How AI Deepfake Scams Work and How to Protect Yourself

How AI Deepfake Scams Work and How to Protect Yourself

In January 2024, an employer engineering firm Arup in Hong Kong was tricked into making 15 transfers total about HK$200 million (25.6 million United States dollars) after joining with appeared to be a video conference with A company, CFO, and other colleagues. The people on the call had been digitally recreated using deepfake technology. A later confirm that it was the company involved in the incident. 

This case shows why deepfake scams can be so convincing. Attacker can combine AI generated voices video in familiar identities with pressure and social engineering to make a fraudulent request, look legitimate. 

This article explains how these scans actually work the technology behind them. The common ways criminals use them and practical steps, you can take to protect yourself, your family and your business.

What Is a Deepfake Scam?

A deepfake scam uses AI generated or AI manipulated audio video or images to impersonate a real person or create a convincing fake identity. The goal is usually to trick someone into sending money sharing sensitive information for taking another harmful action. The term deepfake is commonly associated with deep learning, a type of machine learning used to create or manipulate realistic media.

What sets deepfake scams apart from fraud methods is how fast and easy they are to pull off. In the past copying someone’s voice took hours of recorded speech and technical know-how. Now it only takes a seconds of spoken words and simple software that is free or low cost. This shift has changed deepfakes from something experts worried about into a common tool used by scammers. It’s no longer a problem for high-profile targets, like executives or famous people. Regular people now face these threats every day.

How AI Deepfake Scams Actually Work

Voice Cloning

Voice cloning tools can use a relatively short audio sample to reproduce characteristics of a person‘s voice, including aspects of tone, pronunciation, and speaking style. Once a voice model has been created. It can generate new speech from text or other input. Scammers may obtain voice samples from public videos, social media posts, podcasts, voicemail, messages or other recordings. 

Voice cloning is also used in family. Emergency scans where a caller pretends to be a child grandchild or other relative who urgently needs money. The FTC wants that scammers can use AI to make a cloned voice sound like someone the victim knnows 

In 2025. The FBI also want about a campaign in which malicious actors use AI generated voices while impersonating Senior US officials. The campaign used text messages and voice messages to build trust before attempting to move conversations to other messaging platforms for obtain information for funds.

Video Deepfakes

Video deepfake can create realistic images of people speaking or appearing on camera. They can also be used during live. Video calls to impersonate real people. In the 2024 Arup case the victim joined a video conference in which the people he believed were company, executives, and colleagues were digitally recreated. He was then persuaded to authorize multiple transfers 

Real-time video impersonation can require more computing resources than simple voice cloning, but increasingly accessible AI tools have made sophisticated impersonation easier to attempt. The important point for users is that a convincing video call should not be treated as proof that the person on screen is genuine

Image-Based Impersonation

Scammers also use AI image generators to create fake profile photos for dating scams and fake business accounts, or to alter existing images and videos of real public figures to make it look like they are endorsing a product, especially in cryptocurrency and investment scams. Chainalysis reported that scams using deepfaked images of government officials grew sharply through 2025, particularly in crypto investment fraud.

• Related Article 
• What to Do After a Data Breach: 10 Steps to Protect Your Identity and Credit
• How to Check If Your Email Has Been in a Data Breach

Why These Scams Are Becoming So Common

A few years ago, convincing voice cloning generally required more specialized tools and technical knowledge. That barrier has become lower as consumer AI services have become easier to access. The 2024 New Hampshire robocall impersonating President Joe Biden is one example of how inexpensive AI-generated voice technology can be used in a real-world scam, although the exact cost and production time depend on the tools and process used.

Lower barriers to AI tools can make impersonation scams easier to attempt at greater scale. However, the technology is only one part of these schemes. Scammers also rely on social engineering, stolen information, compromised accounts and other traditional fraud techniques. Reported losses from online crime have also increased in recent years, although those figures cover many types of fraud rather than deepfake scams alone.

Real Cases That Show the Scale of the Problem

These are not hypothetical risks. The FBI's Internet Crime Complaint Center (IC3) reported 22,364 complaints in 2025 in which victims reported AI-related information, with adjusted losses exceeding $893 million. The FBI notes that these figures are based on complaints containing AI-related information, so they should not be treated as a complete measure of deepfake fraud or all AI-related crime.

A few cases stand out:

• The Arup deepfake video call: An employee in Hong Kong was deceived during a video conference and authorized 15 transfers totaling about HK$200 million (US$25.6 million) to five bank accounts. The people appearing on the call were digitally recreated impersonations of company employees.
• Voice cloning of a senior official: An unknown actor cloned the voice of a top US diplomat using a short public audio clip and used it over Signal to contact foreign officials, prompting a public FBI warning about voice-cloning risks.
• Deep fake job interview fraud, US authorities have documented cases, including some linked to North Korean. State sponsored operators of people using deepfake video during job interviews to get higher remotely under a false identity in some cases at well over 100 US companies. 

These cases shared a pattern. The scam relies less on the technology been flawless and more, urgency trust and the victim, not stopping to verify through a separate channel in the Arup case, the employee reportedly had doubt partway through the call but continued because everyone else on the screen, including people, he recognized appeared to confirm the instructions were legitimate. That is what makes group video, deepfake, especially dangerous. They don’t just fake, one voice, fake social proof.

The Law Is Starting to Catch Up

Regulation has changed fast since 2025. The rules are different depending on the country and the kind of deepfake involved. In the United States the federal TAKE IT DOWN Act covers non-consensual intimate images, including those that have been digitally altered or made using AI. In the European Union Article 50 of the AI Act started to apply on August 2 2026. This rule requires that some AI-generated or manipulated content—like deepfakes—must be clearly labeled or disclosed, with exceptions and scope limits.

These laws mostly focus on removing content and requiring clear labels. They don’t stop a scammer from pretending to be your bank or your child, in a phone call. That kind of threat still depends on your awareness and how carefully you verify things. That’s why the steps listed below remain important no matter what legal protections are written into law.

Common Deepfake Scam Scenarios

Family emergency calls. A cloned voice of a relative claims to be in an accident, arrested, or kidnapped and asks for money urgently, often through gift cards or a wire transfer.

Executive impersonation (business email/video compromise). A cloned voice or video of a CEO, CFO, or manager instructs an employee to make an urgent payment or share confidential data, usually outside normal approval steps.

Romance scams. Fake video calls or manipulated photos are used to build trust with someone met online, before asking for money.

Investment and crypto scams. Deepfake videos of celebrities, financial experts, or government officials appear to "endorse" a fake investment platform or cryptocurrency.

Fake job interviews and hiring scams. Applicants use a deepfake to interview for remote jobs under a false identity, sometimes to gain access to company systems and data after being hired.

Tech support and account recovery scams. A cloned voice of a "known contact" or a fake video of a support agent is used to trick someone into sharing login credentials or one-time passcodes.

Warning Signs That Something Might Be a Deepfake

Newer deepfakes are getting harder to catch by sight or sound alone, so it helps to watch for a mix of technical and behavioral clues rather than relying on just one:

• Unusual urgency or pressure to act immediately, especially around money or sensitive information.
• A request to keep the conversation secret or avoid contacting other people to "verify."
• A request to switch to an unfamiliar app or communication channel mid-conversation.
• Slight lag, unnatural pauses, or audio that doesn't quite sync with lip movement on video calls.
• Lighting, shadows, or blinking that looks slightly off, though this is becoming less reliable as the technology improves.
• A "wrong number" caller who tries to keep you talking for no clear reason.
• Any request for payment through gift cards, wire transfers, or cryptocurrency, which are hard to reverse.

How to Protect Yourself From AI Deepfake Scams

For Individuals and Families

• Set up a family passphrase. Agree on a private word or phrase with close family members that you can ask for during any unexpected, urgent call asking for money. This is a step the FBI has specifically recommended.
• Always verify through a separate channel. If you get an urgent call, text, or video from someone you know, hang up and contact them directly using a number or method you already trust, not one provided in the suspicious message.
• Be careful what voice and video samples you post publicly. Long, clear clips of your voice or face on public social media give scammers raw material to clone.
• Slow down under pressure. Scammers rely on panic. Legitimate emergencies can wait the few minutes it takes to confirm through another channel.
• Never pay through gift cards, wire transfers, or crypto based on a single call or video, no matter how convincing it sounds or looks.

For Businesses

• Require out-of-band verification for financial requests. Any payment change or urgent transfer request made over video, voice, or chat should be confirmed through a separate, pre-established channel before it is processed.
• Train employees specifically on deepfake risks, not just traditional phishing. Include realistic examples like the Arup case in training.
• Limit how much executive voice and video content is publicly available, and be cautious about posting earnings calls, interviews, or webinars without considering this risk.
• Use multi-person approval for large transfers, so no single employee can authorize a major payment based on one call or video, no matter who it appears to be from.
• Review hiring processes for remote roles, including live, unscripted verification steps during interviews, given the rise in deepfake job-candidate fraud.

What to Do If You've Been Targeted or Scammed

If you think you have been targeted by the deepfake scam, stop communicating with the scammer and do not send additional money or personal information. If you already sent money, contact your bank. card receive for payment service as soon as possible and ask what recovery options are available. Keep screenshot, recordings messages, phone numbers, payment details, and other evidence that may help with a report in the United States. 

You can report internet crime to the FBI‘s Internet crime complaint Centre (IC3). I see three if you live elsewhere, contact your countries, appropriate cyber crime or consumer protection agency, if the scam involve someone impersonating a person or organization, you know consider notifying them so they can warn others, maybe targeted.

Final Word

AI deepfake scams work because they bring together two things that have always made fraud, successful voice or face that feels familiar and trusted and a push to act quickly. The tools have changed, but the main advice stays the same. Take your time. Check things on your own and never let a sense of urgency. Make you ignore your caution, especially when money or personal information is in play, taking a break to make sure a request is real by using a different trusted way to confirm is still the best way to protect yourself from even the most advanced deepfake