AI-Powered Scams: How They Work and What to Do If You're Hit

The call comes in on a weeknight. It sounds exactly like your grandson: same voice, same way of saying “Grandma.” He’s been in a car accident, he’s scared, and he needs money wired before the lawyer can help. Please don’t tell Mom.

Scams like this are old. What has changed is the toolkit. Generative AI lets one person run a con that used to require a team, a good writer, and a convincing actor. The lesson from our work investigating these cases, tracing fraudulent counterparties and escalating them to banks, the FBI, and infrastructure providers, is consistent: the technology is new, but the defenses that work are mostly procedural, and the hours after a scam matter more than most people realize.

This guide covers how the current wave of AI-assisted scams works, the habits that stop most of them, and exactly what to do if you or your organization has already been hit.

How AI Changes the Scam

None of these techniques require advanced skills anymore. Consumer tools and cheap services do most of the work.

Voice cloning. Modern voice models can produce a convincing imitation from a fairly short recording. Scammers pull audio from social media videos, voicemail greetings, podcasts, or a brief “wrong number” call designed to get you talking. The cloned voice then powers two common scripts: the family emergency (an arrest, an accident, a kidnapping claim) and the executive impersonation, where “the CEO” calls the bookkeeper to approve an urgent payment.

Polished phishing. For years, spelling mistakes and awkward phrasing were the easiest tell. Large language models removed that tell. Phishing emails now arrive in fluent, context-appropriate language, often personalized with details scraped from LinkedIn, a company website, or a data breach. They can also be produced in volume and in any language, so the old “this reads like a bad translation” check no longer works.

Deepfake video in business email compromise. Business email compromise (BEC) is fraud in which a criminal impersonates an executive, vendor, or partner to redirect a payment. Criminals have staged video calls in which several “colleagues” on screen are all synthetic, then talked an employee into authorizing a series of large transfers. Real-time deepfakes still have flaws, but on a small screen, with a poor connection and time pressure, they are often good enough.

Fake investment and romance personas. AI-generated profile photos, chat assistants that keep a conversation going around the clock, and fabricated video messages let a single operator maintain dozens of believable relationships at once. These schemes usually build trust over weeks before steering the target toward a fraudulent trading platform or a series of “emergency” payments.

The common thread: every one of these scams depends on urgency and on you trusting a channel (a voice, a face, an email thread) that can now be faked.

Prevention That Actually Works

Detection tools for deepfakes exist, but they lag behind the generators and you won’t have one running during a panicked phone call. The defenses that hold up are the ones that don’t depend on spotting the fake.

For families

• Agree on a safe word. Pick a word or phrase that isn’t on social media and wouldn’t come up in casual conversation. If someone calls claiming to be family in trouble, ask for it. A real relative will understand; a scammer will stall or get angry.
• Hang up and call back. Call the person directly on the number you already have, or call another family member who would know where they are. Do not use a number the caller gives you.
• Treat payment method as a signal. Requests for wire transfers, gift cards, cryptocurrency, or cash handed to a courier are strong indicators of fraud. Legitimate emergencies rarely require those methods.
• Reduce your public voice footprint where it’s easy. Consider replacing a personalized voicemail greeting with the default, and think twice about public videos of children and older relatives speaking at length.

For small organizations

• Write down a payment-change procedure and follow it every time. Any request to change bank details, add a new payee, or rush a payment gets verified through a separate, pre-established channel: a phone number from your vendor file, not from the email requesting the change.
• Require two people for transfers above a threshold you set. Dual approval turns one person’s mistake into something a second person can catch.
• Make it safe to slow down. Staff should know that pausing to verify a request from “the CEO” will never get them in trouble. BEC scams count on employees feeling they can’t question a senior person.
• Use phishing-resistant authentication. Passkeys or hardware security keys on email and banking accounts block most credential phishing, because they won’t sign in to a look-alike site. That shuts down many of the account takeovers that precede BEC. A password manager helps too, since it won’t autofill your password on a fake domain. The trade-off is setup effort and a recovery plan for lost keys, which you need to document in advance.

The single most useful habit for everyone: when a message creates urgency around money or credentials, that urgency is your cue to slow down.

The First Hours After You’ve Been Scammed

This is the part most articles skip. If money has already left your account, act quickly and in roughly this order.

1. Call your bank or payment provider immediately

Use the number on your card or the institution’s official website. Tell them you’ve been the victim of fraud and ask them to stop or recall the transaction. Wire transfers, ACH payments, and card charges each have different recall and dispute processes, and speed matters for all of them. For gift cards, contact the card issuer right away with the card numbers and receipts. For cryptocurrency, contact the exchange you sent from; some exchanges can flag or freeze funds that reach accounts they control.

Ask the bank for a case or reference number and write it down.

2. Preserve evidence before you do anything else

Scammers delete accounts and messages quickly. Capture what you can:

• Screenshots of texts, chats, emails, and social media profiles
• Full email headers (your email client can show the “original” or “raw” message)
• Phone numbers, call times, and any voicemails
• Website addresses, payment addresses, account numbers, and transaction IDs
• Receipts and bank statements showing the transfers

Don’t confront the scammer or tell them you’re reporting them. That often triggers them to wipe accounts and move funds faster.

3. Build a timeline

Write a plain, dated account of what happened: first contact, each conversation, each payment, and when you realized it was fraud. A clear timeline makes every report faster and more useful, and keeps your answers consistent across organizations.

4. Report to the FBI and local police

File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Include your timeline and every identifier you collected. For wire fraud in particular, file quickly: a prompt report combined with your bank’s own fraud process sometimes gives investigators and banks a chance to attempt a freeze. Also file a report with your local police department. Even if they can’t investigate, a police report number is often required by banks, insurers, and credit bureaus. You can also report to the FTC at ReportFraud.ftc.gov.

5. Report abusive domains and hosting

Fake investment platforms, phishing pages, and impersonation sites run on real infrastructure, and that infrastructure has abuse channels. A WHOIS or RDAP lookup on the domain will usually identify the registrar and sometimes the hosting provider. Most registrars, hosting companies, and proxy services such as Cloudflare accept abuse reports through dedicated forms or abuse contact addresses. Taking a site down won’t return your money, but it can stop the same operation from catching the next person.

6. Secure your accounts

If you shared passwords, verification codes, or remote access to your computer, assume those accounts are compromised. Change passwords from a clean device, turn on stronger authentication, review account recovery settings, and sign out other sessions. If someone had remote access, have the machine checked or reinstalled. If you shared personal information like your Social Security number, place a credit freeze with Equifax, Experian, and TransUnion.

7. Watch for recovery scams

Victims of fraud get targeted again. Shortly after a loss, you may hear from “fund recovery specialists,” “blockchain investigators,” or people posing as government agents who say they can retrieve your money for an upfront fee. Law enforcement does not charge fees to recover funds. Anyone who promises guaranteed recovery for payment up front is very likely running a second scam.

Being Honest About Recovery

Recovery is not guaranteed, and in many cases it doesn’t happen. Money sent by wire or cryptocurrency moves fast and often crosses borders within hours. Law enforcement agencies receive far more reports than they can investigate individually, so a report may not lead to direct follow-up. Banks vary widely in how they handle fraud claims, especially when the account holder authorized the payment themselves.

That doesn’t make reporting pointless. Reports help investigators link cases into larger patterns, fast action sometimes does stop funds in transit, and documentation protects you in disputes with banks and insurers. Just go in with realistic expectations, and be wary of anyone, including a consultant, who promises a specific outcome.

Being scammed is not a measure of intelligence. These operations are built by people who do this full time, and AI has made them more convincing. The goal now is to limit the damage and make yourself a harder target next time.

Getting Help

When a scam has already happened, we investigate what happened and help you organize evidence, build a clear timeline, file complete reports with the right agencies and providers, and lock down your accounts so the same attacker has a much harder time getting back in. We also help families and small organizations build verification habits before anything goes wrong. Learn more about our AI scam and deepfake awareness training and privacy and security services, or reach out if you’re dealing with an active situation.