# Protect yourself from AI scams: deepfakes, voice clones and AI phishing

> From Pyralink™ Prove It, the free Secure AI Toolkit: https://pyralink.co.uk/newsletter/toolkit/personal-ai-protection-guide
> Last reviewed 31 October 2026. General information, not legal advice. You may copy, adapt and print this for your own organisation. Please do not republish it as your own, and keep this credit line.

You do not need to be technical to protect yourself from AI-enabled scams. The most important defences are habits, not software: slow down, check another way, and agree in advance how your family or team will confirm that it really is them.

> **Not legal or financial advice.** This is general safety information based on UK official guidance. If you think you have been scammed, contact your bank straight away and report it using the links below.

## What has changed

Scammers have always pretended to be someone you trust. AI makes it cheaper and faster to do convincingly:

- **Voice cloning.** The UK's Stop! Think Fraud campaign warns that criminals can use AI to clone the voice of someone you know, such as a family member or a colleague, and use it in a phone call.
- **AI-written messages.** The NCSC noted in 2023 that language models could help criminals write more convincing phishing emails, including in languages they do not speak well. Spelling mistakes are no longer a reliable warning sign.
- **Deepfake video.** Synthetic video and audio can be used to impersonate a person on a call. You cannot rely on spotting glitches, so the checks below do not depend on it.

The goal of the scam is usually the same as ever: to rush you into sending money, sharing a code or password, or giving someone remote access to your computer.

## The five habits that work

1. **Slow down.** Urgency is the scammer's main tool. "Do it now, don't tell anyone" is a warning sign in itself.
2. **Do not trust caller ID or a familiar voice.** Stop! Think Fraud says caller ID is not proof of who is calling.
3. **Hang up and call back on a number you already trust.** Use the number on your bank card, a saved contact or an official website, not one the caller gave you.
4. **Agree a safe phrase.** Stop! Think Fraud advises agreeing a safe phrase with close family and friends. If the caller cannot say it, hang up.
5. **Know what real organisations never ask.** Stop! Think Fraud says genuine banks, police and similar bodies will never ask you to transfer money, share financial details or give them remote control of your computer.

## If a call, message or video asks for money

| Situation | What to do |
|---|---|
| A relative or friend phones or messages in distress and asks for money | Hang up. Phone them on their usual number, or ask another family member. Use your safe phrase |
| Someone claiming to be your bank, the police or a company asks you to move money to a "safe account" | Hang up. Call your bank on 159, or the number on your card. Real banks do not ask you to do this |
| A boss, client or supplier asks you to make an urgent payment or change bank details | Confirm with them by a different channel you already trust. Follow your payment-change procedure |
| Someone asks you to install software or give remote access "to fix a problem" | Do not. Hang up and report it |
| A video call shows someone you know asking for something unusual | End the call, then contact them through a separate, trusted channel |

## Spotting AI-written phishing

- **Look at what it asks, not how it reads.** Does it want you to click a link, open an attachment, log in, pay, or share a code?
- **Do not use links in the message.** Go to the organisation's site by typing the address or using your saved bookmark or app.
- **Check the sender and the context.** Is it a message you were expecting? Does it match how that person normally contacts you?
- **Never share one-time codes.** A code sent to your phone is for you only. Nobody legitimate will ask you to read it out.
- **Be careful with QR codes and urgent texts** that take you to a login page.
- **When unsure, ask the sender through another route.**

## Report it

- **Scam phone calls and texts:** Stop! Think Fraud says you can report scam calls by texting "Call" followed by the number to 7726.
- **Scam emails, texts, websites and adverts:** the NCSC explains how to report each type on its [phishing guidance page](https://www.ncsc.gov.uk/collection/phishing-scams), and its reports help get scam sites taken down.
- **If you have lost money or shared details:** call your bank straight away on 159 or the number on your card, then report the fraud to [Report Fraud](https://www.reportfraud.police.uk/). Stop! Think Fraud lists 101 as the number for the police.
- **If someone is in immediate danger:** call 999.

## Protect your accounts

- Turn on 2-step verification (2SV) for email, banking and social media, as the NCSC recommends, and use passkeys where a service offers them.
- Use a strong and separate password for your email, and a password manager to help with the rest.
- Be wary of what you share publicly. The NCSC notes that criminals use information about you that is available online, including on social media, to make phishing messages more convincing.
- Keep phones, computers and apps up to date.

## Using AI chat tools safely yourself

- Do not enter passwords, bank details, ID numbers, medical records or anything you would not want made public. The NCSC advises not to include sensitive information in queries to public tools.
- Read the privacy settings and whether your conversations are kept or used to improve the service.
- Check important answers elsewhere. AI tools can be wrong and sound sure.
- Be careful with browser extensions and apps that connect AI to your email or files. They can be given wide access.

## For employers: protect your team

- **Have a payment-change procedure.** Confirm any change of bank details, and any unusual urgent payment, using a number you already hold. Require a second person to approve payments above a set amount.
- **Do not rely on voice or video to confirm identity** for high-risk requests.
- **Brief staff with real examples**, and make clear that nobody will be criticised for double-checking, even when the request seems to come from the boss.
- **Make reporting easy** and treat it as a success when a staff member reports a near miss.
- See the [AI incident response mini-playbook](https://pyralink.co.uk/newsletter/toolkit/ai-incident-response-playbook) for what to do when something gets through.

## Questions people ask

**Can I tell if a voice is cloned?**
Not reliably. Do not rely on your ear. Use a safe phrase, and call back on a number you trust.

**Is a safe phrase really useful?**
Yes. It is recommended by the UK's Stop! Think Fraud campaign. Choose something nobody could guess from social media, and share it in person or in a private message.

**What if the caller already knows my details?**
Criminals can gather personal details from data breaches and public posts. Knowing your details does not prove who someone is.

**Should I hang up on my bank?**
If you are not sure, yes. Then call the number on your card. A genuine caller will not mind.

## Sources

- Stop! Think Fraud (UK government), [How to spot phone fraud](https://stopthinkfraud.campaign.gov.uk/how-to-spot-fraud/how-to-spot-phone-fraud/): AI voice cloning, safe phrase, caller ID, 159, 101, 7726, what genuine organisations never ask.
- NCSC, [Phishing scams: how to spot and report them](https://www.ncsc.gov.uk/collection/phishing-scams).
- NCSC, [ChatGPT and large language models: what's the risk?](https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk) (14 March 2023): AI-written phishing, and not entering sensitive information into public tools.
- NCSC, [Top tips for staying secure online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online): separate email password, 2-step verification, password managers.
- [Report Fraud](https://www.reportfraud.police.uk/) (police fraud reporting service).