AI Deepfake Scams: Spot Fake Voices and Video Calls

AI deepfake scams use generated voices, faces and video to impersonate someone you trust: a boss asking for an urgent transfer, a relative calling from a “new number”, a supplier on a video call confirming changed bank details. The technology has become cheap enough that a few seconds of public audio can be enough to imitate a voice convincingly. The good news is that the defence does not depend on spotting pixels. It depends on a few habits and one simple rule: verify through a channel you already trust.

This guide explains how AI deepfake scams work, the warning signs that still help, the verification routines that actually stop them, and what a small business or family can put in place this week.

How AI deepfake scams work

Most deepfake fraud is old social engineering with a new costume. The scammer still needs urgency, authority and a reason to skip the usual checks. What has changed is the costume: instead of a badly written email, you may hear a familiar voice or see a familiar face.

The common patterns

The “CEO” call. A finance employee receives a call or voice message that sounds like a senior manager, asking for an urgent, confidential payment, often just before a weekend or holiday.
The fake video meeting. A video call with several participants who look and sound like colleagues. In early 2024, police in Hong Kong publicly described a case in which an employee transferred a large sum after such a call, where the other participants turned out to be fakes.
The family emergency. A parent hears a child’s voice saying they are in trouble and need money now, followed by a “lawyer” or “police officer” who gives payment instructions.
The changed bank details. A supplier’s account manager calls to confirm that invoices should now go to a new account, backing up a fake email that arrived earlier.
The fake celebrity endorsement. A video of a well-known person recommending an investment platform, shared as an advert or a social post.
Recruitment and identity fraud. Fake job candidates in video interviews, or faces used to pass online identity checks.

Where the raw material comes from

Voices come from podcasts, webinars, social videos, conference talks and even voicemail greetings. Faces come from profile photos and video. Organisational details, such as who approves payments and which supplier you use, come from company websites, social profiles and previously leaked emails. The overview of deepfakes describes the techniques in more detail.

Warning signs that still help

Detection by eye and ear is getting harder, and you should not rely on it alone. Still, some signs remain useful, mostly because they belong to the scam rather than the technology.

Signs in the situation

Urgency and secrecy together. “This must happen today, and do not tell anyone yet” is the strongest single signal.
A request to bypass the normal process, such as paying without a purchase order or a second approval.
A new channel. A new phone number, a personal messaging account, a meeting link from an unfamiliar domain.
Payment methods that are hard to reverse: crypto, gift cards, instant transfers to a new account.
Pressure when you hesitate. A real colleague accepts “I will call you back on your usual number”. A scammer pushes.

Signs in audio

Flat emotion or odd emphasis, especially when the person is supposedly upset.
Unnatural pauses before answers, as if each reply is being generated.
Avoiding open questions, or steering the conversation back to the request.
Background sound that does not fit the claimed situation.

Signs in video

Faces that blur or warp at the edges, especially when the head turns or a hand passes in front.
Lip movements slightly out of sync with speech.
Strange lighting or reflections in glasses, and unnatural blinking.
Participants who keep cameras “broken” or refuse simple requests like turning their head.

Treat these as reasons to verify, never as proof either way. A good fake can show none of them, and a real call over a bad connection can show several.

The one rule that beats AI deepfake scams

Verify the request through a channel you already had before the request arrived.

If the “CEO” calls asking for a payment, hang up and call the CEO on the number in your company directory. If a supplier’s “account manager” confirms new bank details, call the supplier using the number from your existing contract or previous invoices, not the one in the new email. If a relative calls from an unknown number in distress, call their usual number or another family member.

This works because the scammer controls the incoming channel, but not your existing ones. It does not require any technical skill, and it works no matter how good the fake is.

Add a shared secret for the riskiest situations

Families and small teams can agree on a code word or a question that would never appear online. “What did we have for dinner on your birthday?” is useless to a scammer who has only scraped social media. Keep it offline and change it if it might have been shared.

Verification methods compared

Here is how common defences compare against AI deepfake scams. None is perfect alone; the strongest setups combine several.

Defence	Stops voice clones	Stops fake video calls	Effort	Weakness
Call back on a known number	Yes	Yes	Low	Only works if people actually do it under pressure
Family or team code word	Yes	Yes	Low	Can leak if written down or reused
Two-person approval for payments	Yes	Yes	Medium	Both people can be targeted in one fake meeting
Fixed process for changing bank details	Yes	Yes	Medium	Must be followed every time, without exceptions
Spotting artefacts by eye and ear	Sometimes	Sometimes	Low	Gets less reliable as tools improve
Automated deepfake detection tools	Sometimes	Sometimes	Medium to high	Can miss new techniques and flag real people
Content provenance labels	—	—	None for the receiver	Scammers do not label their fakes

A protection plan for small businesses

Most losses from AI deepfake scams hit finance and administration teams. A one-page policy, practised once, prevents most of them.

Write down the payment rules. Which payments need two approvals, who can approve, and the statement that no instruction by phone, video or chat can override the rules.
Lock the bank-details process. Any change to a supplier’s bank account is confirmed by calling a number from existing records, and is recorded with who checked and when.
Give staff explicit permission to say no. Make it clear, in writing, that nobody will be blamed for delaying an urgent request to verify it, including requests that seem to come from the owner.
Reduce what is public. Consider whether every manager’s direct number, voice recordings and the names of finance staff need to be on the website.
Run a short training session. Play examples, explain the call-back rule and practise it once with a friendly test.
Agree how to report. One clear contact for suspected fraud, and a habit of reporting attempts even when nobody fell for them.

If you already have an internal policy for AI tools, add this as a section. Our guide on writing a company AI use policy gives a structure you can extend.

What to do if you think you were targeted

Stop and verify using a known channel before doing anything else.
If money was sent, call your bank immediately. Speed matters for any chance of stopping or recalling a transfer.
Keep the evidence: call logs, numbers, recordings, emails, meeting links and chat messages.
Report it to the police and, for businesses, to your national cybersecurity or fraud reporting service. The EU cybersecurity agency ENISA publishes guidance and links to national contacts.
Warn the person who was impersonated, so they can alert their own contacts.
Review what made it convincing and fix that gap in your process.

What the law says about deepfakes in the EU

The EU AI Act includes transparency obligations for AI-generated or manipulated content. In broad terms, people who deploy systems to create deepfakes are expected to disclose that the content is artificial, and providers of generative systems must mark their output in a machine-readable way. The official text is in Article 50 of the AI Act, and our plain-language EU AI Act explainer puts it in context.

These rules help honest publishers label their content, but criminals do not follow them. Fraud using deepfakes is still fraud under existing law. For more on labels and watermarks, see AI watermarks and content provenance.

How an AI assistant can help, and where it cannot

It sounds odd to use AI against AI fraud, but an assistant is useful for the preparation work. With Ask Mio you can draft the one-page payment policy, write a short training script for staff, turn the call-back rule into a poster with the Image / poster job, or ask Mio to explain a suspicious message in plain words. The Domain & DNS check tool can show whether a domain in a suspicious link responds and what records it has, and Research mode can look up whether a “breaking news” video or investment claim is reported by reliable sources, with cited links. The Security reviewer expert helps think through weak points in your processes.

What Ask Mio does not do is analyse a video or voice recording and tell you with certainty whether it is fake. No general assistant can promise that reliably, and you should be careful with any tool that claims to. The call-back rule remains your strongest defence.

Frequently Asked Questions

How much audio does a scammer need to clone a voice?

Less than most people expect. Current voice tools can produce a convincing imitation from a short, clear recording, and public videos, podcasts or voicemail greetings are often enough. Quality improves with more audio, but you should assume that anyone with recordings online can be imitated. That is why verification through a known channel matters more than trying to hide your voice.

Can I reliably tell a deepfake video call from a real one?

Not reliably. Blurring at the edges of a face, lip-sync problems and odd blinking can be clues, but good fakes may show none of them, and poor connections cause similar glitches in real calls. Treat visual clues as a reason to verify, then end the call and contact the person through a number or channel you already had.

What is the best single defence against AI deepfake scams?

Calling back on a number you already had before the request arrived. The scammer controls the incoming call, message or meeting link, but not your company directory, your existing contract or a family member’s usual number. Combine it with two-person approval for payments, and almost every deepfake payment scam fails, however realistic the fake looks.

Should my family have a code word?

It is a simple, effective idea, especially for older relatives who might receive a distressed call from a voice that sounds like a grandchild. Choose something that never appears online, agree on it in person and do not write it in messages. If anyone feels unsure during a call, they ask for the code word or hang up and call back.

Are deepfakes illegal in the EU?

Creating synthetic media is not illegal in itself, and the EU AI Act adds transparency duties for content that imitates real people. Using a deepfake to deceive someone into paying money, to defame them or to harass them falls under existing fraud, defamation and criminal laws. If you are targeted, report it to the police and, if money moved, to your bank immediately.

The Bottom Line

AI deepfake scams are convincing because they borrow trust, not because they are technically perfect. Do not try to win by spotting pixels. Set a call-back rule, require two approvals for payments, lock the process for changing bank details and give everyone permission to slow down. Those habits work whatever the next generation of fakes looks like. To draft your own policy and training material, you can start with Ask Mio’s free plan.

AI Deepfake Scams: How to Spot Fake Voices and Video Calls