AI Phishing & Deepfake Scams: How to Spot Them (2026)
The last time I wrote on this blog, a phishing email gave itself away with bad grammar, a strange sender address and a "Dear Customer" greeting. That was 2015. Today the same scam can arrive in flawless English, quote your manager's name, and be followed by a phone call in a voice that sounds exactly like someone you trust.
Hackup's is back, and I can't think of a better comeback topic. AI has made scams cheaper, faster and far more convincing. The good news is that the defence is still simple, as long as you change what you look for.
I've spent the last 11 years in software testing and QA leadership. My job is to assume something is broken until it proves otherwise. That habit, it turns out, is the best anti-scam tool I know. Let me show you how to use it.
Why AI Phishing Is a Different Game in 2026
The numbers are moving in the wrong direction. The Anti-Phishing Working Group's Phishing Activity Trends Report for Q2 2026 found that phishing attacks rose 10.1 percent over the previous quarter, with 425,808 attacks in June 2026 alone, the highest monthly total since April 2023. The same report says smishing (phishing by SMS) jumped 40 percent and voice-call phishing rose 20 percent from Q1 to Q2.
Deepfakes are growing even faster. Blockchain intelligence firm TRM Labs reports in its 2026 AI-in-Crime Adoption Index that reported deepfake-scam losses so far in 2026 already exceed all of 2025 by 263 percent.
This isn't theory, either. In 2024 the engineering firm Arup confirmed to CNN that an employee in its Hong Kong office paid out about US$25 million after a video call in which fake voices and images were used to impersonate senior colleagues. The scam started with a message that appeared to come from the company's CFO.
The old warning signs no longer work
Even CISA, the US cyber defence agency, now says so plainly. Its phishing guidance notes that poor grammar used to be a common sign, but in the era of AI some emails will have perfect grammar and spelling. So stop grading the writing and start checking the request.
The Most Common AI-Powered Scams Right Now
The FBI's public service announcement on criminals using generative AI for financial fraud is one of the clearest summaries I've read. Here is how those tactics usually show up in real life.
1. The perfect phishing email
AI writes polished, personalised messages in seconds and in any language. Expect emails that mention your real employer, a real project or a recent purchase, all pulled from public profiles and old data leaks.
2. The cloned-voice emergency call
A short clip from a video or voice note can be enough to imitate someone. The FBI warns of calls where a "relative" is in a crisis and needs money right now, or where a cloned voice is used to get into a bank account.
3. The deepfake video meeting
This is the Arup pattern. A "CFO" or "director" joins a video call, looks and sounds right, and asks for a confidential, urgent transfer. The FBI notes that criminals now use generated video for live chats with fake executives and even fake police officers.
4. Fake profiles and fake proof
AI-generated faces, ID cards and screenshots make fake recruiters, investment "advisers" and romance profiles look real. If someone you've only met online sends a photo to "prove" who they are, that proves very little.
How to Spot a Deepfake or AI Scam: Think Like a Tester
In QA we never trust a result just because it looks right. We check it against an independent source of truth, which testers call an oracle. Apply the same idea to any message that asks you to do something.
Don't ask "Does this look real?" Ask "How can I confirm this through a channel the sender doesn't control?"
Check the request, not the polish
Almost every scam asks for one of a few things: money, a password or one-time code, a gift card or crypto payment, or a click on a link. Urgency and secrecy are the giveaways. "Do this now, and don't tell anyone" is a red flag no matter how professional it sounds.
Verify out of band
Hang up and call back on a number you already have, or one you find yourself on the official website. Never use the number, link or meeting invite inside the suspicious message. The FBI and CISA both recommend exactly this.
Look and listen for glitches, but don't rely on them
The FBI lists signs like distorted hands, odd teeth or eyes, unrealistic glasses or jewellery, wrong shadows, lag, and voices that don't quite match. These can help, but the technology keeps improving. Treat a glitch as a bonus clue, never as your main test.
Ask a question only the real person can answer
Ask about a shared memory or something that isn't online. A live deepfake is good at faces and voices. It is far worse at facts it was never given.
Your Practical Anti-Scam Checklist
Save this, print it, or share it on your family group. These steps take minutes and work against almost every scam above.
- Create a family safe word. Agree on a secret word or phrase that anyone must say in a money emergency. This is a direct FBI recommendation.
- Set a callback rule at work. No payment or bank detail change is approved on a single call, email or video meeting. It needs a second check through a known number.
- Turn on multi-factor authentication for email, banking and social accounts, and never share a one-time password with anyone, including "bank staff".
- Type addresses yourself. Go to the website or app directly instead of clicking links in messages, as CISA advises.
- Lock down your voice and face. Make social accounts private where you can and limit followers to people you know. Less public audio and video means less material to clone.
- Slow down on urgency. If a message pushes you to act in minutes, take a pause and verify. Real banks and real bosses can wait five minutes.
- Never pay with gift cards or crypto to someone you have only met online or over the phone.
- Report it. Use the "Report phishing" or "Report spam" button in your email app, then delete the message without clicking anything, including "unsubscribe".
What to Do If You've Already Been Scammed
First, don't be embarrassed. These scams are built by professionals to fool smart people. Speed matters far more than pride.
- Call your bank right away to freeze cards and try to stop or recall the transfer.
- Change the passwords for any account you shared, starting with your email, and sign out of all other sessions.
- Save evidence: screenshots, phone numbers, email addresses, transaction IDs and payment details.
- Report it. In India, call the national cyber crime helpline 1930 or file a complaint at cybercrime.gov.in. In the US, the FBI asks victims to report at ic3.gov.
FAQ: AI Phishing and Deepfake Scams
Can AI really clone my voice from a short clip?
Yes. The FBI warns that criminals generate short audio clips in a loved one's voice to fake an emergency. Keep public voice and video content limited, and use a family safe word.
How can I tell if a video call is a deepfake?
Look for lag, odd lighting, strange eyes or mismatched lip movement, but don't depend on it. The reliable test is to end the call and confirm the request through a number or channel you already trust.
Is a message with perfect grammar safe?
No. CISA says AI-written phishing often has perfect spelling and grammar now. Judge a message by what it asks you to do, not by how well it's written.
Will antivirus software stop deepfake scams?
Not on its own. Security software helps with malicious links and files, but a convincing voice or video call targets your trust, not your device. Verification habits are your real protection.
Conclusion: Trust, but Verify Everything
AI has changed what scams look like, but not what they want. They still need you to act fast, skip a check, and send something you shouldn't. If you build one habit, make it this: verify through a channel the sender doesn't control.
It feels good to be writing here again. I'll be posting regularly on cyber security, ethical hacking and the place where security meets software testing. Have you had a suspicious call or a too-perfect email lately? Tell me about it in the comments, and subscribe or follow Hackup's so you don't miss the next post.
Comments
Post a Comment