How to Protect Yourself from AI Scams

AI scams work because synthetic media removes the tells you were taught to trust: the voice on the phone, the face on the video, the polish of the email. In 2026 the FTC, FBI, and SEC all warn that scammers clone voices from short online clips, generate deepfake videos of officials and executives, mass-produce believable phishing, and wrap it all in fake AI investment schemes - with the FBI noting generative AI also corrects the spelling and grammar errors that used to give frauds away. This guide walks through the five scam families, the red flags, the verification steps that defeat them, and exactly where to report - every claim verified against the official FTC, FBI IC3, and SEC sources today. We cover the frontier of this problem in our news coverage of a rogue open-source agent and white-hat red-team breaches - the same tooling is being weaponized by scammers.

Before you start

• Print or bookmark the three reporting pages: ReportFraud.ftc.gov, www.ic3.gov, and sec.gov/tcr.
• Agree on a family code phrase - a word or short phrase no public post or voicemail contains.
• Update two settings: make your social media accounts private, and keep your financial apps on multi-factor authentication (MFA).
• Set a rule with yourself: any request for money or secrets over the phone, video, email, or DM gets verified through a channel you initiated before anything moves.

Step 1: Know the five AI scam families

All five are documented in official federal warnings - this is not speculative:

1. Voice cloning (family emergency scams). The FTC’s March 2023 alert explains it plainly: a short audio clip of your loved one - harvested from content posted online - plus a cloning program, and the scammer sounds exactly like them. The script is the classic grandparent fraud: “I’m in jail / a wreck / in trouble, send money fast, don’t tell anyone.”

2. Deepfakes (video and image impersonation). The FBI IC3 documents AI-generated videos of executives, law enforcement, and even senior FBI leaders - including, per the July 2026 PSA, AI-generated videos of a senior FBI official directing victims to a spoofed IC3 website. Deepfakes also power fake celebrity endorsements, fake charity appeals after disasters, and real-time video calls where the face is synthetic.

3. AI-generated phishing. The FBI warns generative AI removes the linguistic tells - scammers now mass-produce believable spear-phishing, romance-bait profiles, and even embed AI chatbots into fraudulent websites that walk victims toward malicious links or credential theft.

4. Fake AI tools, services, and “AI-washing” businesses. The FTC has sued companies that promised AI-driven riches they never delivered - the Air AI business-opportunity case and the “AI-powered Ecommerce Empire” scheme both cost consumers millions. Working as an onboarding mini-guide: if a business’s only product is its AI hype, treat it as hostile.

5. AI-powered investment fraud. The SEC’s joint alert with NASAA and FINRA is explicit: bad actors lean on the hype around AI and crypto to promote unregistered platforms, guaranteed returns, and pump-and-dump “AI company” stories - and use deepfake videos of CEOs and cloned voices to sell them.

Step 2: Spot the red flags

Synthetic media tells (FBI, IC3 PSA I-120324-PSA):

• Distorted hands or feet, unrealistic teeth, eyes, or irregular faces
• Unrealistic accessories - glasses or jewelry that don’t sit right; inaccurate shadows
• Video lag or watermarks; audio that doesn’t match the lip movements
• A voice with odd tone, word choice, or robotic pacing on a call that claims to be a loved one
• An unexpected “it’s me” call from a number you don’t recognize - spoofed caller ID is trivial

Pressure tells (FTC and SEC):

• Payment demanded via wire transfer, gift card (with the PIN), or cryptocurrency - all nearly impossible to reverse
• “Don’t tell anyone” and “act immediately” - the FTC calls urgency the scammer’s most powerful tool
• “Guaranteed returns with little or no risk” or “your money doubles” - the SEC lists these as classic signs of investment fraud
• An unregistered platform or unlicensed salesperson pushing an “AI” trading system
• A “government official” contacting you on WhatsApp, Telegram, or Facebook - the FBI confirms the real IC3 never works that way

Step 3: Verify before you act

The single verified counter-measure for every family in this guide:

1. Never trust the voice or the face on an unsolicited call. The FTC’s own words: “Don’t trust the voice. Call the person who supposedly contacted you and verify the story. Use a phone number you know is theirs.” Do not call back the number on your screen - scammers control it.
2. Use the secret code phrase. The FBI recommends a secret word or phrase with your family to verify identity. Ask for it. A real loved one knows it; a clone doesn’t.
3. Call your loved one through a different channel - a partner, sibling, or their voicemail on a saved number - if you can’t reach them directly.
4. For institutions: hang up and call the number on the back of your card, or type the official website yourself. Contact them directly using the information on their website - the SEC’s official advice for verifying any regulator communication. Independently search for contact information rather than clicking links or calling numbers in the suspicious message (SEC/NASAA/FINRA alert).
5. For official websites: type www.ic3.gov directly into the address bar; verify the URL ends in .gov; avoid sponsored search results, which the FBI says are usually paid imitators.
6. For videos of public figures promising investments or recovery: check the figure’s official account and official announcements; the SEC warned deepfake CEO videos are an active manipulation technique.
7. For investment platforms: check whether the firm is registered on your state or national securities regulator’s lists, and research the platform beyond the name - search the URL and screenshots, not just the brand (FBI guidance).

Step 4: Shrink what scammers can copy

Your voice and face are the raw material for cloning - the FBI’s advice is to limit the supply:

• Limit online content of your voice and image. Make social media accounts private, restrict followers to people you know, and think twice before posting clear-audio videos or voicemail-style clips that could be harvested.
• Review privacy settings on every platform that hosts your audio or video - closing off public noise is the cheapest defense.
• Hardening the accounts money moves through: enable MFA on banking and payment apps, and tell family that an unexpected money request triggers the code-phrase check regardless of channel.
• Avoid the amateur leak: answering unknown callers or responding to scam texts lets scammers record your voice and confirm your number is active - screenshots of “health” reads and clicks make you a hotter target.

Step 5: Report it to the right agency

You do not need to be sure, and you do not need to have lost money - all three agencies accept reports precisely because patterns connect cases:

• FTC (consumer scams - voice cloning, phishing, fake products): report at ReportFraud.ftc.gov. The FTC uses reports to open investigations and bring cases.
• FBI IC3 (cyber-enabled fraud - romance, investment, deepfake, recovery): file at www.ic3.gov with as much as you have - names, contacts, websites, emails, phone numbers, bank account or crypto wallet details, screenshots, and a description of how contact started (the FBI’s own reporting checklist). Victims aged 60+ can call the DOJ Elder Justice Hotline at 1-833-FRAUD-11 for filing help.
• SEC (investment fraud): report securities fraud to the SEC at sec.gov/tcr, to FINRA via its complaint form, or to your local state securities regulator - the contact list is on NASAA’s website.
• Your financial institution: always start here if money moved - call the number on your card before anything else, since transfer timing determines whether anything can be frozen or clawed back.

How to verify it worked

• Your family has an agreed code phrase, and everyone knows the ask-for-it rule
• You can list the three payment-method tells without looking (wire, gift cards, crypto)
• You can name at least three synthetic-media imperfections from the FBI’s list
• You know the correct move for an urgent “family emergency” call: hang up, call the saved number
• You know no government agency contacts individuals via WhatsApp, Telegram, or social media
• Your three reporting pages are bookmarked, and someone in your family knows where they are

Troubleshooting

You did it

• You know the five scam families and one real-world example of each
• You can spot synthetic-media imperfections and the three payment-method tells
• Your family has a code phrase and the hang-up-and-call-back rule in place
• Your social media accounts are private, and you think before posting clear audio or video
• You know exactly where each kind of report goes (FTC, IC3, SEC, your bank)
• You know the one thing no official organization ever does: contact you first and charge you to help
• You’ve shared this guide with the least-technical person you love - they’re the target, and now they’re the defense

Next: defense is easier when you understand the attacker - read our stories on the rogue open-source agent incident and white-hat red-team breaches to see how far AI tooling has come, then make sure your own setup follows security basics from our MCP safety guide if you run agentic tools.