Module 3 — Recognizing AI Scams, Deepfakes, and Social Engineering

Learning outcomes: Explain the core concepts, recognize common risks, apply practical safeguards, and complete the ten-point self-check.

1. Why this module matters

Fraud has always relied on persuading people to act before they verify. Generative AI makes that persuasion cheaper and more convincing: a scammer can produce polished messages, realistic images, or a voice that resembles someone you know. The appearance of familiarity is no longer reliable proof of identity.

This module teaches a repeatable response: pause, verify independently, protect accounts and money, and report suspicious activity. The most effective defense is usually a disciplined process rather than an attempt to spot every technical artifact.

Scams can now arrive through text messages, social networks, search advertisements, video calls, and apparently legitimate customer-support channels. AI-assisted fraud can scale rapidly: attackers can tailor messages to local events, imitate the writing style of an acquaintance, and create synthetic evidence that appears persuasive. Not every suspicious message uses AI, and exact fraud trends vary by source and period; the practical concern is that appearance and fluency are no longer sufficient evidence of authenticity.

2. What is Social Engineering, and How Does It Work?

Social engineering is manipulation that persuades a person to reveal information, transfer money, click a link, or bypass a safeguard. Common pretexts include a relative in distress, a bank fraud alert, an unpaid invoice, a package problem, or a request from an authority figure. The attacker uses urgency, fear, trust or embarrassment to short-circuit normal verification.

AI can help criminals personalize messages using publicly available details, translate them into natural language, and generate many variants quickly.

A typical attack follows a pattern: the scammer establishes a believable identity, invents a problem or opportunity, creates time pressure, and asks for a risky action. For example, a fake bank representative may claim an account is frozen, then demand a one-time passcode; a fake employer may request an application fee; or a supposed family member may ask for an immediate transfer. A legitimate-sounding explanation does not justify skipping independent verification.

3. Understanding synthetic media and deepfakes

Synthetic media is content created or altered by AI. A deepfake often refers to realistic synthetic audio or video that impersonates a person or fabricates an event. A cloned voice can sound familiar; a fabricated video can appear to show someone making a statement they never made.

Some fakes have visual or audio imperfections, but increasingly convincing content may not. Do not rely on a single indicator or “tell” such as strange blinking or unusual phrasing. Instead, authenticate and verify the claimed event through a trusted, independent channel.

Examples include a cloned voicemail asking for emergency funds, a fabricated video endorsement of an investment, a synthetic profile photo used in a relationship scam, and an altered screenshot that appears to show a payment confirmation. Authentic photographs can also be placed in a false context. Determine both whether the media is genuine and whether its description is accurate.

4. A reliable verification procedure

If someone asks for money, credentials, a code, or an urgent change of plans, stop the conversation and initiate a fresh contact using a number or address you already trust. Do not use the callback number or link supplied in the suspicious message.

Families can agree on a verification question or call-back practice, but a shared secret should never be your only defense. Institutions can be impersonated too: confirm through the official app, a website address typed independently, a known telephone number, and—when accessing a website—an HTTPS connection using TLS with a valid X.509 certificate. Remember that a valid certificate alone does not prove that the organization or its claims are legitimate.

Step-by-step verification by media type

• Text message or email: Do not follow the embedded link. Inspect the sender address without trusting the display name; open the official app or type the known website address yourself. Confirm the request with a previously saved contact.
• Telephone call or voicemail: Hang up, then call back using a saved number or the number on a physical card or official statement. Caller ID and familiar voices can be spoofed.
• Photo or screenshot: Search for the original image using a reverse-image search; check when and where it first appeared, and whether a credible original source supports the caption. Cropping and reposting can change context.
• Video or livestream: Locate the full recording on an independently verified channel; compare the clip with official transcripts or announcements. Do not treat visual realism as proof.
• Social media post: Inspect the account history and official website links; seek an independent announcement. A verification badge alone does not establish the claim.
• Website, advertisement or payment page: Check the exact domain spelling and navigate independently. HTTPS protects the connection but does not guarantee the business is honest.
• Document, invoice or QR code: Confirm payment instructions with the organization through an existing channel. Avoid scanning unknown QR codes or opening unexpected attachments.
• Breaking news or public claim: Compare multiple independent reputable outlets and the original public record; check dates, locations and corrections.

5. Ten key risks and why they matter

1. Voice impersonation: A caller may imitate a relative or colleague to request an emergency transfer.
2. Video impersonation: A fabricated meeting or clip may appear to show a trusted person giving instructions.
3. Phishing links: A convincing message can direct you to a credential-stealing website.
4. Payment diversion: A fake invoice or changed payment instruction can redirect funds.
5. Fake customer support: An attacker may claim to fix an account problem and request remote access.
6. One-time-code theft: A scammer may ask you to repeat a login code sent to your phone.
7. Romance or relationship manipulation: AI-assisted personas can build trust over long conversations.
8. Investment deception: Synthetic endorsements can make fraudulent opportunities appear credible.
9. False urgency: Threats of arrest, account closure or harm may push people to act immediately.
10. Reputational harm: Fabricated images or messages can be used for harassment or extortion.

6. Practical actions for safer AI use

Treat urgent requests involving money, identity documents, remote access or login codes as unverified until checked. Pause even when the message uses your name, refers to a real event, or sounds like someone you know.

Use an independently obtained contact method: call a family member at a saved number, open your bank’s official app yourself, or visit the organization’s known website. If the caller refuses verification or demands secrecy, end the interaction.

Never disclose one-time authentication codes or recovery phrases. Do not install screen-sharing software at the direction of an unexpected caller. If you clicked a suspicious link, stop interacting, change affected passwords through the official site, review account activity and seek support.

Preserve evidence such as screenshots, timestamps and payment details without forwarding harmful material broadly. Report suspected fraud to the affected institution and appropriate public authorities. Fast reporting may improve the chance of limiting financial loss.

Example: A caller says, “Your daughter is in trouble; send money now.” End the call and contact your daughter directly. Example: An apparent courier message demands a small redelivery fee; open the courier’s official site rather than the message link. Example: A video of a public official makes a startling claim; find the complete speech on an official channel before sharing it.

7. Everyday examples

These scenarios illustrate how to turn the concepts into choices in ordinary life.

1. Emergency family call: A familiar-sounding voice requests bail money. Hang up and call the relative on a saved number.
2. Bank text: A message claims suspicious activity and links to a login page. Open the bank app independently.
3. School fundraiser: A polished email requests gift cards. Confirm through the school’s published contact details.
4. Video endorsement: A celebrity appears to promote an investment. Check primary announcements and regulatory warnings.
5. Tech support pop-up: A browser warning demands a phone call. Close the page and consult the device vendor’s official support.
6. Payroll change: An email requests a new direct-deposit account. Confirm through the employer’s established HR portal.
7. Rental listing: A polished listing requests a deposit before viewing. Verify ownership and inspect the property independently.
8. Charity appeal: A moving video requests an urgent donation. Visit the charity’s official website independently.
9. Friend’s social account: A friend asks for a login code. Call the friend through a different channel.
10. Marketplace sale: A buyer sends a screenshot of payment. Confirm funds directly in your payment account.

8. End-of-module checklist

• I pause before responding to urgent or emotional requests.
• I independently verify callers, senders and institutions.
• I never provide one-time codes or account recovery phrases.
• I avoid clicking login links in unexpected messages.
• I confirm payment instructions through a previously trusted channel.
• I do not grant remote device access to unexpected support callers.
• I recognize that voices and videos can be fabricated.
• I discuss a verification plan with family members.
• I save relevant evidence without spreading suspicious content.
• I know how to contact my bank and report suspected fraud.

9. Further reading and authoritative sources

• US — Federal Trade Commission, Consumer Advice — Scam, identity theft and consumer privacy guidance.
• US — IdentityTheft.gov — Identity theft reporting and recovery steps.
• US — CISA Secure Our World — Practical account and device security guidance.
• EU — ENISA — European cybersecurity research and guidance.
• Japan — AI Safety Institute (AISI) — Japanese AI safety resources.
• Japan — Information-technology Promotion Agency (IPA) — Information security and digital literacy resources.

Copyright and Use

© 2026 Institute for AI Governance, Cybersecurity & Risk Management (IAIGCRM). All rights reserved.

These educational materials are provided for individual learning and personal reference. Except as permitted by applicable law, reproduction, redistribution, adaptation, commercial use, or incorporation into third-party training programs requires prior written permission.

For licensing and permissions, contact: stephen.buerle.phd@gmail.com.

Educational Disclaimer

These materials provide general educational information about artificial intelligence safety, privacy, cybersecurity, and responsible use. They do not constitute individualized legal, medical, financial, or professional cybersecurity advice.

Although reasonable care has been taken in preparing these materials, technologies, threats, regulations, and recommended practices may change. The Institute does not guarantee that the materials are complete, error-free, or suitable for every situation.

Readers should independently verify information relevant to consequential decisions and consult appropriately qualified professionals when necessary.