Generative AI can help scammers create convincing identities, tailor messages, and imitate familiar voices, but it does not make every scam an AI scam. The practical defense is not to judge whether a message or voice sounds real: verify unexpected requests through a separate contact route you already trust.
What “AI-powered social engineering” means
Social engineering tricks people into trusting a person or request, then persuades them to share information, transfer money, click a link, or grant access. Generative AI can accelerate that process by producing polished, personalized text, synthetic profiles, and voice or video imitations. It supports the tactic; it does not define it, and scammers can still succeed without AI.
As an Amazon Associate I earn from qualifying purchases.
The FBI’s 2025 Internet Crime Complaint Center (IC3) report says: “AI-enabled synthetic content is becoming increasingly difficult to detect and easier to make, which allows criminal actors to potentially conduct successful fraud schemes against individuals, businesses, and financial institutions.” That makes surface clues such as good grammar less useful as a test of authenticity.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Are AI scams increasing?
In 2025, the FBI IC3 received 22,364 complaints reporting AI-related information and recorded $893,346,472 in adjusted reported losses associated with those complaints. These are U.S. complaint-based figures, not a count of every incident or a population-wide estimate. They do not establish that AI independently caused every reported loss. The report also says business email compromise (BEC) scams involving AI accounted for over $30 million in reported business losses, while cautioning that BEC includes multiple tactics and not all are AI-enabled. Read the FBI IC3 2025 Annual Report.
#1 Best Overall
Other figures illustrate the range of reported fraud, not the share of all scams that use AI. In the same report, investment complaints with a reported AI nexus accounted for $632,041,188 in losses, against more than $8 billion in total investment-scam losses; the report notes that many victims may not know whether AI was involved. It records over $19 million in losses to confidence and romance scams with a likely AI nexus, and over $5 million in claimed losses to distress scams, which include scams using voice cloning to mimic a loved one. Complaint categories and attribution differ, so these amounts should not be treated as a complete or directly comparable measure of AI’s role.
European sources describe related developments in their own scopes. The European Commission’s summary of Europol’s 2026 Internet Organised Crime Threat Assessment says criminals increasingly use generative AI to tailor social-engineering tactics and accelerate and conceal online fraud. CERT-EU’s 2025 threat review says social engineering is moving beyond email, with voice phishing and AI-generated deepfakes gaining ground. These European assessments and the FBI’s U.S. complaint data are not a single global prevalence measure. European Commission summary of Europol IOCTA 2026; CERT-EU 2025 threat review.
How a scam can reach you
AI can appear in different channels, but the underlying pattern is familiar: create a reason to trust the sender, introduce urgency or opportunity, and steer you toward an action. The FBI described a campaign using texts and AI-generated voice messages to impersonate senior U.S. officials, build rapport, and move targets to another messaging platform or a malicious link. The shift in platform can make a request feel like a natural conversation while separating it from a channel where the target might otherwise check it.
| Channel | Trust cue or approach | Risky requested action | Safer verification route |
|---|---|---|---|
| A polished message that appears to come from a colleague, business, or institution | Open a link, provide credentials or a one-time code, or change payment details | Contact the organization or colleague using a known address or number; confirm payment or account changes through an established procedure | |
| Text or messaging app | Familiarity, authority, urgency, or a prompt to move to a new platform | Click a link, install an app, share information, or continue the conversation elsewhere | Stop and reach the person through a contact route you already have, not one supplied in the message |
| Voice call | A voice that sounds like a relative, manager, or official, often paired with an emergency | Send money, disclose a code, or act before you can check the story | End the call and call the person back at a saved number; a private family verification phrase can help |
| Video or social profile | A convincing face, profile, or apparent personal connection | Trust an investment pitch, share private details, or move funds | Verify the identity and proposal independently through a channel not introduced by the profile |
How to verify a suspicious request
- Pause and break the pressure. Do not transfer money, cryptocurrency, or gift cards, share sensitive information, or click a link while an unexpected request is being verified. Urgency is a reason to slow down, not a reason to skip checks.
- End the interaction. Hang up or stop replying. Do not use a phone number, link, or alternate account supplied in the suspicious message as your verification route.
- Contact the person or organization independently. Use a number, address, or app you already know, such as a saved contact or an established official channel. Ask whether they made the request and confirm the specific action, recipient, and details.
- Use a family phrase for emergency calls. Agree in advance on a private phrase with family members and ask for it if a caller claims to be a relative in danger. Do not post the phrase or share it in a message that could be exposed.
- Protect account access. Never disclose a password, recovery link, or one-time multifactor authentication (MFA) code. Do not install an app or grant account access because an unverified contact asks you to.
- Strengthen sign-in protections. Enable MFA where available. For organizations, phishing-resistant MFA is one defensive priority identified by CERT-EU, alongside procedures that independently confirm payment or account changes; no single control prevents every scam.
Can you spot an AI-generated voice or video?
Sometimes media may contain warning signs, such as distorted features, odd shadows, voice lag, or unnatural movement. Treat these as reasons to check further, not as a reliable detection test. A convincing recording can still be fake, and an authentic recording can have glitches. The FBI warns that AI-generated content can be difficult to identify and that cloned voices can sound nearly identical to known contacts.
The more useful question is whether the request can be verified outside the interaction. A familiar voice, typo-free message, or polished video does not prove who sent it. If the person is genuinely asking for help, a callback to a known number or confirmation through an established channel should not depend on trusting the original message alone.
What the threat means for organizations
The risk is broader than email written with better grammar. The FBI’s described campaign used impersonation, messaging-platform changes, and malicious links; compromised access or contact networks can help an attacker reach additional people. CERT-EU’s review also flags voice phishing and AI-generated deepfakes as gaining ground.
- Train staff to verify unusual requests for payments, credentials, one-time codes, or account changes through a separate, known channel.
- Require independent confirmation for changes to payment instructions or sensitive account details, rather than accepting the request in the same email or call.
- Use MFA and consider phishing-resistant options where services and devices support them.
- Make reporting suspicious messages or calls straightforward so staff can raise concerns without having to decide whether the media is AI-generated.
These measures reduce opportunities for impersonation to succeed; none can guarantee that every deceptive request will be caught.
What to do after responding to a suspected scam
- If you shared a password or code: use the service’s official route to change the password, review account recovery and sign-in settings, and contact the provider if you cannot regain control. Do not use links from the suspicious message.
- If you sent money: contact your bank, payment provider, or relevant platform promptly using its official contact details and ask whether the transfer can be stopped or disputed. Preserve messages and transaction details.
- If you clicked a link or installed an app: stop interacting with the sender, remove access or software you do not recognize, and seek help from your organization’s IT team or the relevant service provider if a work or personal account may be exposed.
The FBI’s May 15, 2025 alert advises people to independently verify identity before responding, sharing information, clicking links, or sending money; enable MFA; never share a verification code; and consider a family secret phrase. It also cautions: “If you receive a message claiming to be from a senior U.S. official, do not assume it is authentic.” Read the FBI alert.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
