Snapshot caveat: Fraud dollar totals and survey percentages shift as agencies and vendors publish new reports, and scam tactics keep evolving. The human defenses described here do not. Reflects June 2026.
AI Scams and Fraud
AI & You
7 min read
In Short
AI does not invent new scams. It makes old ones cheaper and far more convincing, cloning a voice from a few seconds of audio or faking an entire video call, as in the 25-million-dollar Arup case. The old-fashioned defenses still work. Agree a family code word, and when a message pushes you to act fast, hang up and call back on a number you already have.
01. What It Is
AI-assisted fraud is old-fashioned social engineering with better props. Social engineering means tricking a person into sending money or handing over access, rather than breaking into a computer. The scam types are familiar, the relative in trouble, the urgent transfer for the boss, the online romance, the phishing email. What changed is the disguise. Cheap AI tools now produce a convincing voice or face in minutes and write flawless scam messages at scale.
It helps to separate two questions.
One is whether the media is real, the deepfake problem covered in deepfakes-and-detecting-ai-media. The other is whether the request is real, the focus here. A faked voice or video is only the bait, used to make you move money or reveal a credential.
02. Why It Matters
The losses are large and rising. US consumers reported losing more than 12.5 billion dollars to fraud in 2024, a 25 percent rise over 2023, according to the FTC. Imposter scams were the most reported category and second by dollar losses at 2.95 billion, behind investment scams at 5.7 billion. The FTC ties the jump to scams becoming more convincing, not more numerous.
Older adults are losing life-changing sums. The FTC found that combined losses among adults 60 and over who lost more than 100,000 dollars to government or business impersonation rose eight-fold, from 55 million dollars in 2020 to 445 million in 2024.
The problem reaches trained professionals. In early 2024 a finance employee at UK engineering firm Arup paid out about 25.6 million dollars across 15 transactions after a video call on which the chief financial officer and every other colleague was an AI deepfake, as reported by CNN. No system was breached. People were deceived.
03. How It Works
Voice cloning from seconds of audio
A scammer needs only a short clip of someone's voice, often pulled from videos posted online, plus a voice-cloning program. McAfee researchers, in a vendor study, cloned a voice to an 85 percent match from three seconds of audio, and to 95 percent with a few more samples, using free tools. The clone then powers two everyday attacks. In the grandparent or family-emergency scam, a panicked "relative" calls saying they were in an accident or arrested and need money now. In the fake-boss scam, a "manager" phones an employee to approve an urgent payment before anyone can check.
Deepfake video fraud
Faked video now runs on live calls. The Arup case is the clearest example. The employee first suspected the "secret transaction" message was phishing, but his doubts fell away because everyone on the call looked and sounded like real colleagues. It surfaced only when he later checked with head office. Arup's technology chief, Rob Greig, called it "technology-enhanced social engineering" and afterward built a rough real-time deepfake of himself with free open-source software in about 45 minutes.
AI phishing at scale and romance scams
Most fraud still arrives as text. Email was the most common scam-contact method reported to the FTC in 2024, ahead of phone calls and texts. AI lowers the cost of writing convincing phishing and romance messages and translating them into fluent local language. The FBI notes that generative AI fixes the spelling and grammar mistakes that once gave scams away, so a polished message is no longer reassuring. The same tools spin up fake profiles, fake photos, fake IDs, and fake investment sites. In a romance or "pig-butchering" scam, a stranger builds a bond over weeks, then steers the victim into a fake crypto investment, with AI generating the photos and the chat.
04. How to Protect Yourself
The reliable defense is a habit, not a tool. These steps come straight from FTC and FBI guidance.
- Agree a family code word. Pick a private word with close family and trusted colleagues, and never share it by text, email, or social media. If a panicked "relative" or "boss" cannot give it, treat the call as a scam. The FBI lists this first, and Starling Bank built its "Safe Phrases" campaign around it.
- Hang up and call back on a known number. Do not dial the number that contacted you, since caller ID is easily spoofed. Use one you have saved or look up independently. If you cannot reach the person, check with another family member.
- Verify money and credential requests on a second channel. For any unusual transfer or password request, confirm through a separate, known contact before acting. The Arup loss was caught only by a later head-office check.
- Treat urgency as the warning sign itself. A demand to act right now and tell no one is the engine of the scam. Pausing for five minutes defeats most of them.
- Refuse hard-to-reverse payments. Wire transfers, cryptocurrency, gift cards, and Bitcoin ATMs are red flags. No real bank or agency tells you to move money "to keep it safe" or to read back a one-time 2FA code.
- Limit the voice and video you expose publicly. Set social accounts to private, and treat any public video, podcast, or webinar as raw material for a clone.
- Report it. US consumers can report to the FTC at ReportFraud.ftc.gov, and suspected crimes or losses to the FBI Internet Crime Complaint Center at ic3.gov. Reporting aids investigations and warns others even when the money is gone.
05. Key Terms
| Term | Plain meaning |
|---|---|
| Voice cloning | Using AI to copy a person's voice from a small audio sample, as little as three seconds, so a scammer can speak "as" them. |
| Deepfake | AI-made audio, image, or video that convincingly depicts a real person. In fraud it can run live on a video call. |
| Imposter scam | The FTC's most-reported category. Pretending to be someone you trust, such as a relative in trouble (grandparent scam) or a boss demanding a transfer (business email compromise). |
| Vishing and smishing | Phishing by voice call, often a cloned voice, and by SMS text. Both push you to act before you think. |
| Social engineering | Manipulating a person into sending money or sharing a code by exploiting trust and urgency, not by hacking a machine. |
| Safe word / code word | A private word agreed in advance with family or colleagues, never shared digitally, to confirm a caller is who they claim. |
| Pig butchering | A long-game romance-and-investment scam where a stranger builds rapport over weeks, then lures the victim into a fake crypto investment. |
06. Common Misconceptions
"I would recognize my own child's or partner's voice."
A clone from three seconds of audio can reach an 85 percent match, and in a McAfee survey 70 percent of people were not confident they could tell a clone from the real voice. Under manufactured panic, recognition only gets worse. The voice sounding right is not proof.
"A live video call cannot be faked, so seeing them is proof."
In the Arup case the victim was on a video call where the CFO and every colleague was a deepfake. Arup's technology chief built a real-time deepfake of himself in about 45 minutes with free software. A face on a screen is no longer proof of identity.
"Only naive or elderly people fall for this."
A trained finance professional approved 25 million dollars. Older adults report the largest losses, but every age group is targeted. These scams exploit engineered urgency and authority, not stupidity.
"Bad spelling will give a scam away."
The FBI states that generative AI fixes the spelling and grammar errors that used to be warning signs and translates messages into fluent local language. A clean message is no longer reassuring.
"My bank or detection software will catch it first."
Clone and deepfake detection is still research-stage, and money sent by wire transfer or crypto is usually unrecoverable. The dependable defense is a habit. Pause when pushed to hurry, and verify on a separate channel before money moves.