A finance manager joins a video call with the CFO and several colleagues. Everyone looks and sounds right. The CFO asks for an urgent transfer. Later it turns out nobody on the call was real. Stories like this are why deepfake scams keep climbing search charts. We compared guidance from an FBI and American Bankers Association advisory (as summarised by KnowBe4), the New York State IT agency, security firm Quick Heal and the US Federal Trade Commission, and combined what they agree on. We deliberately left out statistics the sources gave without a primary reference.
The key points
- Criminals use AI to impersonate relatives, executives, officials and celebrities, relying on fear and urgency.
- Visual and audio red flags exist, but some deepfakes show none, so the context of a request matters as much as how it looks.
- Process beats detection: verify through a second, trusted channel before moving money or sharing information.
What deepfake scams look like
New York's IT agency describes deepfakes as AI-manipulated photos, video or audio that imitate a real person's face, image or voice. The scams it lists fall into four groups:
- Business email and video-call compromise. Criminals impersonate executives to request wire transfers, payments or employee tax data.
- Investment and charity fraud. Fake videos of well-known figures promote bogus schemes.
- Extortion and "relative in trouble" calls. Fabricated clips or voices push victims to send money urgently.
- Phishing with a face. Realistic impersonations of coworkers or family make fraudulent messages more convincing.
Quick Heal adds the typical script: scammers build credibility with personal details pulled from social media, create urgency or secrecy, then push for money, one-time codes, login details or an app install. Once paid, they vanish.
Visual and audio warning signs
The FBI and American Bankers Association advisory, as reported by KnowBe4, lists these tells:
- Blurry or distorted facial features.
- Unnatural blinking or facial movements.
- Audio that doesn't match the video (lips out of sync).
- A flat or robotic tone of voice.
- Odd lighting or shadows.
Quick Heal adds blurring around the face and hairline, audio lag and a caller who refuses to change camera angle.
The crucial caveat: the advisory itself warns some deepfakes will show none of these signs. That's why the circumstances of a request are as important as its appearance.
Context red flags
- Pressure to act immediately or demands for secrecy.
- A request for money, one-time codes or passwords before any verification.
- An unusual payment method or new bank details.
- A push to move the conversation to a different app or channel.
- An "official" contacting you unexpectedly. Real agencies rarely initiate contact by chat and never require payment to recover lost money.
Verification beats detection
Detection gets harder every month, so the strongest defences are habits that don't depend on your eyes and ears:
- Pause. The FBI-ABA advisory says to stop and think before acting on urgent or emotional requests.
- Hang up and call back on a number you already know, not the one the caller gives you. Quick Heal adds confirming through a second channel like text or email.
- Ask a question only the real person could answer.
- Agree a family code word for emergencies and keep it off social media.
- Never share one-time codes, passwords or banking details on a call.
- For businesses: callback verification, dual approval for payments and bank-detail changes, and regular staff training on AI impersonation.
- Reduce your public footprint. Public photos, videos and recordings can be used to build convincing fakes.
Protect your accounts too
Deepfakes often team up with classic tricks like phishing. Use two-factor authentication (New York's agency recommends multi-factor authentication on accounts and devices), a password manager and learn the signs in phishing email examples. For phone-based fraud in particular, see our companion article on AI voice cloning scams.
If you think you've been targeted
- Stop communicating and don't send money, codes or documents.
- Contact your bank immediately if you transferred funds.
- Report to the FBI at ic3.gov, to local law enforcement and to the platform where it happened. In the US, also use ReportFraud.ftc.gov.
- Warn colleagues and family so the same trick doesn't work twice.
Build a verification culture
For businesses, the lesson is to make verification normal rather than rude. Node-devs can help you harden the systems around your people, from access controls to approval workflows in your internal tools.
References and further reading
This guide was compiled from the sources below. We compared them, kept the points they agree on and wrote the article in our own words. Check the originals for more detail.
- FBI issues guidance for avoiding deepfake scams (KnowBe4)
- Don't fall for deepfakes (New York State Office of Information Technology Services)
- Deepfake scam: how to spot AI video call fraud before it costs you money (Quick Heal)
- Scammers use AI to enhance their family emergency schemes (US Federal Trade Commission)
