AI Scams in 2026: Deepfakes & Voice Cloning

The most important change in online fraud is not that every scammer suddenly has a perfect digital double of every person. It is that convincing-looking material is becoming cheaper to create, easier to personalize, and faster to send. A fraudster can use software to draft a message in fluent language, generate a plausible profile photo, imitate a familiar voice, or prepare a fake video. These tools can remove warning signs that people were taught to look for, such as clumsy grammar or a visibly suspicious image.

That does not mean every scam is AI-generated, or that a convincing clip is automatically fake. It means that old assumptions are less safe: a familiar voice is not conclusive proof, a polished email does not prove a company sent it, and a video call does not by itself authorize a bank transfer. The underlying fraud is often familiar—impersonation, urgency, secrecy, and a request for money or access—with AI used to make the story more believable.

The FBI's public service announcement on criminals exploiting generative AI describes AI-generated text, images, audio, and video being used to support social engineering and financial fraud. Its examples include fabricated profiles, cloned voices, and synthetic videos of supposed officials or executives. The practical lesson is not to become an expert at spotting every manipulated pixel. It is to make important decisions using verification methods that do not depend on the media or contact details supplied by the person making the request.

This guide explains the scam patterns, who may be targeted, what warning signs still matter, and how to build a simple verification routine for family, work, and personal accounts. It also covers what to do in the first hour after a payment or account compromise. The advice is designed to be useful whether you have encountered an obvious fake text or a sophisticated call that sounded exactly like someone you know.

An AI-enabled scam is a deception that uses generative or automated systems to help create, customize, or deliver the lie. AI might generate the content directly, help a scammer translate it, or automate conversations at scale. It does not have to be a wholly autonomous scam. A person can use a voice-cloning app for one phone call or a language model to improve a phishing email and still be carrying out a conventional fraud.

Four kinds of generated media are especially relevant:

• Text: plausible emails, direct messages, support chats, invoices, job offers, and scripts for phone calls.
• Images: profile pictures, fake identification, product photos, screenshots, or fabricated evidence.
• Audio: voice imitation, altered recordings, or synthetic speech used in a call or voice note.
• Video: manipulated clips or real-time impersonation intended to make a person appear present.

These capabilities overlap. A scammer might first create a convincing social-media profile, then build a relationship through messages, send a voice note, and finally ask for a cryptocurrency transfer. Another might impersonate a manager over email, then use a brief video call to reinforce an urgent payment request. Treating each format as a separate problem misses the common structure: an unexpected contact is trying to get you to take a consequential action before you can verify the story.

AI is not required for any of these frauds. A stolen real photograph, an ordinary script, and a spoofed phone number can also deceive people. Conversely, a real person may use generated media for legitimate purposes. The technology alone does not tell you whether a request is trustworthy. What matters is the identity, context, requested action, and independent evidence.

The family emergency call

You receive a call from someone who sounds like your child, parent, partner, or sibling. They claim to be injured, arrested, stranded, or in immediate danger. A second person may take over, pretending to be a lawyer, police officer, doctor, or emergency worker. The caller says there is no time to call anyone else and asks for cash, a wire transfer, gift cards, cryptocurrency, or secrecy.

The emotional pressure is the mechanism. Panic narrows attention, and a familiar voice can make the story feel verified. A short recording from a public video or social account may be enough for a criminal to attempt voice imitation. The voice may sound accurate, somewhat inaccurate, or simply close enough to trigger a frightened reaction. The call may also involve a real emergency unrelated to the person being impersonated, so the safest response is not to dismiss the possibility of danger; it is to verify it through a second route.

If this happens, ask a question only the real person would know, but do not stop there. Hang up and call their number from your contacts, contact another family member, or call the institution the caller named using a number you find independently. Do not use a callback number or link provided by the caller. If there may be immediate physical danger, contact local emergency services through their published number.

The executive, supplier, or colleague on a video call

An employee receives a message from someone who appears to be a senior executive. The request may involve a confidential acquisition, an urgent vendor payment, payroll changes, or a transfer to a new account. A video call appears to confirm the instruction. A synthetic voice or video can add credibility, but the fraud can also use a real recording, a compromised account, or a different person pretending to be the executive.

This kind of scheme exploits both technology and workplace habits. People are trained to respond quickly to leadership, and they may believe that challenging a senior person's request is disrespectful. Attackers may gather names, reporting relationships, project terminology, and travel details from public profiles, company sites, or compromised email. The result can sound specific without being authentic.

The defense is a process that applies regardless of who appears to request the transaction. Payments, bank-detail changes, gift-card purchases, sensitive-data disclosures, and account recovery should require a second confirmation using a separate, trusted channel. A video call should not override financial controls. If a supplier changes bank details, verify through a previously stored phone number, not the contact details in the change request.

The trusted friend or relative in a messaging app

Your friend sends a voice message that sounds like them, or their account suddenly asks you for a loan. They may claim their phone is broken, ask for a one-time login code, or direct you to a payment link. Sometimes the account has actually been taken over; sometimes the criminal is using a lookalike account and generated media.

Do not treat familiarity with the voice, profile photo, writing style, or private facts as proof. Those details can be copied, inferred from public information, or obtained from a compromised account. Start a new conversation using a different channel or call a number you already had saved. Never forward a verification code: legitimate support staff should not ask you to disclose a code that grants access to your account.

The romance or investment opportunity

A stranger makes contact through social media, a dating app, or a messaging service. Their photos and video calls seem convincing, and the relationship develops quickly. Eventually they introduce an investment opportunity, a trading platform, a business deal, or a financial emergency. The initial small deposit may appear to grow on a polished website. When you try to withdraw, the site demands more money for taxes, fees, or account unlocking.

AI can help create profiles, hold conversations, translate messages, and produce plausible supporting media. But romance and investment fraud existed long before current AI tools. The enduring warning signs are a relationship that moves quickly off-platform, a person who cannot meet or be independently verified, pressure to keep the relationship secret, guaranteed returns, and requests to send funds to a wallet or account the other person controls.

Never invest based only on someone you met online, even if you have spoken by video. Research the company through independent regulatory and financial sources, and ask a trusted person who is not part of the relationship to review the decision. Our guide to spotting AI-generated content can explain the limits of visual detection; it should not be used as a substitute for due diligence.

Fake recruiters and work-from-home jobs

An unsolicited recruiter offers flexible remote work with excellent pay and little experience required. The interview may happen entirely through chat. The employer sends a check to buy equipment, asks you to pay for training, requests identity documents before a genuine hiring process, or tells you to deposit cryptocurrency to unlock tasks or commissions.

AI can make fake job descriptions and recruiter conversations more polished, but the financial mechanics are familiar. A real employer does not require you to pay cryptocurrency to receive wages. A check can appear in your account before the bank discovers it is fraudulent; sending part of it onward can leave you responsible for the loss. Verify a vacancy on the company's independently located careers site, contact the company through a published channel, and do not send money to get a job.

The FBI has separately warned about fake work-from-home “optimization” jobs that require victims to send cryptocurrency to unlock tasks or earnings. Its job-scam advisory provides specific warning signs. Even when a recruiter uses AI, the core test is still useful: why is a supposed employer asking the applicant to fund the employer's operation?

Customer-support and account-recovery impersonation

A fake support agent contacts you about suspicious activity, or a search ad leads you to a fraudulent support number. The person may know your name, recent purchase, or part of your account details. They ask you to install remote-access software, read out a login code, move money to a “safe” account, or share your screen.

The details may come from a data breach, a public post, or a previous conversation; accurate personal information does not authenticate the caller. End the conversation and open the official app or type the service's known address yourself. Use the support options listed there. Do not install software or move funds because a person who contacted you says your account is at risk.

Fake public figures, charities, and breaking-news appeals

Generated images and video can be used to make a public figure appear to endorse an investment, giveaway, or product. Fraudulent charity appeals may reuse real disaster footage or add synthetic images to create urgency. A fast-moving event is an ideal environment for people to share unverified material.

Check an endorsement on the public figure's or organization's official channel, and look for independent reporting. For donations, navigate to the charity's official website yourself and confirm its registration through a reputable charity evaluator or regulator. Do not assume that a familiar face in an advertisement has reviewed or approved the offer.

Fake invoices, payment details, and “safe account” instructions

Business email compromise does not require a deepfake. A criminal may compromise a real inbox, imitate a supplier's domain, or insert themselves into an existing email thread. AI can help write fluent messages and use context to make a payment change appear routine. A caller may then claim that your bank account is under attack and instruct you to transfer funds somewhere “safe.”

Banks and law enforcement do not need you to transfer your savings to a private account for safekeeping. Confirm any change to payment details through a contact method already on file. For high-value transfers, require two people to approve the transaction and compare the account information with a trusted record. A polished invoice is still only a request for payment—not proof that the recipient is correct.

Extortion using fabricated intimate images or video

Someone claims to possess intimate images of you and threatens to publish them unless you pay. The material may be real, manipulated, or entirely fabricated. A scammer may combine a real photo from a public profile with generated or altered content to make the threat feel credible.

Do not pay simply because the sender claims to have compromising material. Preserve the messages and account identifiers, avoid engaging further, and report the account to the platform and appropriate authorities. If the material involves a minor, do not download, copy, or forward it; seek help from a trusted adult and the relevant child-protection reporting service. Victims deserve support, not blame. The existence of an image does not establish that it is authentic or that the recipient has the ability they claim.

The recovery scam after the first loss

After someone loses money, a second person may appear claiming to be a government investigator, cryptocurrency specialist, lawyer, or recovery agent. They may know about the original incident because victims posted publicly or filed a complaint. They promise to retrieve funds for an upfront fee, tax, or “blockchain release” payment.

This is often a second attempt to exploit the same person. No stranger can guarantee the recovery of cryptocurrency or a wire transfer. Do not pay a recovery fee or share passwords, seed phrases, remote access, or identity documents. Contact your financial institution and official reporting agencies directly using contact details you locate independently.

People naturally treat familiar sensory cues as evidence. A face, voice, or live conversation feels more direct than an email, and a scammer knows that. Yet voice and video can be copied, altered, replayed, or taken from a context unrelated to the current request. A caller ID can also be spoofed, and a legitimate social account can be compromised.

At the same time, looking for strange blinking, distorted hands, bad lip synchronization, or robotic speech is unreliable. Video compression, weak connections, camera quality, accents, disability, fatigue, and ordinary lighting can create unusual artifacts. Better synthetic systems may avoid many familiar flaws. A human observer can miss a forgery or falsely accuse a real person. Automated detectors also make mistakes and may not apply to a clip that has been edited, compressed, or passed through another platform.

Use visual and audio clues as reasons to slow down, not as a verdict. The question is not “Can I prove this clip is fake?” but “Can I verify the request independently before acting?” If the answer is no, do not send money, change account details, reveal a code, or disclose sensitive information.

Build one routine and use it when the request is consequential, whether or not AI is involved.

1. Pause the action

Urgency is a tactic. “Do it in the next five minutes,” “do not tell anyone,” “stay on the line,” and “the bank will freeze your account” are all reasons to stop and verify. A legitimate emergency may require speed, but a short pause to confirm identity is safer than an irreversible payment to a stranger.

Say: “I never approve money or account changes during an unexpected call. I will call back using the number I already have.” You do not need to persuade the other person or expose your verification steps. If they become angry or insist that verification is forbidden, end the interaction.

2. Use contact information you already trust

Hang up and call the person using a number in your contacts, on an official card, or from a trusted organization website you navigate to yourself. Do not use a number, link, or QR code supplied in the suspicious message. For a workplace request, use the company directory or internal system, not a number written in the email.

If you cannot reach the person, contact another trusted person or wait. A real request can be checked again. A scammer benefits from keeping you inside a channel they control.

3. Switch channels

If the request arrived by email, confirm by phone or in person. If it arrived in a chat app, call a previously known number. If someone called you, use the official app or a number from a card. Changing channels reduces the chance that the same attacker controls both the request and its supposed confirmation.

Do not switch to a number that the caller provides during the conversation. That merely moves the conversation to another channel chosen by the same person.

4. Ask for a separate confirmation

For family emergencies, contact another relative. For a workplace transfer, require a second approver. For a bank alert, check directly in the bank's official application. For a new supplier account, call the supplier through a previously verified number and ask them to confirm the change.

The confirmation should not depend on the same device, email thread, or account that may already be compromised. A second person who is also receiving instructions from the same attacker is not independent confirmation.

5. Verify the requested action, not only the identity

Even a real person can have a compromised account or be mistaken. Confirm exactly what should happen: amount, recipient, account number, deadline, and purpose. Compare it with existing records. If anything changed, ask why through the independent channel. Do not rely on “it is me” as the only check.

For a payment, read back the recipient and amount. For account recovery, confirm which account is being changed and through the provider's official recovery process. For sharing data, verify that the recipient is authorized to receive it and that the channel is approved.

6. Use a pre-agreed pause phrase

Families and teams can agree on a phrase such as “I will verify and call back.” This phrase is not a secret code that proves identity; it is a simple rule that stops pressure from taking over. Anyone who receives a request can use it without feeling they need a special technical skill.

A separate family passphrase can provide another check, particularly for urgent situations. Choose one that is not a pet's name, birthday, or something visible online. Do not store it in a shared chat or send it in response to an unexpected message. If the phrase is disclosed or the relevant account is compromised, replace it. Never rely on a passphrase alone for a large transfer.

Security habits work when people can remember and use them under stress. A family plan should be simple enough for children, older relatives, and someone who is not comfortable with technology.

1. Agree on the callback rule. Unexpected requests for money or account access always get verified by calling a saved number or another trusted person.
2. Choose a private phrase if it helps. Share it verbally with the people who need it, and agree not to send it by text.
3. Pick a backup contact. Decide who to call if the person supposedly in trouble cannot be reached.
4. Make a no-secrecy rule for urgent money. Nobody should be punished for checking an alarming story with another family member.
5. Review social privacy. Limit public details about family relationships, travel, birthdays, and children's schools. Public information can help personalize a scam, but you do not need to erase your online life.
6. Practice once. Talk through a pretend “I need money right now” call so everyone knows the first move is to pause and call back.

Do not turn this into a reason to distrust every loved one or avoid all voice calls. The goal is a calm fallback that protects everyone from pressure, including pressure that comes from real account compromise or ordinary human misunderstanding.

You cannot prevent someone from recording content that is already public, and privacy settings cannot guarantee that images or audio will never be copied. You can still reduce unnecessary exposure.

• Review who can see your posts, friends list, voice notes, and profile details.
• Remove public information that is not needed, such as personal phone numbers, home addresses, travel dates, and routine schedules.
• Avoid posting a public video of a family member announcing their name, relationship, school, and upcoming absence all at once.
• Ask friends and relatives not to post other people's private details without consent.
• Use separate email addresses or phone numbers for public listings and sensitive accounts where practical.
• Limit apps' access to your microphone, contacts, and photo library to what they need.
• Be cautious about uploading private voice recordings, identity documents, and family photos to unfamiliar AI services.

This is risk reduction, not a promise that criminals cannot find or create material. The FBI recommends limiting public image and voice content as one protective step, but verification remains necessary even for people with little online presence. Details can be obtained from data breaches, public records, other people's posts, or a compromised account.

For more foundational privacy steps, see our guides to protecting privacy online and what AI services may do with information you share.

Many impersonation scams become more damaging when an attacker can also access the victim's email, messaging, or financial accounts. Account security reduces the chance that a scammer can message your contacts as you, intercept recovery links, or view private material.

Use unique passwords and a password manager

A unique password for every important account limits damage if one service is breached. A password manager can create and store long random passwords without requiring you to memorize each one. Secure the manager itself with a strong primary password and multifactor authentication.

Prioritize your primary email, mobile carrier, password manager, financial accounts, and social accounts. Email is especially important because it often controls password resets for other services. If you need a starting point, read our guide to strong passwords and password manager comparison.

Turn on multifactor authentication or passkeys

Multifactor authentication (MFA) makes a stolen password less useful. Passkeys and hardware security keys can provide strong phishing resistance when supported. If a service only offers other MFA methods, enable the strongest practical option and keep recovery codes somewhere secure and offline.

Never read a one-time sign-in code to someone who called you. A criminal may already know your password and be trying to complete a login while persuading you to approve it. If an authentication prompt appears unexpectedly, deny it and change your password from the official service.

Add protection to your phone number

Ask your mobile carrier what account PIN, port-out lock, or SIM-swap protection it offers. Secure the carrier account with a unique password and MFA if available. This does not stop every attack, but it can make unauthorized number transfers harder.

For accounts that support it, consider an authenticator app, passkey, or hardware key instead of text-message codes. If your phone suddenly loses service unexpectedly, contact your carrier through a known number and check for unauthorized account changes.

Keep devices and recovery options current

Install operating-system and browser updates, use a screen lock, and remove apps you no longer need. Confirm that account recovery email addresses and phone numbers still belong to you. Store backup codes securely; do not keep them as an unprotected screenshot or in a public cloud folder.

Do not install remote-access software at the direction of an unsolicited caller. If you need technical support, find the vendor's official support channel yourself and ask what access is actually necessary.

You do not need to determine whether AI was used. Take the following steps based on the behavior:

• Do not click links, open attachments, scan QR codes, or install software from the message.
• Do not send money, cryptocurrency, gift cards, identity documents, passwords, seed phrases, or login codes.
• Save the message, caller details, account name, and time if doing so is safe.
• Report and block the account using the platform's built-in tools.
• If it claims to be a company or government service, contact that organization through a published channel.
• Tell the real person being impersonated using a trusted contact method.
• Warn close contacts if your own account may be compromised, but do not repost harmful material.

A suspicious message can also be reported to the email, messaging, or social platform that carried it. Reporting helps those services identify repeated behavior, although a report does not guarantee immediate removal or recovery of money.

Act quickly, but do not panic or blame yourself. Scams are designed to create pressure and exploit normal trust. The first priority is limiting further loss.

Contact the payment provider immediately

Call the bank, card issuer, wire-transfer company, payment app, cryptocurrency exchange, or gift-card issuer using a number from its official app, card, or website. Explain that the transfer may be fraudulent and ask whether it can be stopped, recalled, reversed, or flagged. Provide the transaction time, amount, recipient details, and reference number.

Payment methods have different recovery options and deadlines. Card transactions may have dispute procedures; a wire transfer may be difficult to reverse once collected; cryptocurrency transactions are generally not reversible through a central authority. Still contact the provider promptly. Do not assume it is too late, and do not wait for a recovery agent to appear.

Secure accounts from a trusted device

If you shared a password or code, change the password on the affected service and any other service where it was reused. Start from the service's official website or app, not a link in the suspicious message. Sign out other sessions, review recent account activity, remove unknown recovery methods, and enable MFA or a passkey.

If your email account was involved, secure it first because it may control other password resets. If you installed remote-access software, disconnect the device from the network and contact a reputable support professional using a channel you locate independently. Do not continue using a potentially monitored device for banking until it has been checked.

Preserve evidence and report the incident

Keep original messages, email headers if available, phone numbers, usernames, URLs, transaction receipts, wallet addresses, and a timeline of what happened. Do not edit the evidence or delete the conversation before recording the necessary details. Avoid sharing intimate or illegal material while trying to prove what happened.

Report the fraud to local law enforcement or the national reporting service where you live. In the United States, the FBI's Internet Crime Complaint Center (IC3) accepts reports at ic3.gov; include transaction details and contact information when available. The FTC's consumer resources explain how to report fraud and identity theft. If identity documents or tax information were exposed, check the relevant government identity-theft process and credit-protection options for your location.

Watch for follow-up targeting

After a loss, criminals may contact you again claiming they can recover funds, investigate the original fraud, or protect your account. Treat unsolicited recovery offers as suspicious. Never pay upfront for a guaranteed recovery, disclose a wallet seed phrase, or grant remote access. A person who knows about your case is not necessarily an official investigator.

Get support

Victims may feel embarrassed, frightened, or responsible. Fraud can affect anyone, and sophisticated impersonation is intended to bypass careful judgment. Tell a trusted person, especially if the scammer is threatening you or urging secrecy. If you are at risk of self-harm or immediate physical danger, contact local emergency or crisis support.

Organizations need controls that work even when a convincing voice, real account, or deepfake video is involved. A policy that says “watch for AI” is too vague. Put verification into the workflow.

Require dual approval for high-impact actions

Use two authorized people for large or unusual transfers, changes to supplier bank details, payroll updates, sensitive data exports, and privileged account recovery. Set thresholds based on the organization's finances and risk. A second approval should be genuinely independent, not a rubber stamp added to the same call.

Separate request and confirmation channels

If a payment change arrives by email, confirmation should happen through a previously stored number or authenticated supplier portal. Do not use the phone number in the change request. For requests from an executive, contact them using the internal directory or confirm through another known colleague.

Treat authentication and payment changes as high risk

Help-desk staff should not reset MFA or change recovery details solely because a caller sounds familiar or appears on video. Use documented identity checks and escalation procedures. Train staff that a senior title does not exempt a request from controls.

Limit access and monitor unusual activity

Give employees only the accounts and data they need. Use MFA for email, finance, cloud administration, and remote access. Alert on unusual sign-ins, forwarding rules, new payment recipients, and changes to account recovery. Keep a current incident contact list in a location employees can reach if normal systems are unavailable.

Rehearse a low-drama response

Run short exercises: a supposed executive asks for a wire, a vendor changes their account, or an employee receives a fake support call. Reward people for pausing and verifying rather than shaming them for raising a concern. Make reporting quick, private, and non-punitive so staff do not hide mistakes.

Set boundaries for AI tools at work

Tell employees which tools are approved, what information may be entered, and how AI-generated output must be reviewed. Do not upload customer records or internal call recordings to a consumer tool without authorization. For synthetic media used in legitimate training or marketing, label it clearly and obtain permission from people whose likeness or voice is used.

If you want a concrete starting point, work through this list today:

1. Five minutes: Tell family or teammates that urgent payment and login requests always get a callback through a known channel.
2. Five minutes: Add unique passwords and MFA to your primary email and password manager.
3. Five minutes: Check whether your bank, payment apps, and mobile carrier offer MFA, transaction alerts, transfer limits, or account locks.
4. Five minutes: Review who can see your social profile, friends list, phone number, and family photos.
5. Five minutes: Save official contact numbers for your bank, carrier, and key family members in a place you can reach when stressed.
6. Five minutes: Decide who you will call and what evidence you will preserve if a scam succeeds.

This is not a complete security program. It is a small set of safeguards that break common attacker advantages: urgency, compromised contact channels, weak account security, and irreversible payments.

Do not trust every “AI detector”

A detector may offer a probability or confidence score, but it cannot establish who sent a message or whether the request is legitimate. The tool may have been trained on a different kind of media or fail after compression and editing. Do not upload sensitive family recordings or private images to an unknown detection website in search of certainty.

Do not assume bad grammar is the main warning sign

Generated text can be fluent, and criminals can ask a model to imitate a company's style. Conversely, a real person may write awkwardly or make mistakes. Focus on the request, payment path, urgency, secrecy, and verification—not punctuation.

Do not rely on a public fact as an identity check

A scammer may know a relative's birthday, employer, address, or recent trip. Such facts can be exposed through social media, public records, or data breaches. Ask a question whose answer is not posted online if useful, but still call back through a known channel.

Do not confront a suspected criminal with sensitive details

Trying to trap a scammer may reveal what you know, prolong contact, or expose more information. Preserve evidence, stop engaging, and report. If you need to warn others, do so without forwarding a suspicious link or redistributing private media.

Do not let fear drive a rushed decision

Threats that demand secrecy, immediate payment, or total compliance are designed to prevent reflection. A genuine organization can explain its process and allow you to contact it independently. If a person says that any verification will make the situation worse, treat that as a warning sign.

Generative tools will continue to improve, and defensive tools will improve as well. Platforms may add provenance labels, stronger identity verification, or ways to trace where media came from. Organizations may adopt cryptographic signatures for important communications. These measures can help, but none will be universal: labels can be absent, content can be copied, and identity systems can be misused.

That is why everyday verification should not depend on judging the media. Provenance can help answer where a file came from, but it does not necessarily prove that the person making a request is authorized to make it. A real employee's account can be compromised; a signed message can still contain a mistaken instruction. For consequential decisions, verify identity and intent through a trusted channel and follow the normal approval process.

The same principle applies to personal life. You do not need to suspect every call or stop sharing ordinary photos. Keep useful connections, but separate recognition from authentication. Hearing someone's voice may make a request feel familiar; it should not replace checking before you send a large amount of money, change a password, or reveal private information.

AI can make impersonation more polished, personal, and scalable. It can also make legitimate communication easier and more accessible. The safest response is not fear of all synthetic media, nor faith that a detector will catch every fake. It is a small set of habits applied consistently: slow down under pressure, use contact details you already trust, confirm high-impact requests through a second channel, protect accounts with strong authentication, and contact payment providers quickly if money moves.

Make those habits normal before an urgent call arrives. A family callback rule, a second approval for business payments, and a password manager are simple controls—but they remove the isolation and haste that many scams depend on.

• FBI Internet Crime Complaint Center: Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud
• FBI Internet Crime Complaint Center: Work-From-Home Scams
• Federal Trade Commission: Scammers Use AI to Enhance Their Family Emergency Schemes
• Federal Trade Commission: Report Fraud
• CISA: Use Strong Passwords
• FBI Internet Crime Complaint Center