Deepfakes and AI scams: how to spot them and protect yourself

The most common scams

The relative’s voice. A call with a voice identical to a child’s or parent’s: “I’ve had an accident, I need a transfer now, don’t tell anyone”. The voice was cloned from videos posted on social media.

The fake executive. A video call or voice note from the “CEO” asking for an urgent, confidential payment to a new supplier. Cases with losses in the millions have been documented, even with several fake “colleagues” in the same video call.

The famous face recommending an investment. Videos of celebrities, journalists or entrepreneurs promoting “guaranteed” trading platforms. They’re deepfakes: no serious person promises safe returns.

Perfectly written phishing. Error-free emails and messages, personalised with information found online, imitating banks, suppliers, tax authorities.

Fake tech support and fake recruiters. Chats and calls that seem human, run by AI agents, to obtain access or data.

Signals to notice

The technology keeps improving: unblinking eyes and deformed hands are increasingly rare. Context matters more:

• urgency (“now”, “within the hour”);
• secrecy (“don’t tell anyone”, “don’t use the usual channels”);
• unusual channel (a new number, WhatsApp instead of company email);
• money or credentials (transfers, crypto, gift cards, one-time codes);
• strong emotion (fear, rush, excitement about a gain).

If two of these signals are present, stop.

Defences that work

For everyone

1. Call back on a number you already know, not the one that contacted you.
2. Family code word: an agreed word to ask for in urgent requests.
3. Ask a personal question only the real person could answer.
4. Never share one-time codes, passwords or PINs, for any reason.
5. Limit public audio of your voice and your family’s when not needed.

For professionals and companies

1. Dual approval for new, urgent payments or changed bank details.
2. Bank-detail changes verified by calling a known supplier contact.
3. A written procedure everyone knows: “nobody, not even the owner, asks for urgent payments on a video call”.
4. Regular training with real examples (also part of the AI literacy the AI Act requires).
5. Two-factor authentication on email, banking and business software.

What about deepfake detectors?

There are tools that estimate whether audio or video is synthetic, and from 2 December 2026 the AI Act requires generator providers to mark content in a machine-readable way. Useful, but not enough: scammers use tools that ignore the rules, and detectors can be wrong. The best defence remains procedural and human.

In practice

• Agree a code word with your family today.
• At work, write the rule on urgent payments in one line and share it.
• Facing urgency + money + unusual channel: stop, call back, verify.

Sources

• Financial Times — The rise of deepfakes and how to stop them
• Google DeepMind — From deepfakes to DNA, the science of watermarking AI
• IBM Technology — AI ATTACKS! How Hackers Weaponize AI
• Italian Postal Police — advice and reports

Informational content, current as of the date shown. Prices, models and rules change often: always check official sources. Written with the support of AI tools and reviewed by the author.