AI Scams: 10 Tricks Scammers Use (Deepfake Calls, Fake UPI Requests) and How to Stay Safe

AI scams look and sound real: a cloned voice of your child asking for money, a video call with a “boss” or “officer” who is really a deepfake, or a flawless email from your “bank”. Here are the 10 AI-powered tricks scammers use most, including fake UPI requests in India, the red flags for each, and exactly what to do and where to report if you are targeted.

Quick answer: Never trust a voice, face or message just because it seems real. If anyone asks for money, codes, a PIN or remote access in a hurry, hang up and contact the person or company on a number you already know. Agree a family “safe word”. In India, a UPI PIN is only for sending money, never for receiving it. If you lose money, report it at once: in the US at ReportFraud.ftc.gov (and ic3.gov), in India on the 1930 helpline or cybercrime.gov.in.

Why AI makes scams harder to spot

Criminals use the same AI tools everyone else uses, only to fool people faster. The FBI has warned that they use generative AI for text, images, cloned voices and fake video to make their scams more believable (FBI public service announcement). The old warning signs, such as bad spelling, a strange accent or a blurry photo, are disappearing, so the best defence is to check every request for money or codes through a channel you already trust.

What changed in late 2026

In late October 2026, security firm CrowdStrike reported that a hacking group had used AI agents to target more than 200 organisations in 14 countries in just 11 days, with the AI doing much of the scanning and break-in work that once took teams of people. Attacks on companies get the headlines, but the same technology writes scam messages, clones voices and fakes video for attacks on ordinary people.

Here are the tricks that matter most, and how to beat each one.

10 AI scam tricks at a glance

1. Voice-clone “family emergency” calls

A scammer needs only a short clip of someone’s voice, often taken from a social media video, to make an AI copy of it. You get a call that sounds exactly like your son, daughter or parent: they’ve had an accident, been arrested or lost their phone, and need money now. Sometimes a second “lawyer” or “police officer” takes over.

How to stay safe: the FTC’s advice is simple: don’t trust the voice. Hang up and call the person on a number you know is theirs. If you can’t reach them, check with another relative. The FBI also suggests a family safe word or phrase that a real caller would know. Be wary of any request to pay by wire transfer, crypto or gift cards.

2. Deepfake video calls from a “boss” or an “officer”

AI can now put a fake face and voice on a live video call. At work, this shows up as a call from a “CEO” or “finance head” asking for an urgent, secret transfer. In India, it often appears as a “digital arrest”: callers posing as police, CBI, customs or courier staff claim a parcel in your name contained drugs, keep you on a video call for hours and demand money to “clear your name”.

How to stay safe: India’s Indian Cyber Crime Coordination Centre (I4C) has said plainly that police, CBI and ED don’t arrest people through video calls. There is no such thing as a digital arrest. End the call, don’t pay, and report the number. At work, confirm any payment request through a second channel you already use, such as a known phone number or an in-person check.

3. Deepfake celebrity investment ads

Scam ads and videos now show well-known business leaders, actors or news anchors “recommending” a trading app, crypto scheme or get-rich platform. The face and voice are AI fakes. The FBI lists fake promotional videos for investment fraud among the ways criminals use AI.

How to stay safe: treat any ad promising guaranteed or very high returns as a scam, however famous the face. Never install an investment app from a link in an ad or message. In India, check that a broker or adviser is registered with SEBI before you invest anything.

4. AI-written phishing emails and texts

The old advice to spot scams by their bad spelling no longer works. AI writes clean, friendly messages in any language, tailored to you with details pulled from social media or past data leaks. Typical lures: a delivery problem, an unpaid toll, a blocked bank account, a tax refund or an electricity cut-off “tonight”.

How to stay safe: don’t tap links in unexpected messages, even polished ones. Open the bank, courier or government app or website yourself and check there. Turn on two-step verification for important accounts (see our guide to setting up Gmail 2-step verification), and never share a one-time code with anyone who calls or messages you.

5. Fake UPI payment requests and QR code tricks (India)

UPI fraud usually starts with a convincing story: a buyer on a selling site who “sends” money, a “refund” from a shopping app, or a cashback offer. You are asked to scan a QR code or enter your UPI PIN “to receive” the money, and the money goes the other way. Fraudsters also send fake payment screenshots or SMS that look like bank credits.

How to stay safe: NPCI’s UPI Safety Shield says to enter your UPI PIN only to send money; it is never needed to receive money. Scan a QR code only to pay, check the receiver’s name before you approve, and confirm any “payment received” in your own bank or UPI app, not from a screenshot. NPCI also ended person-to-person “collect” requests from 1 October 2025, so a stranger asking you to approve a payment request is a warning sign.

6. Fake customer support numbers and chatbots

Scammers publish fake helpline numbers in search ads, social posts and review sites, and some now run AI chatbots that sound like a real support agent. When you call about a refund or a blocked account, they ask for card details, codes or remote access.

How to stay safe: get support numbers only from the company’s official website or app, typed in yourself. Real support staff won’t ask for your PIN, password or OTP.

7. AI romance and “investment friend” chats

AI lets one scammer run dozens of warm, patient chats at once, with fake profile photos and fluent replies at any hour. After weeks of friendship or romance, the “friend” introduces a crypto or trading platform where your small first profits look real, until you try to withdraw.

How to stay safe: the FBI advises never sending money, gift cards or crypto to someone you’ve only met online or by phone. Be suspicious of anyone who avoids a live meeting, or whose video calls glitch or never happen. Our crypto wallet security guide covers how to keep crypto safe.

8. Fake AI apps, tools and extensions

The popularity of chatbots and photo generators has brought a wave of copycat apps, browser extensions and “free premium” downloads that steal logins, show endless ads or install malware.

How to stay safe: download AI apps only from the official App Store, Google Play or the company’s own website, check the developer name, and be wary of anything that asks you to sign in with your email password or social account on a page you didn’t open yourself.

9. AI job offers and “task” scams

Messages on WhatsApp, Telegram or LinkedIn offer easy work from home: rating products, liking videos or “training AI” for a fee per task. You get small payouts at first, then must pay a “deposit” to unlock bigger tasks. AI-made recruiter profiles and fake offer letters make it look real.

How to stay safe: a real employer never asks you to pay to get or keep a job. Check the company’s official careers page and contact it directly.

10. Screen-sharing apps and fake KYC updates

A caller or message says your bank KYC, SIM or electricity account will be blocked unless you update it now. To “help”, they ask you to install a screen-sharing or remote-access app, then watch you type your PIN or take over the phone.

How to stay safe: NPCI warns against installing screen-sharing or SMS-forwarding apps at a stranger’s request. Banks and telecom companies don’t do KYC by asking you to install an app during a call. If you think someone already got in, see our guide to recovering a hacked account for the first steps.

How to protect yourself from AI scams: 8 habits

1. Pause. Urgency is the scammer’s main tool. A real emergency survives a five-minute check.
2. Call back on a known number. Never use the number, link or app the caller gives you.
3. Agree a family safe word and use it whenever someone calls asking for money.
4. Keep codes private. No real bank, company or official asks for your OTP, PIN or password.
5. Turn on two-step verification for email, banking and social accounts.
6. Limit what you share publicly. Set social accounts to private to make voice and face cloning harder.
7. Never install apps on request from someone who called or messaged you.
8. Talk to older relatives and teens about these tricks. They are frequent targets.

Where to report AI scams

United States: report fraud to the FTC at ReportFraud.ftc.gov, and internet crime to the FBI at ic3.gov. Call your bank right away if money left your account.

India: if you’ve lost money, call the national cyber crime helpline 1930 immediately or file a complaint at cybercrime.gov.in. Fast reporting can help freeze the money before it is moved. Inform your bank too. To report a suspicious call, SMS or WhatsApp message where you haven’t lost money, use Chakshu on Sanchar Saathi.

FAQ

How can you tell if a call is an AI voice clone?

Often you can’t by ear alone, as clones are very good. Listen for odd pauses or word choices, but rely on checking: hang up and call the person back on their known number, or ask for your family safe word.

Can scammers clone my voice from a short video?

Yes. The FTC says a short audio clip, such as one from a video posted online, can be enough. Keeping your accounts private reduces the risk.

Is “digital arrest” real in India?

No. The I4C has said police, CBI and ED don’t arrest people over video calls. Anyone saying you are under digital arrest is a scammer. Hang up and report it on 1930 or cybercrime.gov.in.

Do I need my UPI PIN to receive money?

No. NPCI says the UPI PIN is only needed to send money. Anyone asking you to enter it to receive a payment is trying to steal from you.

What should I do first if I’ve been scammed?

Call your bank to block cards or transfers, then report it: 1930 or cybercrime.gov.in in India, ReportFraud.ftc.gov and ic3.gov in the US. Change passwords on any account you shared, and turn on two-step verification.

Want more AI help without the risks? See our realistic guide to making money with AI, which also covers the get-rich-quick offers to avoid.