How to Recognise an AI-Powered Scam

The call that sounds like your daughter

It is late. Your phone rings from a number you do not recognise. The voice is your daughter's, and she is crying. There has been an accident, or an arrest, or a problem at the airport. She needs money now and she cannot talk long. Then a calm adult takes the phone and explains what you have to do.

Almost nobody thinks clearly in that moment, and that is the entire design. Before we go any further: if something like this has already happened to you or to someone you love, you were not stupid. These scripts are built, tested and refined precisely because they work on careful, intelligent people. Shame is the scammer's best friend, because it keeps victims quiet and lets the same script run on the next family.

What AI actually changed

Scams are old. What changed is the cost of doing them well.

Voice cloning used to need a studio and now needs a short clip, which for most of us is sitting in a public video somewhere. Phishing emails used to be full of spelling errors, which is how many of us learned to spot them. That tell is gone: the grammar is now perfect, the tone matches your industry, and the message can reference your employer, your role and a real project. Fake job offers arrive with a company website, a LinkedIn presence, a recruiter with a face and a friendly video interview.

The two defences that actually hold

Everything else in this lesson is detail. These two are the substance.

Agree a code word. Pick a word with your family, and a second one with your team at work. Something no search engine could guess and nothing you have posted anywhere. If a distressed call asks for money or a transfer, ask for the word. A real relative will find this mildly irritating for four seconds. A cloned voice cannot answer.

Call back on a number you already have. Not the number that called you, not the number in the email signature, not the link in the message. The number already in your contacts, or printed on your bank card, or on the company website you navigated to yourself. Hang up, then dial. This single habit defeats almost every impersonation, because the whole attack depends on you staying inside a channel the attacker controls.

The pressure signals

Cloned voices are convincing, so watch the shape of the request instead of the sound of it. Real emergencies rarely have all of these at once.

Urgency. It must happen in the next few minutes.

Secrecy. Do not tell your husband, your manager, the police, the bank.

An unusual payment route. Gift cards, crypto, a transfer to a new account, a courier collecting cash.

Authority. A police officer, a bank fraud team, a tax office, a chief executive. Real institutions expect you to hang up and call back, and none of them ask for passwords.

A story that discourages checking. Their phone is broken, they are about to be taken into a room, the line is bad.

Using AI to check a message

The tools that make these scams cheaper are also perfectly good at explaining them to you.

Here is a message I received. Do not judge whether it is real, because you cannot.
Instead give me:

Every urgency, secrecy or authority tactic used in it.
Every factual claim I could check independently.
For each claim, how to verify it WITHOUT using any link, number or address in
the message itself.
Then give me one short, polite way to stall while I check.
MESSAGE:
[paste it]

Help me set up a code word with my family so we can confirm each other's identity
on a phone call. Suggest what makes a good code word and what makes a bad one,
explain in plain language why we need one (voice cloning), and write a short
message I can send to relatives including older ones who may find this alarming.
Reassuring, not frightening. Under 150 words.

I have received a job offer or recruiter approach. Here are the details:
[company name, role, what they have asked me to do next].
List everything about this I should verify before responding, in order of
importance. Flag anything that is a known pattern in recruitment fraud, such as
requests for payment, requests for identity documents very early, or interviews
conducted only over text chat.

If it already happened

Move quickly and skip the self-recrimination, which can wait. Contact your bank straight away, because speed genuinely matters with transfers. Change the password on any account involved, starting with your email. Report it to the fraud or cybercrime reporting body in your country, and to your employer if any work system was touched. Then tell one other person. Scams thrive on the silence that embarrassment produces, and the person you tell may be the next target.