AI scams: voice clones, deepfakes and synthetic identities

For the first time in the Internet Crime Complaint Center's near-25-year history, the FBI's 2025 report contains a section on artificial intelligence: 22,364 complaints, and losses of approximately $893 million.

The report describes the tactics plainly — scammers "deploying fake social profiles, voice clones, identification documents, and believable videos depicting public figures or loved ones", while relying on the same pressure techniques as before. The FBI's separate advisory on generative AI fraud is more direct still, warning that "generative AI reduces the time and effort criminals must expend to deceive their targets" — a statement about efficiency, not about inventing anything genuinely new.

That last clause is the important one. AI has not invented new scams. It has removed the imperfections that used to expose the existing ones.

Nothing below requires special equipment or technical skill. Voice cloning tools are consumer apps sold for podcasters and video editors; image and video generators are the same ones used for marketing content. The gap between "a scam convincing enough to work on me" and "a scam obviously run by an amateur" has mostly closed, using off-the-shelf software rather than anything built for fraud.

What actually changed

For years, detection advice rested on a quiet assumption: that a fake would contain a flaw a person could notice. Bad grammar. A voice that was not quite right. A video that looked wrong. A document that did not match.

Every one of those flaws was expensive to eliminate. Now none of them is.

The end of "check for bad grammar"

"Look for spelling mistakes and clumsy phrasing" was, for two decades, close to universal phishing advice. It worked because writing a convincing message in a target's language, at scale, used to require either a fluent native speaker or a lot of expensive editing — and most phishing operations did neither.

A general-purpose language model removes that constraint entirely. The output is fluent by default, in whatever language and register the sender chooses, with no marginal cost for a second draft or a hundredth one. Scammers can also now generate dozens of variations of the same message and see which gets clicked, the same way a legitimate marketer A/B tests subject lines — turning phishing wording into something iterated on rather than written once.

The practical result: fluency is no longer evidence of anything. A message being well-written says nothing about who sent it. What still says something is what it is asking you to do, and whether it gives you a reason to act before checking.

The forms in circulation

Voice cloning

A few seconds of clear speech — from a social video, a voice note, a podcast, a voicemail greeting — is enough to generate convincing synthetic audio using consumer-grade tools that were built for dubbing and narration, not fraud. The FTC's own alert on this puts the raw material bluntly: "all he needs is a short audio clip of your family member's voice — which he could get from content posted online — and a voice-cloning program."

The distress call. A grandchild in an accident, a relative arrested abroad, a child who has lost their phone. The voice is right, which was historically the strongest identification available by telephone. What makes this variant effective is not the technology alone — it is the technology combined with the oldest trick in social engineering, which is asking the target not to hang up and check, because there "isn't time."

The executive call. A senior person authorising an urgent payment, often following an email that set up the context. The call typically arrives after business hours or right before a deadline, when the person being asked has the least room to pause and verify. See phishing vs spear phishing.

Why a familiar voice stopped being proof. Telephone fraud has always relied on the target being unable to see who they are speaking to. Recognising the voice used to close that gap; cloning reopens it. Treat an unexpected call asking for money or account access the same way regardless of whose voice it uses.

Deepfake video

In investment advertising. Fabricated video of well-known figures endorsing a platform. The FTC found $1.1 billion lost to investment scams that started on social media in 2025 — this is a standard component of that advertising, and the fabricated clip is usually just the entry point: it links out to a convincing but fake trading platform that shows invented gains to encourage larger deposits.

In video calls. Real-time deepfakes are harder to run convincingly than a pre-recorded clip, because they have to react live, but they are no longer exotic — cheap "face swap" software applied to a webcam feed is enough for a short, low-quality call. They remain weakest under sudden movement and occlusion, so asking someone to turn fully sideways, pass a hand across their face, or hold up an object to the camera can produce visible glitches a static clip would not reveal. Treat a request that specifically avoids video, or that degrades suspiciously the moment you ask for one of these checks, as itself a signal.

In romance scams. Brief, poor-quality video that answers the "why won't you video call" objection which used to end romance scams early. The excuse offered alongside it — a broken camera, a poor connection, a job that does not allow personal video calls — is worth noticing on its own, since it is doing the same isolating work as "don't call, just reply here" in a text-based scam.

Synthetic profiles and documents

Fake social accounts with consistent photo histories, plausible friend networks and months of posts, all generated rather than lifted from a real person — which used to be the tell, since a reverse image search would find the original owner. Generated identity documents that pass a visual check, used to open accounts or pass a one-time identity verification step. Together these defeat the "does this person seem real" test that used to work, and they are the reason a profile "existing for years" or "having lots of mutual friends" is weaker evidence of authenticity than it used to be.

Personalised text at scale

The most quietly consequential change. Spear phishing used to be expensive because each message was written by hand, which limited it to high-value targets worth the effort — a finance director, an executive assistant with payment authority. Combining public profile data — a job change announced on social media, a recent house purchase, a bereavement — with a language model makes an individually tailored message available at ordinary bulk-phishing volumes and cost. The scarcity that used to protect everyone below "worth targeting personally" has gone.

What still works

Notice what all of these attack: your ability to judge authenticity from the content itself. So the defences that never relied on that judgement are untouched.

Call back on a number you obtained yourself. Hang up, and dial the number already saved in your phone, printed on a card, or on the organisation's own website — never a number given to you in the call, text or email you are trying to verify. A cloned voice cannot answer your daughter's real phone, and a fake bank cannot answer the number on the back of your actual card. This single habit defeats every voice clone and every deepfake video call, regardless of quality, because it does not depend on judging the call at all — it depends on reaching a different, trusted channel.

Agree a family code word. As above — and keep it spoken, not written anywhere a scraped photo, post or document could surface it.

Verify payment changes out of band, by policy. Any change of bank details, any unusual transfer — confirmed by phone on a number from your own records, every time, without exception for how convincing the request was. The FBI's advisory on generative AI fraud gives the same instruction for a suspicious call: hang up, look up the organisation's number yourself, and call that number directly — precisely because the channel the request arrived on can no longer be trusted on its own.

Use passkeys. A perfect replica of a login page still gets nothing, because the passkey is bound to the domain and the domain is wrong. The FIDO Alliance, which maintains the passkey standard, designed it specifically so the credential cannot be phished, replayed or handed over by mistake — the cryptography is not persuadable, which is the point.

Check the payment method. Gift cards, cryptocurrency and transfers to new accounts remain the constant across every AI-enhanced variant, because the irreversibility requirement has not changed.

The practical summary

The FBI's own guidance around the 2025 report is to "Take a Beat" — resist pressure to act quickly and assess before turning over money or information.

That is exactly right, and it is deliberately not a list of tells. When you cannot trust what you see and hear, the only reliable move is to stop trusting the channel and use a different one.

The most common version of that problem — a call from a voice you recognise — has its own page: AI voice scams covers the callback rule and the family code word in detail.