In early 2024, a finance worker at the engineering firm Arup joined a video call with what looked like the company’s chief financial officer and several colleagues. Every face and voice on that call was fake. The worker was convinced and transferred about 25 million US dollars across multiple payments. This is what defeating deepfakes and phishing looks like in real life, and it shows why old advice like “look for spelling mistakes” no longer protects you.
Artificial intelligence has handed scammers better tools than they ever had before. They can clone a voice from a few seconds of audio, write flawless emails in any language, and build fake video in minutes. The good news is that the defenses are simple, and most of them are habits rather than software. This guide explains how these attacks work, how to spot them, and what to do the moment something feels wrong.
Why AI Has Changed Online Scams
Phishing used to be a numbers game. Criminals sent millions of clumsy emails and hoped a few people clicked. Now AI helps them write personal, polished messages that mention your employer, your bank, or your recent purchases. The message often looks more professional than the real ones you receive.
Deepfakes add a second layer. A deepfake is audio, video, or an image created or altered by AI to make someone appear to say or do something they never did. When the two techniques are combined, an email asks for a “quick call,” and the call itself is fake.
Voice Cloning
Voice cloning needs very little material. A short clip from a social media video, a podcast, or a voicemail greeting can be enough. Scammers then phone a relative and claim to be a family member in trouble or ring an employee while pretending to be a manager.
Fake Video and Images
Fake video is harder to make well, but it is improving fast. It is used for fake investment adverts featuring famous faces, bogus job interviews, and live video calls, like the Arup case. Fake profile photos are also used to build convincing accounts on social networks and dating apps.
Real Cases That Show the Danger
Examples make the risk easier to understand. These cases were widely reported, and each teaches a different lesson.
- UK energy company, 2019: the head of a UK subsidiary received a call that sounded exactly like his German parent company’s chief executive. He transferred roughly 220,000 euros to a supplier account before the fraud was discovered.
- New Hampshire robocalls, 2024: thousands of voters received a call using an AI-generated voice that imitated a well-known politician, urging them not to vote in a primary. It showed that voice fakes can target public trust, not just bank accounts.
- Arup video call, 2024: the case above proved that seeing a face on screen is no longer proof of identity.
- Fake celebrity investment adverts: across social media, adverts have used cloned voices and faces of famous people to push fraudulent trading platforms, and many people have lost savings.
The pattern is the same each time. The attacker creates urgency, borrows authority, and asks for money or access. The technology changes, but the psychology does not.
Old Phishing Versus AI Phishing
Understanding what has changed helps you adjust your instincts. The table below compares the two.
| Feature | Traditional phishing | AI-powered phishing |
|---|---|---|
| Writing quality | Spelling and grammar errors | Clean, natural language |
| Personalization | Generic greeting | Uses your name, job, and habits |
| Channel | Mostly email | Email, SMS, calls, video, and chat apps |
| Proof of identity | Fake logo | Cloned voice or face |
| Scale | Mass mailing | Mass and highly targeted at once |
How to Spot a Deepfake
No single sign is reliable, because the technology keeps improving. Use several checks together and trust your sense that something feels slightly off.
- Unnatural blinking or stiff expression: the face may look smooth while the eyes and mouth feel disconnected.
- Lip sync problems: words may arrive a fraction too early or late.
- Odd lighting: shadows on the face may not match the room.
- Flat or oddly paced voice: clones often lack natural pauses, breathing, and background noise.
- Glitches when the person moves: a hand across the face or a quick head turn can break the illusion.
- Unusual requests: a boss who never asks for urgent payments suddenly demands one.
The last point matters most. Technical checks fail over time, but a strange request is a clue that stays reliable.
How to Spot AI-Powered Phishing
Because the writing is now polished, focus on behavior rather than grammar. Ask yourself four questions before you act on any message.
- Did I expect this message, call, or request?
- Does it push me to act immediately?
- Does it ask for a password, code, payment, or gift card?
- Is the sender’s address or link slightly different from the real one?
A message that fails even one of these tests deserves a pause. Our guide on the best cybersecurity tips for online protection covers the wider habits that make these checks automatic.
A Practical Defence Plan
You do not need to be technical to protect yourself. You need a small set of rules that you follow every time.
- Verify through a second channel. If a request arrives by email or video, confirm it by calling a number you already know, not one in the message.
- Agree on a family code word. A simple phrase that only your family knows can stop a cloned voice scam instantly.
- Slow down. Urgency is the scammer’s main tool, so a ten-minute delay breaks most attacks.
- Use multi-factor authentication. Even if a password is stolen, a second step blocks most account takeovers. Prefer an authenticator app or security key over SMS codes.
- Never share one time codes. A genuine company will never ask you to read out a code.
- Keep software updated. Updates close the security holes that phishing links try to exploit.
Protecting Yourself as an Individual
Start by reducing what criminals can learn about you. Public videos with clear audio, open profiles, and old posts all feed cloning tools and personalized messages. Set social accounts to private, remove personal details such as your birthday, and be careful about what you share. Our article on online safety tips to protect yourself gives a simple checklist you can follow today.
Use a password manager so every account has a unique password. This limits the damage if one service is breached. Also check your bank statements weekly, because small test payments are often how fraud begins.
Protecting Your Family
Older relatives and children are common targets. Explain in plain words that voices and faces can now be faked and that anyone asking for money urgently should be verified. Make it normal to hang up and call back.
Teach children that a friend request or a chat message from a stranger with a perfect photo may not be a real person. A calm conversation at home is more effective than any filter.
Protecting a Small Business
Small firms are attractive because they often lack formal payment checks. Set a rule that no payment or bank detail change is approved on a single message, call, or video. Require a second person to confirm anything above a set amount.
If you sell online, scammers may also impersonate customers or suppliers. Our guide on how to set up your own online shop includes the basics of safe setup, and the article on whether a small business can really compete online shows why trust is a competitive advantage. For wider workplace habits, reading safety measures is usually everyone’s company, which makes the point that security is a shared responsibility.
Money Habits That Limit the Damage
Scams hurt more when everything sits in one account. Keep a main account for daily spending and a separate one for savings, and set low transfer limits where your bank allows it. Turn on instant transaction alerts so unusual activity is spotted in seconds.
Good financial habits are also a security tool. Our guide to budgeting for beginners explains how tracking your spending makes odd payments stand out immediately. If you know exactly what normally leaves your account, fraud is much easier to notice.
What to Do If You Have Been Targeted
Speed matters more than embarrassment. Many victims delay reporting because they feel foolish, and that delay costs money. Act in this order.
- Contact your bank immediately and ask them to stop or recall the payment.
- Change passwords on affected accounts, starting with email, and sign out of all devices.
- Enable multi-factor authentication if it was not already on.
- Save screenshots, emails, phone numbers, and links as evidence.
- Report the incident to Action Fraud, the UK’s national reporting center for fraud and cybercrime.
- Warn friends, family, or colleagues so the same scam does not reach them.
In the UK, the National Cyber Security Centre also publishes free guidance on reporting suspicious emails and texts. Reporting helps investigators spot patterns and shut down criminal networks.
Tools That Help, and Their Limits
Deepfake detection tools and email filters are improving, but none is perfect. Treat them as a safety net rather than a replacement for your own judgment. Spam filters catch many phishing attempts, and some platforms now label AI-generated media, but criminals adapt quickly.
Hardware security keys, password managers, and automatic updates give the best return for the least effort. For a broader look at the equipment and services available, see our overview of electronic digital safety measures. The strongest protection is still a habit of verifying before you trust.
Conclusion
AI has made scams more convincing, but it has not made them unbeatable. Defeating deepfakes and phishing comes down to four things: pause before acting, verify through a second channel, protect your accounts with multi-factor authentication, and report quickly if something goes wrong. Stay curious, stay calm, and remember that a real person will always accept a call back.
Frequently Asked Questions
What is a deepfake scam?
It is a fraud that uses AI generated voice, video or images to impersonate someone you trust. The goal is usually to steal money or personal data.
How can I tell if a video call is fake?
Look for lip sync errors, odd lighting and stiff expressions, then verify the request through another channel. An unusual or urgent demand is the strongest warning sign.
Can AI clone my voice from social media?
Yes, a short clip can be enough for modern tools. Limit public audio and video, and agree a family code word.
What is the best way to avoid phishing?
Never click links in unexpected messages, and confirm requests through a known number or the official app. Multi factor authentication adds a strong backup.
What should I do if I clicked a phishing link?
Disconnect if needed, change your passwords, and call your bank straight away. Then report it to Action Fraud.
