You often cannot spot a good deepfake by looking or listening, so the safest defense is a habit: verify through a channel you control before acting on any urgent request. The FBI warned in a December 2025 alert that AI-generated voices and images can be hard to distinguish from real ones. Hang up and call back on a number you find yourself, agree on a family secret word, and never send money, gift cards, or crypto because of a call or message alone.
Scammers now use cloned voices (called vishing when done by phone) and fake video to impersonate relatives, executives, and officials. This guide explains how these scams work, which warning signs are worth checking, why those signs are not enough on their own, and the verification steps that work even when the fake is convincing.
How Deepfake and Voice Scams Work
Every version of this scam has the same structure. A criminal creates a believable identity, builds urgency, and asks for something that is hard to undo: money, a one-time code, or access to an account. AI changes the first step by making the identity more convincing.
The FBI’s May 15, 2025 alert described a campaign active since April 2025 in which criminals impersonated senior US officials through text messages (smishing) and AI-generated voice messages. The goal was to build rapport and then gain access to personal accounts. The actors often moved targets to a separate messaging platform through a malicious link that steals login credentials. A compromised account can then be used to target the official’s contacts.
The FBI’s December 19, 2025 alert says the activity has gone on since at least 2023 and targets not only officials but also their family members and acquaintances. Initial contact comes by text, followed by a quick move to encrypted apps such as Signal, Telegram, or WhatsApp. Requests include authentication codes, personal documents, wire transfers, or introductions to other people. Stolen contacts are then used for further impersonation.
The same pattern applies to ordinary people. A voice that sounds like a grandchild, a boss, or a bank agent asks you to act quickly and keep it secret.
The Arup Case: What a Deepfake Video Call Looks Like
The clearest documented example involved the engineering firm Arup. According to a May 2024 account from Adaptive Security, a phishing email impersonating Arup’s UK-based chief financial officer asked a Hong Kong finance employee to take part in a “secret transaction.” The employee was skeptical at first. A video call followed in which every participant except the employee was an AI-generated deepfake, including senior executives. The fakes looked and sounded like real colleagues.
The employee made 15 transfers to five Hong Kong bank accounts controlled by the scammers, for about $25 million in total. The fraud came to light when the employee followed up with Arup’s headquarters. Arup confirmed it was the victim. Its chief information officer, Rob Greig, said no company systems were compromised and no data was affected, and he called it “technology-enhanced social engineering” instead of a traditional cyberattack.
Two lessons stand out. The email request was suspicious enough that the employee hesitated, and it was the video call that removed the doubt. And what exposed the fraud was a follow-up with someone the employee already knew how to reach.
Warning Signs Worth Checking
The FBI’s alert lists indicators worth watching for. None is proof on its own.
In Images and Video
Look for distorted hands, unrealistic facial features, inaccurate shadows, watermarks, and unnatural movement.
In Voice and Language
The FBI advises listening to tone, word choice, call lag, and voice matching, and warns that AI voice clones can sound nearly identical to real contacts.
In the Request Itself
The most reliable signals are about behavior, not pixels. Watch for urgency, secrecy, a request to switch platforms, a demand for payment by gift card or crypto, and a request for a verification code. The FBI notes that scammers ask for authentication codes in order to sync with a victim’s contacts.
In Contact Details
The FBI advises checking email addresses, phone numbers, URLs, names, and spelling for slight differences. A cloned voice calling from an unfamiliar number is a warning.
Why Detection Alone Is Not Enough
The FBI’s December 2025 alert says AI-generated content is “often difficult to identify.” That should shape how you protect yourself. If you rely on noticing a glitch, you will miss the fakes that are good, and those are the ones that cause harm. A person under pressure also reads cues poorly. A relative who is told a child is in jail is not carefully checking the quality of the audio.
The better approach is to assume any single call, message, or video could be fake and to use a process that works either way. The steps below do that.
Verification Steps That Work Even Against a Good Fake
Hang Up and Call Back
The FBI’s guidance is to research the originating number, organization, or person, then find a phone number independently and call to confirm. Use a number from your own contacts, a bank card, or the company’s official website. Do not use a number the caller gave you.
Agree on a Family Secret Word
Both FBI alerts recommend creating a secret word or phrase with family members to verify identities. Choose something that is not posted online and cannot be guessed from social media. If a caller claiming to be a relative cannot give the word, treat the call as a scam. Agree in advance that the word is used for any request involving money or emergencies.
Ask Something Only the Real Person Would Know
If you have no secret word, ask about a detail that is not public, such as a shared memory. A prepared scammer may research public information, so a secret word is stronger.
Slow Down
Scammers depend on speed. Tell the caller you will call back in a few minutes, and then do it through a trusted channel. Real relatives and real banks can wait five minutes.
Never Send Money or Codes on the Strength of a Call
The FBI advises not sending money, gift cards, or cryptocurrency to people you know only online or by phone. If a known contact asks for money, confirm their contact information independently first. Never share two-factor codes by email, text, or messaging apps, and keep two-factor authentication enabled.
Don’t Click Links From Unverified Senders
The FBI says not to click links in texts or emails until you have independently confirmed the sender. A link may lead to a page that steals your login.
Extra Steps for Businesses and Finance Teams
The Arup case shows what happens when a single employee can move large sums on a video call. Companies can reduce the risk with rules that do not depend on spotting a fake. Require a second approver for transfers above a set amount. Confirm payment requests by calling a known number, not by replying to the request. Treat any “secret” or “urgent” transaction as a trigger for extra checks. Train staff that video and voice are not proof of identity, and give them permission to pause a request from a senior executive.
What to Do If You Think You Have Been Targeted
If You Sent Money
Contact your bank immediately and ask whether the transfer can be stopped or recalled. Speed matters.
If You Shared a Code or Clicked a Link
Change the password for the affected account from a clean device, sign out of all sessions, and check the account’s recovery settings. Tell your contacts, because a compromised account can be used to impersonate you to them.
Report It
The FBI asks victims to report to their local FBI field office or to the Internet Crime Complaint Center at ic3.gov, with as much detail as possible, including phone numbers, messages, and the platform used.
A Script for the Moment a Suspicious Call Arrives
When a call or message creates pressure, you rarely think clearly. A short script helps, and it works whether the caller is real or not.
First, say you will call back. A real relative, bank, or employer will accept that. Second, hang up and find the number yourself, from your contacts, a bank card, or an official website. Third, call and ask whether they contacted you. Fourth, if the request involved money, wait until you have heard the answer from someone you reached on a trusted channel. Fifth, if it was a scam, report it.
The point of the script is that it does not depend on judging the voice. A cloned voice can fool you for a minute. It cannot answer the phone when you call the real person.
Helping Older Relatives
Older relatives are common targets for family-emergency calls because the story plays on worry. Sit down with them and set up the verification habits together. Agree on a secret word, write it on a card for the phone table, and explain that a real family member will not mind being asked for it. Tell them a legitimate bank, government agency, or company will not demand payment in gift cards or crypto, and that they can always hang up and call back. The FBI’s guidance to never send money or codes on the strength of a call applies to them in particular.
Rules That Protect a Company
Organizations can turn the Arup lesson into policy. A payment instruction that arrives by email or message should be confirmed through a second channel using contact details already on file. Large or unusual transfers should need two approvers. Staff should be told that a senior executive on video is not proof of identity, and that no one will be punished for pausing a request to verify it. These rules do not require anyone to spot a fake, which is why they work.
Limits of What We Know
Public figures on how often these scams succeed vary widely between sources, and several roundups cite loss totals without traceable origins, so this article does not quote them. The FBI alerts describe the tactics and give verification advice, and the Arup case documents what a successful attack looks like. The technology also changes quickly, so the visual and audio tells that work today may not work next year. Habits of verification will outlast them.
Frequently Asked Questions
How can I tell if a voice call is an AI clone?
Often you cannot. The FBI says AI voice clones can sound nearly identical to real contacts. Verify by hanging up and calling a number you find yourself, and use a family secret word.
What is vishing?
It is voice phishing, a scam carried out by phone call or voice message. The FBI’s alerts describe criminals using AI-generated voices to impersonate officials and, by extension, anyone they want to imitate.
Is a video call proof that someone is real?
No. In the Arup case, every other participant on the video call was a deepfake, and the employee transferred about $25 million.
Should my family have a secret word?
Both FBI alerts recommend it. Pick a word or phrase that is not public, and agree to use it for any request involving money or an emergency.
Where do I report a deepfake scam?
Report to your local FBI field office or at ic3.gov, and tell your bank right away if money moved.
References and Sources
Internet Crime Complaint Center, “Senior US Officials Impersonated in Malicious Messaging Campaign (PSA I-051525)”: https://www.ic3.gov/PSA/2025/PSA250515
Internet Crime Complaint Center, “Senior US Officials Impersonated in Malicious Messaging Campaign (PSA, December 19, 2025)”: https://www.ic3.gov/PSA/2025/PSA251219
Adaptive Security, “Arup Deepfake Scam: How $25M Was Stolen via Video Call”: https://www.adaptivesecurity.com/blog/arup-deepfake-scam-attack
About The Author
