How to Spot AI Deepfake Scams: Warning Signs and Protection Tips

AI deepfake scams use cloned voices and fake faces to make a stranger sound like your boss, your bank or your own kid. The tech got cheap, the calls got convincing, and “it sounded just like him” is now a normal line in fraud reports.

Quick answer: AI deepfake scams copy a real person’s voice or face to pressure you into sending money or sharing a login. You can’t reliably spot them by sound or looks alone, so the safest move is to hang up, call the person back on a number you already trust, and never pay by gift card, crypto or wire because of a call, video or message.

What Are AI Deepfake Scams and How Do They Work?

A deepfake is audio, video or an image that AI has generated or altered to look like a real person. In a scam, the fake is the bait. The real hook is urgency: someone you trust seems to need money, secrecy or a password right now.

The US Federal Trade Commission explains that scammers can copy a loved one’s voice with a short audio clip, often pulled from posts they shared online, plus a voice-cloning program. That’s the whole barrier to entry. No studio, no hours of recordings.

Different costumes, same script. Create pressure, cut off outside advice, move money.

Why the threat of deepfake identities is increasing

Faking someone convincingly used to take skill and hours of footage. Now, as the FTC points out, a short clip and a voice-cloning program can be enough. That’s why the threat of deepfake identities keeps growing: scammers can borrow the face or voice of someone you trust, not just their name. The FBI has warned about AI voice messages posing as senior officials and, more recently, fake videos of its own staff. When anyone’s identity can be copied, the person on the screen stops being proof of anything.

Common AI Voice Cloning and Deepfake Video Scams

New warning for 2026: The FBI has reported scammers using AI-generated videos impersonating FBI personnel to direct victims to lookalike complaint websites. A video featuring an apparent official is not proof that the website or payment request is genuine. Type the official address yourself and verify any request independently. See the FBI’s July 2026 warning.

These four patterns cover most of what shows up in warnings from regulators and police.

The family emergency call

The FTC describes the classic version: a caller who sounds like a grandchild says they’ve been in an accident or arrested and need money fast. Voice cloning just makes the old trick more believable. The agency’s advice is blunt: don’t trust the voice.

The fake executive on a video call

This one costs companies real money. In the best-known case, a finance worker at the engineering firm Arup joined a video call with people he took to be the chief financial officer and other colleagues. Hong Kong police said they were all deepfake re-creations. CNN Business reported that the worker made 15 transfers totaling about 200 million Hong Kong dollars, roughly $25.6 million, and Arup confirmed that fake voices and images were used.

Notice what made it work. He first suspected a phishing email, then the video call calmed him down. The faces and voices felt like proof. They weren’t.

Official impersonation by voice message

In a May 2025 alert, the FBI warned that criminals were sending text messages and AI-generated voice messages posing as senior US officials, then steering targets to another platform and a link built to steal logins. The FBI’s advice was not to assume a message is authentic just because it claims a famous name.

The same trick shows up in tax scams. If a cloned voice or a fake audio message claiming to be the IRS demands immediate payment by gift card, prepaid card or wire transfer, or threatens arrest, hang up. The IRS says it never calls to do either, and you can report the call to the Treasury Inspector General for Tax Administration (TIGTA).

Fake celebrity endorsements

A smooth video of a well-known person praising a trading app or giveaway is easy to generate and easy to share. If an endorsement only exists in an ad or a forwarded clip, treat it as unconfirmed until the person’s own official channels say the same thing.

How to Spot a Deepfake Video or AI Voice Scam

How can you tell if a video is AI-generated? Look for unusual mouth movements, inconsistent lighting, strange pauses and suspicious links, but don’t make a decision from those clues alone. Modern fakes may have no obvious errors. The safer test is to verify the person’s identity using a number or channel you obtained independently, particularly before sending money, sharing a code or opening a link.

The FBI says to watch for visual distortions, unnatural movements and odd delays on voice calls, and to listen for strange tone or word choice. It also admits that AI voice clones can sound nearly identical to the real person.

So treat these as hints, not proof. A perfect-sounding call can still be fake, and a glitchy one can be a bad connection.

• Audio hints: unusual pauses before answers, flat or oddly cheerful emotion, phrases your friend would never use.
• Video hints: blurred edges around the face or hair, movements that don’t match speech, lighting that doesn’t fit the room.
• Behavior hints: a demand for secrecy, a deadline measured in minutes, and a push to switch to a new app or number.

The behavior hints are the most reliable of the three, because pressure is the part scammers can’t skip. If you’re curious how detection tools fare, our guide to AI content detectors and their accuracy limits explains why a “fake or real” score shouldn’t be your only check.

What to Do the Moment a Call or Message Feels Wrong

Your goal is simple: break the script before any money moves. Do this in order.

1. Stop and hang up. You don’t owe a stranger or a “relative” an answer in the next sixty seconds.
2. Call back on a number you already have. The FTC says to use a number you know belongs to that person, not the one the caller gives you.
3. Check with someone else. If you can’t reach them, ask another relative, friend or coworker to confirm the story.
4. Ask a question only the real person could answer. Better yet, use a code word you agreed on earlier (more on that below).
5. Look hard at the payment method. The FTC lists wire transfers, cryptocurrency and gift cards as signs of a scam because they’re so hard to reverse.
6. Don’t click, open or install anything yet. The FBI advises confirming the sender before you touch links, attachments or apps.

If you already clicked or shared a code, change that account’s password right away and turn on two-step sign-in. If money is gone, call your bank or payment provider immediately and ask whether the transfer can be stopped or recalled. Speed matters here.

Deepfake Fraud Protection: Simple Steps That Really Help

If you’re wondering how to prevent deepfakes, it’s important to separate two things: stopping someone from creating a fake and stopping that fake from fooling you. You can’t completely prevent strangers from misusing public photos or recordings, but you can make impersonation scams much harder to pull off. Keep personal recordings private where practical, agree on a family code word, and verify urgent requests through an independent contact method.

Pick a family code word

The FBI suggests agreeing on a secret word or phrase with family so you can confirm identities. Choose something that’s not on social media, not a pet’s name, and not guessable from a birthday. Tell parents and older relatives first, since they’re the usual targets of the emergency-call script.

Lock down your accounts

The FBI recommends turning on two-factor or multi-factor authentication wherever you can, and never sharing a code with anyone, even by email, text or an encrypted chat. Passkeys go a step further because there’s no password to hand over. We walk through the setup in our guide on how to set up passkeys on iPhone, Android and Windows, and our Instagram account guide covers securing a social profile that scammers love to copy.

Give cloners less to work with

The FTC notes that cloned voices often come from clips posted online. You don’t have to vanish from social media, but you can set videos to friends-only, trim public voice notes and think twice before posting long, clear recordings of kids or older relatives. If you use AI voice tools yourself, know what they can do. Our rundown of the best AI voice generators shows how realistic these tools have become.

Verify new numbers and platforms

If someone you know suddenly contacts you from a new number or app, confirm it through a channel you’ve already verified. That small habit would have stopped most of the cases above.

How to Protect Against Deepfake Phishing Scams at Work

A deepfake phishing scam might arrive as a voice note from a supposed manager, a video call with an apparent executive or a message asking you to open a payment portal. The safest team habit isn’t learning to spot every visual flaw. It’s requiring a second approval and checking unusual requests through a trusted channel before anyone transfers funds or shares credentials. This is useful deepfake awareness training even for a small business without a dedicated security team. Larger companies often add deepfake phishing training and simulations, where staff get a harmless fake voice note or video request and practice verifying it before acting.

The Arup case shows that “I saw them on video” isn’t a security control. If you handle payments, approvals or sensitive data, a few rules go a long way.

The point isn’t to distrust your colleagues. It’s to build a process that works even when the face on the screen looks exactly right.

Are AI Voice Scams Illegal?

Yes, fraud is illegal whether or not AI is involved. On the voice side, the Federal Communications Commission ruled unanimously in February 2024 that AI-generated voices count as “artificial” under the Telephone Consumer Protection Act, according to a Cooley law firm summary of the ruling. That means robocalls using cloned or synthetic voices fall under the same restrictions as other prerecorded calls.

In the UAE, the Cyber Security Council has cautioned the public about deepfakes and pointed to Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes, which carries strict penalties for offenses such as fake news and online fraud, as reported by Gulf News. The council also urges people not to share content whose authenticity is in doubt and to check anything attributed to public figures or institutions against official sources.

Laws punish scammers after the fact. They rarely get your money back, which is why prevention matters more.

Where to Report Deepfake Fraud in the USA and UAE

If you’ve lost money to a deepfake scam, contact your bank or payment provider immediately and ask about stopping or recalling the transaction. In the United States, report fraud through the FTC’s official site or the FBI’s Internet Crime Complaint Center. In the UAE, use the official police reporting service for your emirate. Save messages, call logs, URLs and payment reference numbers. Beware of anyone promising guaranteed recovery for an upfront fee.

Report it even if you didn’t lose anything. Reports help investigators connect cases. Details below were last checked in October 2026.

The eCrime Hub is Dubai Police’s portal. If you live in another emirate, check your local police website for its own channel. Also tell your bank, the platform where the scam happened and, if a friend’s account was copied, that friend.

Keep everything: call logs, voice notes, screenshots, chat history, transfer receipts. Don’t delete the thread in frustration, even though you’ll want to.

Sources and How We Checked

This guide relies on official guidance and named reporting: the FTC’s consumer advice on voice-cloning family emergency scams, the FBI’s May 2025 public service announcement, CNN Business reporting on the Arup case, a Cooley summary of the FCC ruling and Gulf News coverage of the UAE Cyber Security Council warning. Facts were checked in October 2026. For related AI safety reading, see our explainer on AI hallucinations, which covers a different way chatbots can mislead you.

Frequently Asked Questions About AI Deepfake Scams

Can a scammer fake a live video call?

Yes. The FBI warns that criminals can use AI-generated video during real-time conversations to impersonate executives and other authority figures. A convincing face and voice are not enough to verify the person. End the call and independently contact the organization using a number you already know or find on its official website.

Can AI really clone my voice from a short clip?

Yes. The FTC says scammers need only a short audio clip, often taken from something posted online, and a voice-cloning program. That’s why limiting public voice and video posts is a sensible precaution.

Are deepfakes dangerous?

They can be. A deepfake is just AI-made media, but the dangers of deepfakes show up when they’re used to impersonate real people: draining bank accounts, stealing logins or spreading fake news. The defense is the same every time. Verify through a channel you already trust before you act.

What should I do if an AI voice says it’s the IRS?

Hang up. The IRS says it won’t call to demand immediate payment by gift card or wire transfer, or threaten arrest. If you’re worried about a real tax issue, contact the IRS yourself using the details on irs.gov.

What should I do if I already sent money to a deepfake scammer?

Contact your bank or payment provider right away and ask whether the transfer can be stopped. Then report it to the FTC and the FBI’s IC3 if you’re in the USA, or to Dubai Police’s eCrime Hub or your local police if you’re in the UAE, and save all evidence.

Are deepfake scams illegal in the UAE?

Online fraud and spreading fake news carry strict penalties under Federal Decree-Law No. 34 of 2021, which the UAE Cyber Security Council cites when warning about deepfakes. If you’re unsure how the law applies to your case, ask the police or a licensed lawyer.

Can a deepfake detector tell me if a call is fake?

Not reliably. Detection tools have accuracy limits and often can’t analyze a live phone call at all. A callback on a trusted number and a pre-agreed code word beat any scanner.