Scam emails used to give themselves away. You’d see a clumsy greeting, a pixelated logo, and a stranger who needed a wire transfer by Friday. Most people learned to spot that at a glance, and now the glance doesn’t help much. AI can write a polite, typo-free message in almost any language, and some tools can copy a person’s voice from a few seconds of audio.
Ask the finance worker at Arup’s Hong Kong office. In early 2024 he joined a video call with what looked and sounded like the firm’s CFO and several colleagues. He’d actually been wary of the email that set up the meeting. But the faces were familiar and the voices were right, so he made 15 transfers totaling about $25.6 million. Everyone else on that call was a deepfake.
So spotting fakes isn’t a winning strategy anymore. What still works is a set of dull, reliable habits: calling people back, being picky about where your passwords live, and letting software check what your eyes can’t. Whether you use a mainstream cloud service or a self hosted password manager you run yourself, the habits matter more than the brand.
What AI Actually Changed
The fraud itself is old. Fake bank alerts, “your package is stuck,” the cousin stranded abroad. AI just made all of it cheaper to produce and much easier to believe.
Phishing emails now read like real support messages, with the right tone and no typos. Scammers also scrape social media and leaked data, so a message can mention your employer, your city, or the gym you joined last month. Voice cloning closes the loop. The FBI has warned that since April 2025, criminals have used AI-generated voice messages to impersonate senior US officials. If they can fake a senator, they can fake your brother.
That doesn’t make every message suspect. It means “this looks sloppy” was never a security system, and it’s stopped working anyway. The same tools now power fake shops and voice clones aimed at ordinary shoppers, not just officials.
Pressure Is the Tell
Nearly every scam wants you moving fast. Maybe your account closes in an hour, or a payment just bounced. Maybe your boss needs gift cards before a meeting. The urgency is the whole trick, because people who stop to think tend to catch the scam.
So make it a reflex. If a message makes your stomach drop, wait before you click or reply. Your bank won’t shut you out over a text you ignored for ten minutes.
Call Back on a Number You Already Have
When an alert claims to be from your bank, email provider or a courier, ignore its link and phone number entirely. Open the official app, or type the website address yourself. If the problem is real, it’ll show up there.
Phone calls get the same treatment. A panicked relative asking for money? Hang up and call the number saved in your contacts. Some families pick a code word for emergencies. It feels a bit like a spy movie, but it beats voice cloning neatly, because a clone can copy how your sister sounds without knowing what she knows.
At work, the Arup case makes the point better than any policy memo. One callback to the real CFO, on a number the employee already had, would have ended the scam before the first transfer. A face on a video call doesn’t prove who’s behind it anymore.
Stop Reusing Passwords
This one gets skipped constantly, and it causes more damage than anything else on this list. Sites get breached all the time. Attackers take the leaked email-and-password pairs and try them everywhere else, from your inbox to your Amazon account to your bank. Reuse a password once and one leak can unlock all of them.
Nobody can memorize forty long random passwords, so let a password manager do it. It generates them, stores them and fills them in.
It also catches lookalike sites better than you can. Most password managers only fill in a login on the exact web address where you saved it. A fake page might fool you at 11 p.m. on your phone, but it won’t fool that address match. If your password manager suddenly has nothing to offer on a login page, stop and look at the URL.
Cloud or Self-Hosted?
For most people, a well-known cloud password manager is the right call. It’s easy, it syncs everywhere, and someone else handles the servers.
Some people want the vault closer to home, though, especially freelancers, small agencies and anyone holding client logins. Self-hosting means the encrypted vault sits on a server you control instead of a vendor’s.
That control comes with chores. You’re the one patching the server, testing backups and locking it down. If you know you’ll let updates slide for six months, a reputable hosted service is probably safer for you. Pick the option you’ll actually maintain.
Either way, guard the vault with a long master passphrase and turn on two-step verification for it.
Add a Second Lock, Ideally a Passkey
A strong password can still be typed into a convincing fake page. That’s why a second step helps. A code from an authenticator app or a tap on a hardware security key blocks a lot of those attacks.
Passkeys go further. Each one is tied to the real website’s address, so it simply won’t work on a fake page, however polished. Like password autofill, it takes the judgment call away from you, and that matters now that attackers run campaigns at machine speed. AI agents have already cut the cost of hacking to a few dollars per attempt, which means more attempts landing in more inboxes.
Text-message codes are still better than nothing. An authenticator app or a security key is better still.
Your Quick Checklist
- Treat urgency as a reason to slow down.
- Check alerts in the official app, not through the link you got.
- Give every account its own password, and keep them in a password manager.
- Turn on two-step verification, plus passkeys where offered.
- Agree on an emergency code word with family.
- Install phone and app updates when they arrive.
Make the Fakes Irrelevant
AI made scams prettier, not unstoppable. You don’t need to win a staring contest with a deepfake. Call back on numbers you trust, keep passwords unique, and let autofill and passkeys check the web address for you. An afternoon of setup shuts most of the doors these scams rely on.
Related: AI Phishing Is Changing: Is Your MSP Security Training Keeping Up?
