AI Scams: How to Spot and Stop Voice Clones, Deepfake Calls and AI Phishing

AI scams are old scams with better props. A cloned voice that sounds exactly like your son. A video call where the "CFO" is a deepfake. A message with no typos that knows your manager's name. The trick underneath hasn't changed: create urgency, then get money or a password before you stop to check. So the defence isn't learning to spot fakes. It's a few habits that make the fake irrelevant.

The three AI scams worth knowing

1. The cloned-voice emergency call. A caller sounds like a family member in trouble — a crash, an arrest, a hospital — and needs money now, usually by wire, gift cards or crypto. The FTC warns that scammers use voice cloning to make these calls convincing, and a few seconds of audio from a public video can be enough to train a clone.

2. The deepfake video call at work. In January 2024 a finance employee at the engineering firm Arup’s Hong Kong office joined a video call with what looked like the company’s CFO and colleagues. Reportedly every other person on the call was a deepfake. The employee made transfers totalling about US$25 million (HK$200 million). Seeing a face is no longer proof of who you’re talking to.

3. AI-written phishing and fake people. The FBI lists four ways criminals use generative AI: text (flawless phishing and scripts), images (fake profile photos and IDs), audio (voice clones) and video (fake live calls and promos). The old tells — bad grammar, a stock photo, a robotic voice — are mostly gone.

Why “spot the fake” isn’t enough

There are still tells: the FBI suggests looking for distorted hands or feet, odd teeth or eyes, and listening for unnatural tone or word choice on calls. Use them, but don’t rely on them. The tools improve every few months, and a scared, rushed person on the phone isn’t doing forensic analysis. A process beats a sharp eye.

Five habits that actually work

1. Agree a family code word. A word or phrase only your household knows. Anyone calling in an “emergency” has to say it. It comes from the FBI’s advice. Treat it as one check, not proof: a familiar voice, or even the right word, doesn’t prove who you’re talking to. Still hang up and call back on a number you already trust before you send money or sensitive information.
2. Hang up and call back on a number you already have. Not the number that called you, not a number in the message. Your saved contact, or the official number on the company’s website or the back of your card. The FTC’s first step for family emergency calls is exactly this.
3. Treat urgency plus an odd payment method as the alarm. Wire transfers, gift cards, crypto, “don’t tell anyone”, “it has to be in the next hour”. Before sending money or sharing sensitive information, hang up and verify the story through a number you already know. If you think someone is in immediate danger, contact emergency services.
4. At work: no money moves on one channel. Any new payment, changed bank details or “urgent transfer from the boss” gets confirmed on a second channel you start yourself — a call to a known number, or a second approver. A video call counts as one channel, not two.
5. Shrink the sample. Voice and face clones are built from what’s public. The FBI suggests making social accounts private and limiting followers to people you know. You don’t have to vanish, just stop handing out free training data.

Set it up in ten minutes

• Pick a code word with your household tonight. Tell everyone in the family, older relatives and teenagers included, so the whole household uses the same check.
• Check the people you’d panic about are saved in your phone, so a callback is one tap.
• Say out loud, once, as a family: “We will never ask each other for money by gift card, wire or crypto.”
• At work, ask finance or your manager: “What’s our callback rule for payment changes?” If there isn’t one, that’s the fix.

If you build AI apps

This page is about protecting people. If you build or test LLM applications, the attacks on your product are a different list — prompt injection, leaked system prompts, over-powered agents. Start at the LLM Security map, then practise in the AI Red Teaming Playground lab.

Sources

• FTC — Family emergency scams
• FTC — Scammers use AI to enhance their family emergency schemes
• FBI IC3 — Criminals use generative AI to facilitate financial fraud (PSA, Dec 2024)
• AI Incident Database — Incident 634 (Arup deepfake video call)

Written for StashGrid by Steven. Figures and advice checked against the sources above on the date in the chip. Spot something out of date? Tell me and I will fix it.