AI scams in 2026: 8 schemes to spot and how to protect your family

AI scams are old frauds (the family emergency, the boss who needs a wire, the can't-lose investment) made more convincing with cloned voices, deepfake video and AI-written messages. This guide covers the eight schemes the FBI, FTC and CFTC warn about, the red flags that still work when the fake is perfect, and the exact steps to protect your family and your company.

What are AI scams?

AI scams are frauds where criminals use generative AI to impersonate people or invent credibility: a cloned voice of your son, a deepfake of your CFO on a video call, a flawless phishing email, or a fake trading bot with AI-generated testimonials. The script is usually decades old. What changed is that the fake now looks and sounds right, and one scammer can run thousands of tailored conversations at once.

The FBI's 2025 Internet Crime Report added a section on artificial intelligence for the first time. It counts 22,364 complaints that mentioned AI, with $893,346,472 in adjusted losses, and notes that AI-made content "is becoming increasingly difficult to detect and easier to make."

Those AI figures are a floor. The same report puts total investment scam losses above $8 billion while AI-linked investment complaints came to about $632 million, and concludes that many victims do not realize AI was involved. The FTC sees the same scale from the consumer side: people reported losing $15.9 billion to fraud in 2025, with investment scams ($7.9 billion) the costliest category and impostor scams (over 1 million reports) the most common.

The practical lesson: you will not reliably catch a good fake by looking or listening. You catch AI scams by noticing the pressure pattern and verifying through a channel the scammer does not control.

The 8 AI scams to know in 2026

The eight AI scams below cover almost everything the FBI, FTC and CFTC warn about. Each one pairs an AI-made "proof" with a classic pressure tactic.

The sections below explain the ones that cost people the most and the signals that still work.

How do voice cloning scams work?

A voice cloning scam uses a short recording of someone you love to generate new speech in their voice, then calls you with an emergency. The FTC puts it plainly: "All he needs is a short audio clip of your family member's voice," often taken from content posted online, plus a voice-cloning program.

The call follows a script: an accident, an arrest or a hospital, a request to keep it secret ("don't tell Mom"), and a payment method that is hard to reverse. The FTC lists wire transfers, cryptocurrency and gift cards as the tells. The FBI's report says victims reported over $5 million in 2025 losses to these "distress" scams, and that the script is spreading from grandchildren to other relatives and close friends.

Signs that still hold up when the voice is perfect:

• Urgency plus secrecy. Real emergencies survive a two-minute callback. Scams do not.
• An unusual way to pay. Nobody's lawyer takes gift card numbers.
• A handoff. The "relative" speaks briefly, then a "lawyer" or "officer" takes over, which keeps the cloned audio short.
• No answer to a personal question. Ask something that is not on social media, or ask for the code word.

The FTC's core advice is "Don't trust the voice." Hang up and call your family member on the number you already have. If you cannot reach them, call someone who is with them.

How do deepfake video call scams target companies?

Deepfake video call scams put fake executives in a live meeting to approve a payment that a lone email could not. The best-documented case is the engineering firm Arup: a finance employee in its Hong Kong office was invited to a video call where the UK-based CFO and several colleagues were deepfakes, and made 15 transfers totaling about HK$200 million (roughly US$25 million) to five bank accounts. Dezeen reported that the employee was suspicious at first, and that the fraud surfaced only when he later checked with head office. Arup confirmed that "fake voices and images were used."

The lesson from Arup is uncomfortable: recognizing faces on a call is not verification. The FBI's 2024 public service announcement on generative AI fraud lists deepfaked video calls with supposed executives among the main patterns, and its 2025 report counts over $30 million in business email compromise losses that involved AI. Business email compromise as a whole cost businesses more than $3 billion in reported losses in 2025.

Deepfakes also show up in hiring. The FBI notes fake job candidates using voice spoofing in online interviews, where lip movement does not match the audio and a cough or sneeze is out of sync with the video. The goal there is usually access to company networks rather than money.

How is AI phishing different from old phishing?

AI phishing removes the spelling mistakes and awkward translations that used to give scams away. The FBI warns that chat generators create official-sounding emails that mimic a company's CEO, and that AI translation lets foreign scammers write in fluent local language. Grammar is no longer a useful filter.

What still works is checking the request, not the writing:

• A changed bank account for a known supplier is the classic business email compromise move. Verify by phone using a number from your records, not the email.
• A login link you did not ask for should be ignored. Open the site from a bookmark. Passkeys and hardware security keys resist fake login pages because they only work on the real domain.
• A new urgency ("before end of day", "the auditors are here") is pressure, not information.

A newer variant is the fake AI tool. In May 2025 Google's Mandiant team documented a campaign that ran thousands of ads, mostly on Facebook and a handful on LinkedIn, for fake AI video generators impersonating Luma AI, Canva Dream Lab and Kling AI. Visitors who "generated" a video downloaded malware that stole passwords, cookies, credit card data and crypto wallets. Install AI apps only from the vendor's own site or an official app store, and treat ads for free AI tools as suspect. Our guide to using AI safely at work covers the approved-tools side.

How do fake AI trading bots and deepfake investment ads work?

Fake AI investment schemes promise that a bot or algorithm earns returns no human can, often promoted with deepfake videos of celebrities or CEOs. The FBI says investment fraud remained the costliest crime type in 2025, with $7.2 billion lost to cryptocurrency investment fraud alone, much of it run by organized groups in Southeast Asia that move victims from social media to private messaging groups.

The CFTC's advisory "AI Won't Turn Trading Bots into Money Machines" states the core fact: AI cannot predict the future or sudden market changes. Its red flags:

• Guaranteed or unreasonably high returns, or win rates near 100 percent.
• "No trading experience required."
• Referral bonuses for recruiting friends.
• Tips from influencers or strangers you met online.

The CFTC's example is Mirror Trading International, which took more than $1.7 billion in bitcoin from at least 23,000 people with a promised bot-driven forex program. Very little was traded; it was a Ponzi scheme. Before you invest anywhere, check that the firm is registered with your financial regulator, run a reverse image search on the people in the ads, and ask someone you trust for a second opinion.

How do you protect your family from AI scams?

You protect your family with three habits: a shared code word, a rule that every money request gets a callback, and less public voice and video. The FBI recommends a code word in both its generative AI fraud warning and its December 2025 virtual kidnapping alert, where scammers send altered photos of a relative as "proof of life" and use timed messages so you cannot study them closely.

Set it up in one evening:

1. Pick a code word or phrase that is not online anywhere: not a pet's name, not a street. Share it in person or on a call, not in a group chat that could be compromised.
2. Agree on the rule: any call, text or video asking for money or secrecy gets a callback to a saved number before anyone pays, even if the voice or face is perfect.
3. Save a backup contact for each person (a partner, roommate or coworker) so you can check on someone who does not answer.
4. Make accounts private where you can, and think twice before posting long clips of children's voices.
5. Tell older relatives about the payment tells: wire, crypto, gift cards, cash couriers. People 60 and over reported $7.7 billion in losses to the FBI in 2025, more than any other age group.
6. Practice once. Call a parent pretending to be in trouble and see whether they ask for the code word.

Send something like this to your family group:

New family rule, because of AI voice scams:If anyone calls, texts or video-calls asking for money or to keep something secret,even if it sounds exactly like me, hang up and call me back on my saved number.Our code word is the one we agreed on in person. Ask for it.Real emergencies can wait two minutes. Scams can't.

If you want to understand how convincing synthetic media gets, our guide on how to spot deepfakes shows the visual and audio artifacts, and why detection tools alone are not enough.

How should a company protect itself from deepfake fraud?

A company protects itself from deepfake fraud with payment controls that do not depend on anyone recognizing a voice or face. Training helps, but the Arup case shows a trained, suspicious employee can still be convinced. The control has to make the convincing irrelevant.

Write the rule so that an executive cannot override it on a call. If the real CEO asks for an exception, the callback costs five minutes; if a deepfake asks, it saves the company. Security teams that want to go further can read our overview of AI for cybersecurity.

What should you do if you've been scammed by AI?

If you sent money, call your bank or payment provider immediately and ask for a recall, then report the crime. Speed matters: the FBI's Recovery Asset Team froze about $679 million of $1.16 billion in attempted theft in 2025 (a 58% success rate) through its fast-response process, and the FBI stresses that "time is of the essence."

1. Stop all payments and contact with the scammer. Do not send "one more fee."
2. Call your bank using the number on your card and request a recall of the transfer. Ask what documents they need.
3. Report it. In the US, file at ic3.gov with full transaction details and at ReportFraud.ftc.gov; people 60 or older can call the DOJ Elder Justice Hotline at 1-833-FRAUD-11. In the UK, forward scam texts to 7726, emails to report@phishing.gov.uk, and report losses to Report Fraud (England and Wales) or Police Scotland, as GOV.UK explains.
4. Keep evidence: screenshots, phone numbers, profile names, wallet addresses, recordings and "proof of life" images.
5. Secure accounts if you clicked a link or installed something: change passwords from a clean device and turn on passkeys or two-factor authentication.
6. Warn your circle. Scammers often reuse the same story on other relatives or colleagues.

How to start today

Ten minutes now covers most of the risk:

• Agree on a family code word in person or by phone.
• Send the "hang up and call back" rule to your family group.
• Save a backup contact for each close relative.
• Set social accounts to private and review public videos with your voice.
• At work, confirm that new payees and bank changes require a callback and two approvers.
• Bookmark your bank's fraud line and your national reporting site.

AI is also the best tool for learning this material: ask an assistant to role-play a scam call so older relatives can practice saying "I'll call you back." For the wider picture on using these tools well, see our guide to responsible AI use. And if your team runs AI coding agents, Orkio keeps them on an isolated cloud box rather than on your own laptop.

Frequently asked questions