Online scams work by combining a believable identity with emotional pressure and a specific action: click a link, disclose a code, install software, send money or keep the conversation secret. Artificial intelligence can make that combination faster and more convincing through targeted messages, cloned voices and synthetic video, but the underlying playbook is older than AI. The safest response is consistent: pause, ignore contact details supplied in an unexpected message, and verify the request through a channel you already know is genuine.
What makes an impersonation scam work?
Impersonation supplies the disguise. A criminal pretends to be a bank, retailer, delivery company, government office, employer, friend or relative. Social engineering supplies the story and pressure that make the disguise useful. The message may claim that your account is under attack, a parcel is waiting, a subscription is renewing, you have won a prize, you are in legal trouble or someone you love needs emergency help.
As an Amazon Associate I earn from qualifying purchases.
The objective is not merely to sound authentic. It is to move you from recognition to an irreversible action before you have time to check the story. The requested action can be a payment, gift-card purchase, cryptocurrency transfer, login, one-time code, identity document, link click, attachment opening or remote-access installation.
Federal Trade Commission (FTC) guidance describes impersonation as a major and changing category of fraud. In its 2024 data, the FTC recorded more than 330,000 business-impersonation reports and nearly 160,000 government-impersonation reports, with more than $1.1 billion in combined reported losses. Those are reports made directly to the FTC, not a count of every incident. Separate FTC consumer guidance says consumers reported nearly $3 billion lost to impersonators in 2024. The publications cover different years, populations and definitions, so the figures should not be added together.
How the scam sequence unfolds
- A trusted identity is selected. The scammer chooses an institution or person you are likely to recognize. Public social-media information, breached data and previous conversations can help make the choice specific.
- A problem or opportunity is presented. The opening may be an unauthorized purchase, a delivery failure, a prize, a refund, a legal threat or a family emergency.
- Emotion narrows your decision time. Fear, excitement, urgency and secrecy discourage you from checking with anyone else. A caller may insist that you stay on the line or that telling someone will make matters worse.
- A concrete action is demanded. You may be told to move money to a “safe” account, buy gift cards, use a Bitcoin ATM, reveal a password or verification code, click a link, open an attachment or install remote-access software.
- Additional impersonation reinforces the story. A second criminal may pose as your bank, a government investigator or a recovery specialist. The handoff makes the first claim seem independently confirmed while extracting more money or data.
FTC reporting has found that impersonation complaints increasingly began with text messages or email between 2020 and 2023, while phone-originating reports fell. That does not make any one channel safe: a convincing text can lead to a call, and a phone call can direct you to a fraudulent website.
Common scripts and the warning signs inside them
| Script | Typical request | What should make you stop |
|---|---|---|
| Account-security alert | Call a number, transfer funds or “confirm” credentials after a claimed suspicious purchase. | The message creates fear and supplies its own contact route instead of asking you to open the official app. |
| Subscription renewal or refund | Call for cancellation, install remote-access software or send back a fictitious refund. | A stranger needs control of your screen or asks you to repay money you never received. |
| Prize, giveaway or benefit | Pay a fee, buy gift cards or provide banking details to claim winnings. | Legitimate prizes do not require gift-card codes or an upfront payment to release them. |
| Government or legal threat | Move money, pay in cryptocurrency or keep the investigation secret. | Officials do not demand secrecy or gift cards to prevent arrest or resolve a case. |
| Delivery problem | Follow a link to pay a small fee or update card and account information. | An unexpected message uses a lookalike domain and asks for payment details before you check the carrier’s app. |
| Family emergency | Send money immediately to a new account or intermediary. | The caller insists on urgency, secrecy or a method that prevents you from speaking with the relative directly. |
These scripts change constantly. Grammar, branding and a familiar telephone number cannot authenticate the sender. Caller ID can be spoofed; the FTC’s consumer advice is blunt: “Don’t trust your caller ID.”
How do online scams use AI?
AI is an amplifier, not a prerequisite. The FBI said on May 8, 2024, that “AI provides augmented and enhanced capabilities to schemes that attackers already use and increases cyber-attack speed, scale, and automation.” In practice, a criminal can produce many personalized messages quickly, adapt a script to a target’s job or relationships and maintain a plausible conversation for longer.
Targeted phishing at scale
Generative systems can draft messages that mention a real employer, recent transaction, school, event or colleague. They can translate and rewrite the text for different audiences, reducing the obvious spelling and grammar errors that once exposed many scams. Polished prose is therefore not proof of legitimacy, and awkward prose is not proof that a message is harmless.
Voice cloning in urgent calls
A short audio sample can be used to imitate a person’s voice closely enough to trigger recognition. A criminal may call as a child, parent, coworker or executive and then hand the phone to a supposed police officer, lawyer or bank employee. The emotional effect is strongest when the request fits a real-world event, such as travel, illness or a late payment.
Synthetic video and live impersonation
Video manipulation can place a familiar face in a message or meeting. A convincing image still does not establish who is controlling the account, where the request originated or whether the payment instructions are genuine. Treat an unexpected video call with the same skepticism as an unexpected email.
What AI does not change
The scam still needs a believable pretext, pressure and a transfer of money, information or access. There is no reliable consumer test that proves an audio or video clip is authentic. The FTC’s Office of Technology has discussed prevention, real-time detection and post-use analysis for voice cloning, but warns that watermarks can be altered or removed, detection can produce harmful false positives and methods must adapt as cloning improves. The FTC says there is “still no silver bullet to prevent the harms posed by voice cloning.”
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow can I tell if a scammer is impersonating someone?
- The contact is unexpected. You did not initiate the call, message or email, yet it claims to concern an urgent account or payment.
- The request changes the normal process. You are told to use gift cards, cryptocurrency, a Bitcoin ATM, a new bank account or a remote-access tool.
- Pressure replaces evidence. The sender demands immediate action, secrecy or a decision while you remain on the line.
- The supplied link or number is the only verification route. A real organization’s app, statement or independently found website offers a safer route.
- The story crosses organizations. A retailer, bank and government “agent” appear in sequence, each confirming the previous person.
- The identity signal is merely visual or audio. A logo, caller ID, familiar voice, profile photo or video can be copied or manipulated.
One warning sign can be enough to stop. You do not need to prove that a message is fraudulent before declining to act through its instructions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should I do if a caller claims to be a family member asking for money?
- Pause and end the pressured conversation. Tell the caller you will call back through your usual number. Do not let a demand for secrecy prevent you from checking.
- Call the relative using a number already saved in your contacts or written in a trusted record. Do not use the number displayed by caller ID or supplied during the emergency call.
- Use a second route if the person cannot be reached. Contact another relative, a household member, school, workplace or travel companion using contact details you already know.
- Ask a private question or use a family safe word only as an additional check. Do not treat a correct public fact as proof; information from social media can be available to criminals.
- Do not send money while identity remains unverified. A genuine emergency can wait for a safe callback and an independently confirmed payment route.
A cloned voice can make a false story feel personal, but it does not change the verification rule: independently contact the person or someone who can confirm the situation.
How do I verify a suspicious text or email?
- Do not click, reply, open attachments or call the supplied number. Replying can confirm that your address or number is active.
- Open the official app or type a web address you have used before. Do not search for a support number and select a sponsored or lookalike result without checking the address carefully.
- Check the account independently. Look for the alleged purchase, renewal, delivery or security alert in the service’s normal notification area.
- Contact the organization through a known channel. Use the number on a bank card, a statement, a prior bill or the organization’s independently verified website.
- Verify the payment destination before approving anything. Read the account name and amount aloud to a second person for high-value or unusual transfers.
- Report and delete the message after preserving useful evidence. Keep the sender address, phone number, links and transaction records for investigators, but do not continue the conversation.
The FTC’s phishing guidance specifically warns about unexpected links and attachments. If you already entered a password, change it from the genuine site, sign out other sessions and enable multifactor authentication. Contact the financial institution immediately if money or card data was sent.
Which defenses help, and what can they not prove?
| Defense | What it helps prevent | What it does not establish |
|---|---|---|
| Spam filters and reporting tools | Reduce exposure to known malicious messages and help providers identify campaigns. | They cannot catch every new or highly targeted message. |
| Multifactor authentication (MFA) | Adds a barrier when a password is stolen or guessed. | It does not authenticate a phone call, email, social profile or payment request. |
| FIDO2-compatible security key | Strengthens sign-in on services that support hardware security keys and resists many phishing-based credential theft attempts. | It cannot tell whether a person contacting you is genuine. Confirm that each account supports the key before buying one. |
| Caller-ID or voice-clone detection | May flag suspicious technical characteristics in some calls or recordings. | No tool guarantees that a voice, video or caller ID is authentic; false positives and evasion remain possible. |
| Independent callback procedure | Tests the identity and request through a channel not controlled by the initial contact. | It requires you to slow down and use a trusted number or website rather than the supplied details. |
For organizations, technical filtering should be paired with staff training and an approval rule for unusual financial or data requests. A second employee should verify new payment instructions, password resets and requests for sensitive records through an established channel. MFA remains an important access control, but it is only one layer.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat to do after you paid or shared information
- Call the bank, card issuer, payment service or cryptocurrency exchange immediately and ask whether the transaction can be stopped or reversed.
- Change compromised passwords from a clean, trusted device; use unique passwords and revoke unfamiliar sessions or app access.
- Tell your mobile carrier if an account takeover or SIM-swap attempt is possible.
- Preserve messages, headers, phone numbers, payment receipts, wallet addresses and screenshots. Do not pay a second “recovery” service that promises to retrieve funds.
- Report the incident to the FTC at ReportFraud.ftc.gov. For suspected internet crime, the FBI directs victims to IC3.gov.
- Warn people who might be targeted next, especially if the scammer obtained your contacts, workplace details or family information.
Why slowing down is the most reliable protection
Impersonation succeeds when recognition substitutes for verification and urgency prevents a second opinion. AI can improve the disguise, generate more attempts and imitate voices or video, but it cannot make an unexpected payment demand legitimate. Treat identity as unproven until you confirm it independently, and treat any request for secrecy, credentials, remote access or an unusual payment method as a reason to stop.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
