Spotting AI Fakes

Part 1

What can be faked now, honestly

Being precise about this matters. Overstating it makes people distrust everything, which is its own kind of harm. Here is where the technology actually stands.

1. 1

   Voice: convincingly, from seconds of audio

   A cloned voice can now carry emotion, crying, and a specific accent. It can say anything the operator types. What it still struggles with is unscripted back-and-forth — long pauses before answering an unexpected question, and shared history it was never given. It cannot know what you ate at Thanksgiving.

2. 2

   Still photos: essentially perfectly

   A face that has never existed can be generated in seconds and used as a dating or business profile. Older advice about counting fingers and looking for warped ears is out of date — that generation of tell is largely gone. Assume a photo proves nothing at all.

3. 3

   Video: very good, and improving fast

   Short clips of a person talking are now routinely convincing, especially compressed on a phone screen. Longer video and anything with fast movement, hand gestures near the face, or someone turning fully in profile still tends to break down. Do not rely on that gap lasting.

4. 4

   Live video calls: possible, but harder

   Real-time face swapping exists and is used in fake job interviews and romance scams. It is more fragile than a recorded clip: it struggles when someone waves a hand slowly across their own face, turns fully sideways, or picks up an object and holds it near their cheek. Asking for that is not rude when money is involved.

5. 5

   Writing: completely, in anyone's style

   Grammar mistakes used to be the reliable sign of a scam. That tell is dead. Scam messages are now fluent, correctly punctuated, and can be written to match how a specific person texts if the sender has seen examples. Judge messages by what they ask for, never by how well they are written.

Part 2

The grandparent call, step by step

This is the one that takes the most money from the most people in North Texas, and it follows the same script almost every time. Knowing the shape of it is most of the defense.

1. 1

   The call comes at a bad hour

   Late at night or very early. That is deliberate — a person woken from sleep is worse at scepticism and better at panic. The voice is upset, often crying, which conveniently explains why it sounds slightly off.

2. 2

   There is an accident, an arrest, or a hospital

   Something urgent and shameful. A car crash, a DUI, a broken nose, an arrest in another state. Shame is doing real work here: it is the reason for the next step.

3. 3

   You are asked not to tell the parents

   'Please don't tell Mom, she'll kill me.' This is the tell. It is the only reason given for why you should not do the one thing that would end the scam in thirty seconds. No genuine emergency is improved by keeping one specific person in the dark.

4. 4

   A second voice takes over

   A lawyer, a bail bondsman, a police sergeant, a doctor. This person is calm and authoritative and gives you the number and the amount. Real bail is not paid this way. No court, hospital, or police department takes payment by gift card, wire, crypto, or a courier to your door.

5. 5

   The money must move now

   Within the hour. Before a hearing, before a transfer, before a procedure. Urgency exists to stop you doing the checks you would otherwise do. Every genuine institution can wait twenty minutes while you call someone back.

6. 6

   Sometimes, someone comes to collect

   A growing version sends a courier to the house for cash. If that happens you are dealing with people who now have your address. Do not open the door, and call the police while they are still outside.

Part 3

The code word, and how to actually set one up

A family code word defeats voice cloning completely, because it is information that does not exist anywhere the technology can reach. It only works if you set it up properly.

1. 1

   Choose something that is not a fact about you

   Not a pet's name, a street, a birthday, a school, or a maiden name. All of those are findable. Pick something arbitrary — a nonsense pairing like 'purple tractor' is ideal precisely because there is no reason for it.

2. 2

   Agree it face to face

   Never by text, email, or a phone call, and never in a group chat. If it exists in writing on a device, it can be found on a device.

3. 3

   Tell everyone who might get the call

   Grandparents especially, and anyone who would wire money for family. A code word only one person knows about is not a system.

4. 4

   Practice it once, out loud

   Ring your parent and ask for the word. It feels silly. It also converts an abstract idea into a habit, and habits are what people fall back on when frightened.

5. 5

   Agree what happens when it fails

   The rule is: no word, no money, no exceptions, even if the story is heartbreaking. Decide that now, calmly, so the decision is already made when someone is crying down the phone.

Part 4

Checking a photo, a profile, or a video

For dating, marketplace selling, hiring, or anyone who has appeared in your life recently and moved quickly to talking about money.

• Reverse image search the profile picture. Right-click, search image, or use Google Lens. A stolen photo often appears under several names.
• Look at the account's age and history. An account created two months ago with fifty followers and no tagged photos from anyone else is a warning regardless of how good the pictures are.
• Ask for a live video call and do not accept excuses. A broken camera, bad signal, and being in a war zone or on an oil rig are the classic three.
• On the call, ask them to slowly pass a hand across their face, then turn fully sideways. Real-time fakes commonly break at exactly that moment.
• Ask something only the real person would know, that is not on their profile. Not 'where did you grow up' — something specific to your shared history.
• Check whether the story requires you to be the only one who can help. That framing is doing a job.

Part 5

Fakes aimed at your business

Small businesses are targeted specifically, because they have real money and no fraud department. Two versions dominate.

1. 1

   The CEO voice note

   A voice message or call that sounds like the owner, telling a bookkeeper to pay an urgent invoice or change payment details. It arrives when the real owner is known to be travelling, which is public information if anyone posts about trips.

2. 2

   The changed bank details email

   A supplier you really use writes to say their account has changed. The email is fluent, the invoice looks right, and the account is the fraudster's. This is the single most expensive scam hitting small firms.

3. 3

   The rule that stops both

   Any change to payment details, and any payment over an amount you set, requires a call back on the number you already have on file — not one in the email — to a named person. Write the rule down. Tell staff explicitly they will never be in trouble for slowing a payment down to check.

4. 4

   Limit what is public

   Voices are cloned from what is published. Owner interviews, promotional videos, and voicemail greetings are all raw material. That is not a reason to stop marketing, but it is a reason to have the callback rule.

Part 6

What to do in the first hour

If you think you have just been caught, speed matters more than anything else. Work down this list in order.

• Stop. Send nothing further, even if you are told the first payment failed. A second request is a sign it worked, not that it failed.
• Call your bank's fraud line using the number on your card. Say the words 'I am reporting fraud' — it routes you differently.
• If it was Zelle, Venmo, Cash App or a wire, say exactly which. Recall windows differ and are short.
• Write down everything while it is fresh: times, numbers, names, amounts, what was said. You will need it and memory fades fast.
• Screenshot everything before deleting anything. Do not delete the conversation.
• Report at reportfraud.ftc.gov and to local police, and ask for the report number.
• If you shared login details, change that password and turn on two-step verification, from a different device if you let anyone connect to your computer.
• Tell someone you trust. Shame is what keeps this quiet, and quiet is what lets it keep working.