AI-Enabled Scams

Build the mental model

Cybersecurity Basics already taught the classic phishing tells: check the sender, hover the link, watch for urgency, spot spelling/grammar mistakes. AI has quietly broken that last one — it can now produce grammatically flawless scam text.

Voice cloning — reproduces a person's voice from a short sample
Fake video/image — produces convincing fake likenesses
Impersonation scams — claim to be a family member/manager and urgently request money or credentials

A Familiar Voice or Face Is No Longer Proof of Identity

Stop treating "it sounds and looks like them" as sufficient proof of identity on its own.

Whenever a request involving money, credentials, or urgency arrives via voice, video, or message, verify identity independently through a separate trusted channel before acting.

text

AI-GENERATED CONTENT AND THE DEFENSIVE BREAK POINT
--------------------------------------------------
AI-GENERATED CONTENT AND THE DEFENSIVE BREAK POINT
----------------------------------------------------

  AI-GENERATED CONTENT
  ---------------------
  perfect scam text | cloned voice | fake video/image
              |
              v
  arrives via message, call, or video
              |
              v
  claims urgency + asks for money or credentials
              |
              v
      >>> DEFENSIVE BREAK POINT <<<
      verify through a SEPARATE,
      independently-known channel
      before acting
              |
      +-------+--------+
      |                |
      v                v
  NOT verified     VERIFIED
  -> do not act    -> safe to act

Connect it to a real scenario

The code below is a purely defensive, illustrative risk-scoring function. It takes a description and returns a risk level plus a recommended action, never generating or mimicking scam content.

Risky example — urgency, money request, unverified channel, not verified -> "high" risk, pause
Verified example — same request but independently verified -> "low" risk, proceed

This contrast shows that verification, not how convincing the voice or message sounded, is what actually changes the outcome.

AI has broken the old spelling/grammar heuristic for spotting scam text
Voice cloning and fake video are increasingly used in impersonation scams
Verify any money or credential request through a separate, independently-known channel

A Familiar Voice or Face Is No Longer Proof of Identity

A familiar voice or face is no longer proof of identity. Verify any request involving money or credentials through a separate, independently-known channel, no matter how convincing it sounds or looks.

Try the working example

javascript

function assessIncomingRequest({ claimsUrgency, requestsMoneyOrCredentials, arrivedViaUnverifiedChannel, wasIndependentlyVerified }) {
  let score = 0;
  if (claimsUrgency) score += 1;
  if (requestsMoneyOrCredentials) score += 2;
  if (arrivedViaUnverifiedChannel) score += 1;
  if (wasIndependentlyVerified) score -= 4;

  let riskLevel;
  if (score >= 3) riskLevel = "high";
  else if (score >= 1) riskLevel = "medium";
  else riskLevel = "low";

  const recommendedAction = wasIndependentlyVerified
    ? "Proceed -- identity was confirmed through a separate, known channel."
    : "Pause. Do not act on this message alone -- verify the request through a separate, independently-known channel before doing anything.";

  return { score, riskLevel, recommendedAction };
}

const riskyVoiceRequest = assessIncomingRequest({ claimsUrgency: true, requestsMoneyOrCredentials: true, arrivedViaUnverifiedChannel: true, wasIndependentlyVerified: false });
const verifiedSafeRequest = assessIncomingRequest({ claimsUrgency: true, requestsMoneyOrCredentials: true, arrivedViaUnverifiedChannel: true, wasIndependentlyVerified: true });

console.log(JSON.stringify({ riskyVoiceRequest, verifiedSafeRequest }, null, 2));

You should see

{
  "riskyVoiceRequest": {
    "score": 4,
    "riskLevel": "high",
    "recommendedAction": "Pause. Do not act on this message alone -- verify the request through a separate, independently-known channel before doing anything."
  },
  "verifiedSafeRequest": {
    "score": 0,
    "riskLevel": "low",
    "recommendedAction": "Proceed -- identity was confirmed through a separate, known channel."
  }
}

5-minute try-it

Run `assessIncomingRequest` with `requestsMoneyOrCredentials: false` but every other factor still risky. Notice how the risk level changes, and think about why the score drops.

One important caution

Still assuming flawless spelling and grammar means a message is genuine

Skipping verification just because the voice or face sounded or looked familiar

CISA — Avoiding Social Engineering and Phishing Attacks — Digital Privacy & Modern Security