AI-Enabled Scams: Cloned Voices and Deepfakes
Where you are: Unit III — The Human Attack Surface · Lesson 3.4 · This topic is new in the 2026 edition of the course.
For most of history, recognising a familiar voice or face was a reliable way to know who you were dealing with. Generative AI has changed that. This lesson explains what voice cloning and deepfakes are, how scammers use them, and a simple routine that protects you and your family however convincing the fake is.
What you'll be able to do
Apply a verification routine (family code word, hang up and call back) before acting on an urgent request from a familiar voice or face.
- Explain what voice cloning and deepfake video are and why they make impersonation cheap.
- Recognise the pattern of an AI-enabled impersonation scam, whether of a relative, a boss or an official.
- Set up and use a family code word and the hang-up-and-call-back habit.
Cloned voices and deepfakes
Generative AI means software that creates new text, images, audio or video. Two uses matter here:
- Voice cloning creates a digital copy of someone's voice, so a computer can "speak" any words in that voice.
- Deepfake video creates or alters video so a person appears to say or do things they never did.
The FBI warned in December 2024 that criminals use generative AI to make fraud more believable, including by cloning voices and faces. Material for a clone can come from the voice and video clips people post publicly, which is why the FBI advises limiting the images and voice recordings you share online (Lesson 3.5 shows how).
You cannot rely on spotting a fake by ear or eye. Some fakes have glitches, but the good ones don't, and in a stressful moment nobody listens carefully. Your protection has to be a routine, not a talent for detection.
How the scams work
AI changes the costume, not the con. The psychology is exactly what you learned in Lesson 3.1.
- The family emergency. You get a call or voice message in the voice of a relative or friend. They sound distressed: they have lost their phone and wallet abroad, or are in some other trouble, and they need money sent right now, often with a plea not to tell anyone. Fear, urgency and the wish to help do the rest.
- The impersonated boss or official. The FBI warned in May 2025 that criminals were sending texts and AI-generated voice messages pretending to be senior US officials. The same approach works with a cloned voice of a manager or company director asking for an urgent payment.
The scale is now measurable. The FBI's 2025 Internet Crime Report included its first section on AI-related complaints: 22,364 complaints and about $893.3 million in reported losses.
The routine: pause, verify, then act
When a familiar voice or face asks for money, codes or sensitive information under pressure, run this routine every time:
- Pause. Strong emotion is the scammer's tool. Take a breath and say you'll call back.
- Hang up and call back on a number you already have. Call your relative's own phone, or another family member who would know where they are. For a boss or an organisation, use the directory or the official number. Don't trust caller ID, which can be faked (Lesson 3.1).
- Ask for the family code word. The FBI recommends agreeing a secret word or phrase with your family to confirm identity in an emergency.
- If there is no code word, ask a question only the real person could answer, one whose answer isn't on social media.
- Don't send money, gift cards or cryptocurrency until you have verified through your own channel. A real emergency survives a five-minute check.
Setting up a family code word
- Agree it in person, not by text or email, and make sure everyone who might receive a call knows it, including older relatives and teenagers.
- Make it unguessable: not a pet's name, birthday or anything that appears online. Two or three unrelated words work well.
- Never post it or type it into messages.
- Agree the rule too: "If someone calls in an emergency and can't give the word, we hang up and call back."
A workplace can adopt the same idea: any urgent payment request is confirmed by a call to a known number, however senior the requester sounds.
Real-World Example
In May 2025, the FBI issued a public warning about a campaign in which criminals impersonated senior US government officials, using text messages and AI-generated voice messages.
Set that beside the family-emergency pattern above and the lesson is the same. Whether the voice belongs to an official, a manager or your own brother, it can be imitated. What criminals cannot easily imitate is a call you place to a number you already have, or a code word agreed face to face. That is why the routine matters more than your ear.
Why This Matters in 2026
- Impersonation has become cheap and convincing. Generative AI lets criminals imitate voices and faces from material that is often publicly available (FBI, December 2024).
- It is already causing real losses. The FBI's 2025 report counted 22,364 AI-related complaints and about $893.3 million in reported losses, in the first year it reported AI separately.
- Recognition is no longer proof. A familiar voice or face must now be verified like any other request.
- The fix is low-tech: a family code word and the hang-up-and-call-back habit.
Watch: How to Avoid Voice Cloning Scams (AARP Live)
This one-minute clip from AARP, a large US organisation for older adults, sums up the routine in plain language. It is short enough to share with family members when you agree your code word.
As you watch, notice:
- The first instruction: stay calm and consider whether the call is plausible, rather than reacting to the panic in the voice.
- The advice to hang up and call or text the person yourself to check they are all right.
- The safe word tip, the fallback of asking a question only they would know, and the warning not to trust caller ID.
The last few seconds promote a television programme and can be skipped. The video reinforces what you just read — the lesson is complete without it.
What Would You Do?
Your phone rings. It is your younger brother's voice, panicked. He says he is travelling, has lost his phone and wallet, and is calling from a friend's phone. He needs money sent to the friend's account right now, and begs you not to tell your parents. The voice sounds exactly like him. What do you do?
Knowledge Check
Your manager's voice leaves you a voicemail asking you to buy gift cards urgently for a client and text the codes to a new number, because they are stuck in meetings. What is the best response?
Your family is choosing a code word for emergencies. Which choice is best?
A video call shows what looks and sounds exactly like your aunt. She urgently asks you to transfer money for a medical bill and says she can't talk long. What should you do?
Answers explained
- Question 1 — d is right. A channel you already trust confirms the request independently. a is not right: voices can be cloned, so recognition is not proof. b is not right: the new number belongs to whoever sent the message. c is not right: buying any card acts on an unverified request, and gift cards are hard to recover.
- Question 2 — b is right. Unrelated words agreed in person can't be found online or intercepted in a message. a is not right: pet names often appear on social media and are easy to guess. c is not right: birthdays are guessable, and typing the word in a chat means anyone who sees that chat can learn it. d is not right: a street name is easy to find, and email can be read by others.
- Question 3 — a is right. Calling back on a known number, or asking for the code word, verifies the person whatever the video shows. b is not right: deepfake video means a face on screen is no longer proof. c is not right: good fakes may show no glitches, and searching for them under pressure is unreliable. d is not right: half the money is still money sent on an unverified request.
- Your brother (What Would You Do?): pause and say you'll call back. Ask for the family code word, or a question only he could answer. Then call his own phone, and if he doesn't answer, check with a parent or someone travelling with him, despite the plea for secrecy, which is a classic pressure tactic. Send nothing until you have reached him through your own channel.
Key Takeaways
- AI can clone voices and fake video, so a familiar voice or face is no longer proof of identity.
- AI scams use the same levers as all social engineering: authority, urgency, fear and helpfulness.
- Pause, hang up and call back on a number you already have. Don't trust caller ID.
- Agree a family code word in person, keep it offline, and make "no word, no money" the rule.
- Limit the voice and video clips you post publicly.