Confirm the person through a contact method you find independently and already trust—not through the phone number, link, or account in the unexpected message. Until you confirm the request, don’t send money, sensitive information, or authentication codes, and don’t click links or download files.
Verify the person through a separate, trusted channel
- Pause before acting. Treat urgency, secrecy, emotional pressure, a request for money, or a push to move to another messaging app as reasons to slow down. The FBI has described impersonation campaigns that begin by text and shift to encrypted messaging apps: FBI IC3 guidance.
- Find a contact route yourself. Use a separate browser session to locate the person or organization’s official website, published directory, or a contact method you previously confirmed. Don’t use a link, phone number, or account supplied in the message. The FBI advises people to verify the identity of someone contacting them by phone, text, or voice message: FBI guidance.
- Ask whether the message and request are genuine. Contact the expert directly through that independent route. If the message claims to come from an organization, use its published switchboard or official support channel—not the contact details in the message.
- Wait if you can’t confirm it. Don’t follow instructions or disclose information while identity is uncertain. If you suspect fraud, report it through the organization’s official channel or the relevant law-enforcement reporting service in your jurisdiction.
Why familiar-looking clues are not proof
A convincing job title, profile photo, verification badge, employee ID, familiar voice, or plausible video call can all be copied or fabricated. The FTC warns that scammers can use fake employee badges: FTC guidance. The FBI also warns that impostors may use public photos, slight changes to names or contact details, and AI-generated voices that sound nearly identical to a real person: FBI IC3 alert.
As an Amazon Associate I earn from qualifying purchases.
Check the sender address, phone number, profile name, and URL spelling, and notice unexpected changes in contact details. These checks may reveal a mismatch, but a match does not prove who is behind the account or device.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Media clues can raise suspicion, but can’t certify identity
Unnatural movement, irregular facial features, inaccurate shadows, audio-video synchronization problems, or unusual latency may be warning signs. Their absence is not proof that a video or voice is authentic: AI-generated media can be difficult to identify by casual inspection, and cloned voices can sound convincing. For a surprising public image or video, check reputable news coverage or a known official channel rather than relying on the media itself.
#1 Best Overall
Protect money, accounts, and personal information while checking
- Don’t transfer money or cryptocurrency, buy gift cards, or provide account access because of an unexpected message.
- Don’t share passwords, sensitive personal information, or one-time authentication codes. A legitimate-seeming request does not make a two-factor code safe to disclose.
- Don’t click an unexpected link or download an attachment before confirming the sender independently.
Identity verification is different from securing your own login
NIST’s remote identity-proofing guidance addresses forged or manipulated images and videos, digital injection attacks, protected channels, media analysis, and human review as controls for organizations performing identity proofing. Those are system-level safeguards; they are not a consumer method for certifying a message sender from a photo or video. NIST notes that a biometric comparison using a captured sample does not prevent these attacks: NIST SP 800-63A.
WebAuthn, used with a security key or other supported authenticator, can help protect your sign-in to a website by binding authentication to the site’s domain. It does not establish who sent you an email, text, or social message. NIST describes WebAuthn as a phishing-resistant authentication example: NIST SP 800-63B.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where this guidance applies
The cited FBI, FTC, and NIST material is U.S.-focused. If you’re elsewhere, use the equivalent official organization or law-enforcement reporting channel in your jurisdiction. There is no established statistic here that can tell you how likely a message from an “AI expert” is to be genuine; verify each high-stakes request on its own merits.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
