where the generated texture tends to blur or shimmer when the subject moves.
In audio deepfakes, listen for flat emotional cadence. Cloned voices reproduce the timbre of a person but often miss the micro-pauses, breath sounds, and pitch shifts that come with genuine feeling. A "son" calling to say he's been arrested who sounds oddly calm and even-paced is a red flag. Background noise that cuts off abruptly or sounds synthesised is another.
For video calls specifically, test the feed. Ask the person to turn sideways so the camera captures their profile. Most real-time deepfake tools degrade badly on profile angles because the training data is overwhelmingly frontal. A sudden freeze, excuse, or connection drop when you make that request tells you something.
Common AI scam formats in 2026
Three formats dominate AI-assisted fraud right now.
- Virtual kidnapping calls. A cloned voice of a family member screams that they've been taken. A second voice demands immediate wire transfer. The real family member is fine and unaware. The entire crisis is fabricated from a few seconds of publicly available audio, often scraped from social media.
- CEO fraud with video. A finance employee receives a video call from someone who looks and sounds exactly like the company's chief executive, instructing them to transfer funds urgently. This variant has cost companies millions of dollars in documented incidents.
- Romance deepfakes. An AI-generated persona maintains a relationship over weeks or months, building trust before requesting money, gift cards, or cryptocurrency.
Practical steps to protect yourself
Establish a family code word. Pick a word or short phrase that only close relatives know, and agree that anyone calling in an emergency must say it unprompted. No code word means no money moves, full stop. This costs nothing and defeats the virtual kidnapping scam almost completely.
Slow down any request that pairs urgency with payment. Urgency is the core mechanism of every AI scam. The pressure to act before you can think is deliberate. Hang up, call back on a number you already know, and verify the situation independently before doing anything financial.
Check the source before you share or react to a video. Microsoft's Security team and other organisations publish tools and guidance for detecting synthetic media. Reverse image searching a still frame from a suspicious video often surfaces the original footage a deepfake was built from.
Enable multi-factor authentication on all financial accounts. AI scams that succeed at social engineering still need access to accounts. A strong second factor blocks that path even when a scammer has convinced someone to hand over a password.
Limit publicly available audio and video of yourself where practical. Scraped social media content is the raw material for voice and face cloning. Locking down profiles, removing old video posts, and setting strict audience controls on platforms like Instagram and TikTok reduces the training data available to anyone targeting you.
What to do if you've been targeted
Report the incident to your national cybercrime authority. In Australia, that's the Australian Cyber Security Centre. In the United States, the FBI's Internet Crime Complaint Center (IC3) handles these cases. Reporting matters even when no money was lost: it feeds threat intelligence that helps agencies track patterns and issue public warnings.
If a deepfake of you has been created and distributed, document everything before attempting a takedown. Screenshot the content, record URLs, and note timestamps. Platforms move fast to remove synthetic media once reported, but evidence gathered before removal is essential if the case escalates to law enforcement or civil action.
Contact your bank immediately if money was transferred. Banks have fraud response teams that can sometimes halt or reverse transactions if they're notified quickly. The window is narrow, often 24 hours or less, so speed matters.
The technology will keep improving
Deepfake detection tools are improving in parallel with generation tools, but it's genuinely a race. The National Institute of Standards and Technology (NIST) runs ongoing evaluations of AI detection methods and publishes its findings publicly. The honest position is that behavioural habits and verification processes protect people more reliably than any single detection tool right now. Know the patterns. Slow down. Verify independently.