Spotting fakes and AI scams

In Trust and limits you learned that AI sounds equally confident when it is right and when it is wrong. This lesson is the flip side: people using AI on purpose to fool you. The good news is that the defenses are simple, they cost nothing, and most of them are habits your grandparents would recognize.

A quick definition first. A deepfake is a photo, video, or audio clip made or altered by AI to show someone saying or doing something they never did. A scam is any trick meant to get your money or your information. AI did not invent scams. It made the old ones cheaper, faster, and more convincing.

The cloned voice on the phone

The classic version goes like this. The phone rings. It sounds exactly like your grandson, or your daughter, or your boss. They are scared or rushed. There has been an accident, an arrest, a deal that falls apart by noon. They need money right now, and please do not tell anyone.

Voice cloning means using AI to copy how a specific person sounds from a recording of them talking. Recordings people post online are the raw material. The FBI's Internet Crime Complaint Center warned in December 2024 that criminals use cloned audio to impersonate a close relative in a crisis and ask for immediate financial help or a ransom.

The defense that works best is old-fashioned: a family safe word. Pick a word or phrase with the people you would actually send money to. Do not post it, do not text it around, just say it out loud at the dinner table. If a call ever comes in asking for money, ask for the word. A real family member knows it. A cloned voice does not, because the scammer does not. The FBI lists this exact tip first: create a secret word or phrase with your family to verify their identity.

The second defense is the callback. Hang up and call the person on the number you already have saved, not the number that called you. The Federal Trade Commission's advice on family emergency calls is short and worth memorizing: don't trust the voice, call the person and verify the story. If you cannot reach them, try another family member or a friend of theirs.

The same move works at work. If a "boss" calls or texts asking for a wire transfer, gift cards, or a change to where payroll goes, call them back on the office number you already know. A real boss will not mind. A scammer will suddenly have somewhere else to be.

Fake photos and video, and the tells that are fading

You may have heard the old advice: look at the hands, AI can never get fingers right. That was true for a while. If you read How AI builds images, you know these models start from noise and refine toward a picture, and each new generation of models gets better at the details that used to give them away.

The FBI still lists visual tells worth a glance: distorted hands or feet, unrealistic teeth or eyes, odd faces, jewelry or glasses that do not look right, wrong shadows, and stiff or unnatural movement in video. Those checks are still worth doing. They catch the lazy fakes.

The catch is what happens when they find nothing. A clean image does not prove a real one. The better fakes pass every visual test, and they are the ones aimed at you on purpose. So treat visual tells as a bonus. If you spot one, great. If you do not, you have learned nothing yet, and you move on to the checks below.

The checks that still work

Here is the pattern behind every good check: instead of staring harder at the message, step outside it. Four habits cover almost everything.

• Slow down when urgency and money show up together. Deadlines, secrecy, and an odd payment method are the signature of a scam. The FTC calls out requests to wire money, send cryptocurrency, or buy gift cards and read off the numbers. No real emergency requires gift card codes.
• Call back on a number you already know. Not the one in the message, not the one on the caller ID. The one in your contacts, on your bank card, or on the company's real website.
• Check the source. Who posted this first? A local news outlet, a city account, or a page created last week? A dramatic photo with no trustworthy source behind it is a rumor until proven otherwise.
• Run a reverse image search. This means giving a search engine the picture itself instead of words, and asking where else it has appeared. Many phone search apps can do it from a screenshot. An "event from this morning" that shows up in posts from years ago is not from this morning.

Try each scenario below. Notice which checks actually settle the question.

Labels and watermarks: helpful, not a lie detector

The tech industry is building ways to label AI content at the source. Two names you may see:

Content Credentials come from a standard called C2PA, short for the Coalition for Content Provenance and Authenticity. Provenance just means where something came from and what happened to it along the way. C2PA describes Content Credentials as like a nutrition label for digital content: a record attached to a file that can show which camera or app made it and what edits were applied.

Two limits matter. First, the label can be stripped. C2PA's own explainer answers the question "can it be removed?" with "Yes it can," and C2PA's guidance notes that many platforms drop this kind of file data when a picture is shared. So a missing label means nothing either way. Second, C2PA itself says provenance information alone cannot tell you whether the content is true, accurate, or factual. A label tells you where a file came from, not whether the claim in the caption is honest.

SynthID is Google DeepMind's watermark, an invisible mark baked into content as it is made, for images, video, audio, and text from Google's AI tools. As of October 2026, Google says you can upload a file to the Gemini app and ask whether it was created or altered by Google AI, and a separate SynthID Detector portal is being tested with journalists and media professionals. The limit is in the name: it recognizes Google's own watermark. A fake made with a different company's tool will not carry it, so "no SynthID found" does not mean "real."

Both are useful extra signals when present. Neither replaces the callback.

Fake reviews and phishing without the typos

Two quieter changes are worth knowing.

Reviews. AI can write a hundred believable, different-sounding reviews in a minute. In August 2024 the FTC finalized a rule banning fake reviews and testimonials, and it names AI-generated fake reviews specifically. A rule does not make them disappear, though. When you are choosing a tint shop in St. George or a rental in Hurricane, read the middle-rated reviews, look for specific details only a real customer would mention, and be wary of a burst of glowing reviews that all arrived the same week.

Phishing is a message pretending to be from someone you trust, like your bank, a delivery company, or your email provider, trying to get you to click a link or hand over a password. For years the advice was to watch for bad spelling. The FBI notes that criminals now use AI to translate and clean up their messages so the grammar and spelling errors disappear. A polished email is no longer a sign of a safe one. The checks that still work are the same ones from above: do not click the link, go to the real website or app yourself, and call back on a number you already know.

Two more FBI tips round this out. Never send money, gift cards, or crypto to someone you have met only online or by phone. And consider making social media accounts private, since public videos are the raw material for voice and face copies.

Try this yourself

Pull up a suspicious text or email you have actually received, or one from your spam folder. Remove any real account numbers or names. Paste it into the chat app you already use with this prompt:

Here is a message I received. Do not tell me whether it is safe. Instead:
1. List every urgency cue (deadlines, threats, secrecy).
2. List every request for money, codes, passwords, or clicks.
3. Tell me how the sender could be verified through a different channel.

[paste the message here]

Then notice two things. First, how clean the writing probably is. Second, that every useful answer points you outside the message, back to a number or website you already trust. The AI is good at naming the pressure tactics. It cannot confirm who really sent it, and neither can you by reading it.

One more thing to do tonight, no app required: pick your family safe word. Say it out loud with the people who matter, and do not write it anywhere a scammer could find it.

Fakes will keep getting better, and that is fine, because your defenses do not depend on spotting them. Slow down when urgency meets money. Ask for the safe word. Call back on a number you already know. Check where a picture came from before you share it. Do those four things and a perfect fake still fails.