AI Scams in 2026 — What They Look Like and How to Spot Them

Why this is different from old-school phishing

The old advice was simple. Look for bad spelling, weird formatting, a sender address that does not match. That advice is not useless, but it is a lot less reliable than it used to be, because AI tools fix exactly those problems. A scammer can generate a perfectly written email in seconds, matching the tone of a real company, with zero grammar mistakes.

The bigger shift is scale combined with personalisation. The old model was one generic email blasted to a million addresses. The new model is one scammer running thousands of personalised attacks at once. Tools can pull details from social media, breached data, or a company's own website, and weave that into a message that feels specifically written for you. That is what makes scams in 2026 hit differently. It is not just better writing. It is better writing, aimed better, at scale.

Here is what is actually circulating right now, broken down by type, with the specific signs to watch for in each one.

AI written phishing emails and texts

This is the most common one and the easiest to run into. A scammer feeds an AI tool a target, whether that is you, your company, or your bank, and gets back a message that reads like it was written by an actual employee. No more "Dear Valued Customer" with three exclamation points. Now it is a calm, professional note that mentions the right bank name, the right kind of unusual activity, and just enough urgency to get you to click without overthinking it.

What makes these dangerous is the personalisation. Older phishing kits used the same template for everyone. AI generated ones can reference real details, like your city, your bank, or something pulled from your own social media, making the email feel like it could not possibly be fake.

The red flags to watch for here are not about writing quality anymore. Pay attention instead to what the message is asking you to do. Any request to click a link, verify your account, or act within a tight deadline is worth pausing on, no matter how polished it sounds. A well written email and a genuine email are no longer the same thing.

Cloned voices — it sounded exactly like them

This is the one that catches people off guard the hardest, because it does not feel like a scam. It feels like an emergency.

Voice cloning tools can recreate a person's voice using just a few seconds of audio, often pulled from a public video, a voicemail greeting, or a social media clip. The scam usually goes like this. You get a call from an unknown number and the voice on the other end sounds exactly like your child, your parent, or your sibling. They sound scared. They say they are in trouble. Then someone else gets on the line and asks for money, fast, often through a wire transfer, crypto, or gift cards.

This is not a hypothetical. There have been real documented cases of parents wiring thousands of dollars after hearing what they were sure was their own child's voice, sobbing, on the phone, only to find out later it was an AI clone built from old social media videos.

It has also moved into the corporate world. Finance employees have been tricked into approving large wire transfers after a call, or even a video conference, with what looked and sounded exactly like their company's CFO, but was actually an AI generated deepfake of the entire meeting.

The red flag here is the request itself, not the voice. Any urgent call asking for money, especially through crypto, gift cards, or wire transfers, is worth stopping for regardless of how real the voice sounds. The defence is not trying to detect the fake voice, because at this point most people genuinely cannot. The defence is having a plan in place before it happens, such as a family code word, or a rule that you always hang up and call the person back on a number you already have saved, never the one that called you.

Deepfake video calls

This is the newest and most unsettling category. We have moved past obviously fake, stiff deepfake videos. Real time video deepfakes can now hold a live conversation, react naturally, and maintain eye contact, all while wearing someone else's face.

The most well known example involved a finance employee at a major engineering firm who joined what looked like a totally normal video call with his company's CFO and several coworkers. Everyone on that call, every face and every voice, was an AI generated fake. By the time anyone realised, he had already transferred millions of dollars across multiple payments.

It has also shown up in scams impersonating government officials and public figures, used to push fake investment schemes or spread convincing misinformation. If a video of a politician or a well known businessperson promoting a guaranteed investment seems too aggressive or too good to be true, AI generation is a real possibility, not a stretch.

The red flag is the action being requested, not the visual quality of the call. Treat any video call that involves a request for money, login credentials, or sensitive information the same way you would treat a phone call. Verify independently. Call the person back on a known number, or confirm through a separate channel, before acting on anything that happened in the call.

AI romance scams

Romance scams are not new, but AI has made them dramatically more convincing and a lot harder to walk away from.

Here is how it typically unfolds. Someone matches with you on a dating app, or messages you on social media. Their photos look real because they often are real, just AI enhanced, swapped, or entirely AI generated to be exactly the kind of attractive but believable that does not trigger suspicion. The conversation moves fast. They are warm, attentive, and always available, partly because AI chatbots can now handle large parts of the conversation, keeping multiple targets going at once without ever sounding tired or inconsistent.

Once trust is built, sometimes over weeks, sometimes months, the ask comes. It is rarely send me money right away. It is usually something softer, a crypto investment opportunity they are excited about, a financial emergency, travel money so they can finally come visit. By the time money is requested, the emotional investment is real, even though the relationship never was.

The AI layer makes this worse in two ways. First, photos and even short videos can now be generated or faked convincingly enough that a reverse image search, the old trick for catching catfish, does not always work anymore. Second, AI chat assistance means scammers can run more relationships at once, and keep the conversation feeling personal and consistent even when it is not really one person typing.

The red flags worth watching for are a relationship that has moved fast, someone who is never quite available for a live video call or only ever appears briefly with bad connection issues, and any mention of money, crypto, or an investment opportunity. None of these alone is proof of a scam, but together they are a pattern worth slowing down for.

Fake AI generated official content

A growing slice of AI scams do not target you directly. They target what you trust. This includes AI generated images, videos, or audio of government officials, news anchors, or company spokespeople, used to make a scam look officially backed.

Canada's Competition Bureau has specifically flagged this trend, warning that scammers are using AI to impersonate government officials and political figures with a level of realism that is harder than ever to catch. The fake content gets used to push everything from phony government refunds to fraudulent investment schemes, sometimes with a fabricated video of a recognisable public figure endorsing it.

The red flag here is urgency dressed up as authority. Government agencies do not run urgent video campaigns asking you to click a link or send payment. If a video, voice clip, or official announcement is driving you toward an urgent financial action, that urgency is the tell, not the production quality.

What real organisations actually do

How to actually protect yourself

You cannot out detect this stuff anymore, not reliably. The production quality has gotten too good. What still works is changing what you rely on.

Stop trying to spot the fake and verify through a different channel instead. If a call, text, email, or video is asking you to send money, click a link, or share login information, do not decide based on how convincing it seems. Contact the person or company directly, using a number or method you already had, not one provided in the message.

Set up a family code word. A simple phrase only your close family knows, to be used if someone calls claiming to be in an emergency. It sounds old fashioned. It works precisely because AI cannot fake what it does not know.

Slow down on urgency. Every category above leans on the same trick, making you feel like you have to act right now. Scammers have always used urgency, but AI lets them deliver it more convincingly than ever. A real emergency from a real bank, government agency, or family member can survive you taking five minutes to verify it.

Be cautious about what is public. Voice clones and image based deepfakes are often built from content people post publicly. You do not need to disappear from social media, but locking down public facing voice and video content, like old stories or old public videos, removes some of the raw material scammers rely on.

When in doubt, check it before you act on it. Whether it is a link in a text, a forwarded email, or a screenshot of a suspicious message, getting a second opinion before clicking or replying is the single easiest habit that stops most of this cold.

Check something suspicious right now

If you received a message, email, or call that felt off and you want a second opinion before acting on it, check it here.

What to do if you think you have been targeted

If you sent money through a wire transfer, contact your bank immediately. Wire transfers can sometimes be recalled within a short window if you act fast, though this is not guaranteed.

If you sent money through cryptocurrency, contact the exchange or platform you used immediately and report it as fraud, though crypto transactions are very difficult to reverse once confirmed.

If you sent gift cards, contact the retailer that issued them as soon as possible. Some retailers can freeze the balance if the cards have not yet been redeemed.

If you shared personal information during a romance scam or a cloned voice call, be cautious about further contact from the same person or number and consider placing a fraud alert on your credit file as a precaution.

If you are a business and believe a deepfake video call led to a fraudulent payment, report it to your bank's fraud team immediately and inform your IT and finance leadership so internal verification processes can be reviewed.

Where to report it

Questions people ask about AI scams

How can I tell if a voice is cloned if it sounds completely real?

In most cases you genuinely cannot, and that is the point of this guide. Voice cloning has reached a level where detection by ear is no longer reliable. Instead of trying to spot the fake, hang up and call the person back on a number you already have saved. If it was really them, they will understand why you checked.

Is it really possible to fake an entire video call with multiple people?

Yes. This has already happened in documented corporate fraud cases where every person on a video call, including their faces and voices, was AI generated. It is technically demanding but increasingly accessible, and it has resulted in real financial losses in the millions.

My family member called and the voice sounded exactly like them. Should I still verify?

Yes, especially if the call involves any request for money, gift cards, or financial details. A genuine emergency call will not be undermined by you hanging up and calling them back on their actual number to confirm. If anything, a legitimate caller will appreciate the caution.

What is a family code word and how do I set one up?

It is a simple word or phrase that only your immediate family knows, agreed upon in advance, that can be used to confirm identity during an unexpected or distressing call. If someone claiming to be a family member cannot provide it, or refuses to, that is a strong signal something is wrong. Choose a word that is easy to remember and not something you have posted publicly anywhere.

Are AI romance scams only on dating apps?

No. They commonly start on social media, through direct messages, comments, or even seemingly random follow requests. Dating apps are common but not the only place this happens. The pattern to watch for is the same regardless of platform, a relationship that moves fast, frequent unavailability for live video, and an eventual request involving money.