Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume an unexpected request could be AI-assisted, even when the voice, video, logo or writing looks authentic. The safest response is to pause, verify through a trusted channel you choose yourself, and require a second factor before money or account access changes hands. Generative AI now lets criminals produce convincing text, cloned voices, fabricated video, realistic social profiles, look-alike websites and fraudulent identity documents at scale.
Why AI scams are harder to recognize
On March 19, 2025, the U.S. Commodity Futures Trading Commission warned that criminals were using AI to create “fake images, voices, videos, live-streaming video chats, social media profiles, and malicious websites designed to look like legitimate financial trading platforms.” The FBI Internet Crime Complaint Center (IC3) similarly warned on December 3, 2024 that AI-generated text makes social-engineering, spear-phishing, romance and investment scams more believable and easier to scale.
That polish changes the warning signs, not the underlying risk. An unexpected request to transfer money, disclose a one-time code, install software or keep a secret remains suspicious regardless of how professional it looks. The Federal Trade Commission (FTC) reported that government and business impersonation scams generated more than $1.1 billion in reported losses in 2023. In a 2025 data release, the FTC said consumers reported losing $470 million to scams that began with text messages during 2024. IC3’s 2025 annual report recorded more than 22,000 complaints that mentioned AI-related information. These are reported losses, not a complete count of fraud; many incidents are never reported.
10 protections that work against AI-assisted scams
1. Pause before you act
Urgency is a manipulation technique. Stop when a message demands immediate payment, a password, a verification code, remote access or secrecy. Put physical distance between the request and your response: close the message, wait, and write down exactly what is being requested. A genuine bank, employer or relative can tolerate a verification step.
#1 Best Overall
2. Verify through a separate channel
Contact the supposed sender using a phone number, app or website you already trust. Type the institution’s address yourself or use a saved bookmark; do not use the number, QR code or link in the message. For a family emergency, call the person’s usual number or another relative. Independent confirmation is stronger evidence than any detail contained in the original contact.
3. Treat caller ID, logos and familiar voices as clues—not proof
Caller ID can be spoofed, logos can be copied and a short public recording can help create a voice clone. Video calls are not automatically authentic either. Ask a question the impersonator could not prepare for, then end the call and reconnect through a trusted route. Never approve a transfer solely because the voice or face seems familiar.
4. Avoid unexpected links and attachments
Do not click an unsolicited sign-in link, open an attachment or scan a QR code from an unexpected message. Instead, open the official app or type the known web address. Before entering credentials, check the domain and confirm that the page is using the expected service. If you clicked already, do not enter information; close the page, update security software and change any password you may have exposed.
5. Turn on two-factor authentication
Enable two-factor authentication (2FA) on email, banking, social, cloud and password-manager accounts. A FIDO2/WebAuthn hardware security key provides strong phishing resistance where a service supports it. An authenticator app is more widely available, but the phone or computer holding it still needs a strong lock and current software. SMS codes are preferable to no second factor, yet they can be exposed through number-porting attacks or message interception. 2FA cannot stop every scam, but it can limit damage after a password is stolen.
6. Keep devices, browsers and apps updated
Install operating-system, browser and application updates promptly because they close vulnerabilities criminals can exploit. Download software only from the device maker’s official store or the publisher’s verified site. Remove apps you do not recognize, and review permissions for microphone, camera, contacts and accessibility features.
7. Reduce material that can be cloned
Review what is public on social media. Limit long, clear voice recordings, high-resolution videos, family relationships, birthdays, travel plans and photos of identity documents. The FBI has warned that criminals can reuse publicly posted audio, video and photos to create deepfakes. Privacy settings cannot make you invisible, but reducing the available material makes impersonation harder and gives scammers less context for personalized messages.
8. Use filters and blocking tools
Leave spam filtering enabled, mark suspicious email as junk and use your carrier’s or phone’s call and text blocking controls. Report recurring numbers and accounts rather than replying; a response confirms that your address or number is active. Filters reduce exposure but are not a substitute for checking an important request independently.
9. Establish a family verification rule
Agree in advance on a private phrase, a callback routine or a question with a known answer. If someone claiming to be a relative asks for an emergency payment, hang up and call the person directly. Do not publish the phrase or use an obvious fact that a social profile reveals. A cloned voice alone should never authorize a transfer.
10. Report quickly and preserve evidence
Save the original message, email headers, phone number, profile address, URLs, payment receipts and screenshots before blocking the sender. Report fraud to the FTC at ReportFraud.ftc.gov and internet-enabled crime to the FBI’s IC3. If money moved, contact your bank, card issuer, wire service or cryptocurrency provider immediately and ask whether a transfer can be stopped or recalled. Fast notice may help protect other victims and preserve recovery options.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to judge a suspicious voice, video or message
- Pressure: deadlines, threats, secrecy or instructions to bypass normal procedures.
- Payment changes: a new account, gift card, cryptocurrency, wire transfer or “safe” account.
- Authentication requests: a demand for a one-time code, password, recovery phrase or remote-control session.
- Context mismatch: a message arrives from a new number, at an unusual time or outside the person’s normal habits.
- Technical oddities: unnatural pauses, lip-sync errors, distorted hands or inconsistent details. Their absence proves nothing; high-quality fakes may look normal.
Use these signs to trigger verification, not to make a final authenticity judgment. AI can improve grammar and remove obvious visual errors, so the decisive test is whether the request survives an independent callback.
Choosing a second-factor method
| Method | Phishing resistance | Coverage and recovery | Practical trade-off |
|---|---|---|---|
| FIDO2/WebAuthn hardware key | Strongest of these options when supported | Works only on services that support security keys; keep a spare and recovery codes | Requires purchase, setup and carrying the key |
| Authenticator app | Strong, but codes can still be entered into a fake site | Available on many services; protect and back up the device | More setup than SMS and dependent on device access |
| SMS code | Lower; vulnerable to number porting and interception | Broad availability; recovery is tied to your mobile number | Better than no second factor, but not ideal for high-value accounts |
If you already responded to a scam
- Stop contact: do not send more money, codes or documents.
- Secure accounts: change exposed passwords from a trusted device, starting with email; revoke unfamiliar sessions and API keys.
- Protect payments: call the provider using its official number and request a freeze, recall or fraud review.
- Check for takeover: review forwarding rules, recovery addresses, new payees, login alerts and device lists.
- Preserve and report: keep evidence and submit reports to the FTC and IC3.
The rule that holds up against deepfakes
AI increases credibility and scale; it does not make an unexpected request trustworthy. Verify the request independently, use 2FA, keep your software current and make payment decisions that require more than a convincing voice, face or caller-ID label.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
