What Is a Deepfake Scam? How AI Voice and Video Fraud Works

A deepfake scam is a fraud in which a criminal uses AI-generated audio, video, or images to impersonate a real person — a family member, a boss, a romantic interest, or a public official — to trick a victim into sending money or sensitive information. The technology has moved from research-lab curiosity to everyday fraud tool: the FBI's Internet Crime Complaint Center (IC3) warned in December 2024 that criminals now use generative AI to clone voices for fake emergency calls, stage deepfake video chats with fabricated executives, and manufacture fake IDs and disaster images, all to make old scams more convincing and harder to spot.

This explainer breaks down what a deepfake scam actually is, the real documented ways criminals are using voice-cloning and video deepfakes right now, and the concrete verification habits that regulators and investigators recommend to protect yourself and the people you care about.

What is a deepfake scam, exactly?

"Deepfake" describes synthetic media — audio, video, or still images — generated or altered by AI to make it appear that a real person said or did something they never did. A deepfake scam is simply fraud that uses this synthetic media as the hook. Instead of a scammer typing a convincing email, they call you in a voice that sounds exactly like your son's, or they join a video call looking and sounding like your company's CFO.

The underlying crimes are not new. Family-emergency scams, CEO impersonation fraud, and romance scams have existed for decades. What has changed is the fidelity of the impersonation. The FTC's March 2023 consumer alert on AI-enhanced family emergency schemes notes that a scammer may need only a short audio clip of someone's voice — easily pulled from a social media video — plus a voice-cloning program to produce a convincing fake.

How AI voice cloning works in scam calls

Voice cloning tools analyze a short sample of someone's speech and learn the patterns needed to generate new sentences in that voice — pitch, cadence, accent, even characteristic pauses. Scammers harvest the source clip from voicemail greetings, social media videos, YouTube appearances, podcast interviews, or webinar recordings, then feed it into cloning software to produce a script of their choosing: "Mom, I've been in an accident," or "This is the CEO, I need you to wire funds right now."

The FBI's December 2024 PSA describes exactly this pattern, noting that generative AI "significantly enhances the quality" of these scams and reduces the errors that used to tip victims off, such as poor grammar, mismatched translations, or an unnatural voice. The same PSA found scammers are using cloned voices both to fabricate emergencies and to impersonate account holders directly to banks or call centers in order to gain access to real accounts.

Family-emergency and "grandparent" voice-clone scams

This is the scenario regulators have warned about most consistently. A person receives a frantic phone call that sounds unmistakably like their grandchild, child, or spouse, saying they've been in a car accident, arrested, or kidnapped, and need money immediately — usually by wire transfer, cryptocurrency, or gift card. The FTC's family-emergency-scams guidance describes this exact pattern and stresses that the emotional pressure is the point: scammers want you to act before you think to verify.

The FTC's advice, repeated across its alerts, is specific and simple: don't trust the voice alone. Hang up, and call the family member back on a phone number you already know is theirs — not a number the caller gives you. If you can't reach them directly, check with another relative or friend who might know where they are. This is the same identity-verification instinct behind questions like the ones raised in comparisons of biometric login methods — the goal is always confirming a claimed identity through a channel the impostor doesn't control.

CEO fraud and business deepfake calls

Business email compromise has existed for years in text form — a spoofed email from "the CEO" urgently requesting a wire transfer. Deepfakes add audio and video to that playbook. The IC3's generative-AI PSA specifically flags scammers staging "deepfake video chats" and live calls impersonating executives or authority figures to authorize payments or extract sensitive company data. Because the request arrives in a voice or face an employee recognizes, normal skepticism toward an unexpected email can evaporate.

This is functionally the same social-engineering pressure covered in explainers on how social engineering attacks work: the attacker is manufacturing trust and urgency, and the deepfake is simply a more convincing costume. Finance and HR teams are the most common targets because they can move money or data directly.

Fake video calls and face-swap deepfakes

Beyond cloned audio, criminals increasingly use real-time face-swapping tools to join live video calls looking like someone else entirely — a company leader, a romantic partner, or a law-enforcement official. The FBI's PSA lists several recognizable flaws that still show up in live deepfake video even as the technology improves: distorted hands or teeth, irregular facial movement, lighting or shadows that don't match the background, visible watermarking artifacts, noticeable lag, and unnatural blinking or head movement. On the audio side, listen for odd word choice, flat emotional tone, or a cadence that doesn't match how the person actually talks.

In July 2026, the IC3 separately warned that scammers have gone a step further: using AI-generated video of senior FBI officials to direct previous fraud victims to a spoofed version of the IC3's own reporting website, re-victimizing people who had already lost money once. The lesson generalizes well beyond that specific scheme — a deepfake video doesn't just impersonate a loved one anymore; it can impersonate the very authority you'd turn to for help.

Romance scams: when the "person" on video isn't real

Romance scams were already the costliest form of imposter fraud tracked by the FTC before deepfakes entered the picture: the agency's February 2023 Data Spotlight found nearly 70,000 people reported losing a combined $1.3 billion to romance scams in 2022, with a median loss of $4,400 — more than ten times the median loss across other fraud types. Most of that contact started on social media (40%) or dating apps and websites (19%), and victims who were persuaded into sextortion rose more than eightfold since 2019.

Deepfakes close the one gap that used to expose most romance scammers: the refusal to appear on video. The FBI's generative-AI PSA notes criminals now stage live video chats or produce short clips to "prove" an online love interest is real, and use face-swapping to disguise their actual appearance, age, or gender during a video call. The psychology at play is close cousin to what we've described in our explainer on how pig butchering scams build trust before the financial trap — a long grooming period designed to make the eventual request for money feel like a natural next step in a real relationship, not a red flag.

Warning signs you may be talking to a deepfake

No single sign is proof, but several together — especially paired with urgency and a request for money — are a strong indicator you're dealing with synthetic media rather than the real person.

How regulators are responding

U.S. agencies have moved from guidance to enforcement tools over the past two years. In February 2024, the FCC issued a declaratory ruling classifying AI-generated voices in robocalls as "artificial" under the Telephone Consumer Protection Act — a move the agency said gives state attorneys general in all 48 states that have partnership agreements with the FCC a direct legal path to prosecute voice-cloning robocalls, separate from whatever scam the call was trying to run. The same month, the FTC finalized a rule banning impersonation of government agencies and businesses, and proposed extending that protection to cover impersonation of individuals specifically because of AI-driven voice cloning and deepfakes — then-Chair Lina Khan said fraudsters are "using AI tools to impersonate individuals with eerie precision and at a much wider scale." The FTC also ran a public Voice Cloning Challenge, whose winning entries focused on detecting whether a voice is human or synthetic and adding audio safeguards that make cloning harder.

How to protect yourself and verify who you're really talking to

The advice from the FTC and FBI across their alerts is remarkably consistent, because the underlying defense doesn't depend on spotting the deepfake itself — it depends on verifying identity through a channel the scammer doesn't control.

• Hang up and call back on a known number. If a "family member" or "executive" calls with an urgent money request, end the call and dial a number you already have for that person — never a number the caller provides.
• Set a family or team code word. The FBI recommends agreeing in advance on a word or phrase that only real family members or colleagues would know, to use when verifying a sudden request by phone or video.
• Verify through a second channel. If you can't reach the person directly, confirm the story with another relative, friend, or coworker before sending anything.
• Be suspicious of irreversible payment requests. Wire transfers, cryptocurrency, and gift cards are the common thread across family-emergency, romance, and CEO-fraud cases because they're nearly impossible to claw back.
• Limit what the public can clone. Set social media accounts to private where practical and think twice before posting long clips of your own voice or face publicly; both are raw material for cloning.
• Watch for the visual and audio tells listed in the warning-signs table above during any unexpected video call.
• Don't negotiate in isolation. Scammers push urgency and secrecy specifically to prevent you from checking in with someone else — treat insistence on secrecy itself as a red flag.

The same verify-independently principle underlies most modern identity-security advice: never trust a single, spoofable signal on its own.

What to do if you've been targeted or victimized

If you receive a suspicious call or video chat, don't engage further — hang up and verify independently as described above. If you've already sent money or shared sensitive information, act quickly: contact your bank or payment provider immediately to attempt to reverse or flag the transaction, change any passwords or account details you may have shared, and report the incident. U.S. residents can file a complaint with the FTC at ReportFraud.ftc.gov or with the FBI's Internet Crime Complaint Center at ic3.gov, including the scammer's phone number or handle, how contact began, and what was requested — these reports are what let agencies like the FTC and FBI track emerging deepfake-scam patterns and build cases.

What next

Deepfake scams will keep improving in fidelity, but the countermeasures that work today — independent verification, code words, skepticism toward urgency and secrecy, and caution around irreversible payments — don't depend on out-detecting the AI. They depend on habits. Agree on a family verification phrase now, before you need it. Talk to older relatives, who are disproportionately targeted by emergency-call scams, about the specific mechanics described above. And if your workplace handles wire transfers, push for a standing policy that no payment request is actioned on a phone or video call alone, no matter how convincing the voice or face looks.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage