AI Scams in 2026: How to Protect Yourself and Your Family

The best protection against AI scams in 2026 is a set of family rules and account settings that still work when the voice or face on the other end seems real. Agree on a family safe word, make it a rule that money never moves because of a single call, video or text, and always hang up and call back on a number you already have saved. Then lock the accounts themselves: alerts on every transaction, two-factor authentication on your bank and email, and your real savings kept away from the account your cards and payment apps touch.

You can't rely on your ears: three seconds of audio is enough to clone a voice with an 85% match, according to McAfee's voice-cloning research, and detector apps do little better than a coin toss on real-world fakes. What happens after a scam also depends on where you live. UK banks now have to refund most push-payment scam victims, US banks usually don't have to when you sent the money yourself, and the EU has agreed a narrower refund rule for bank-impersonation scams that isn't in force yet. The recovery section below has the details.

The classic version of the scam goes like this. Late at night the phone rings and it's your son, shaky and scared. He's been in a car accident, he needs money wired for bail before morning, and please don't tell Dad. It sounds exactly like him, because it was built from a short clip he posted online. The FTC warns about this family-emergency script, and its advice is blunt: don't trust the voice, call the person back on a number you know is theirs.

With a family safe word, you ask the caller for it. A cloned voice can't give it, so you hang up and call your son on the number saved in your phone. Agreeing on the word takes a few minutes, and you do it long before a call like this comes.

---

Are AI Scams Getting More Common? The 2025 Numbers

Yes, and the official counts probably understate it.

The FBI's Internet Crime Complaint Center (IC3) logged 1,008,597 complaints and $20.9 billion in reported losses in 2025, up 26% on 2024, according to its 2025 annual report. That total covers all internet crime, not only AI. For the first time in the report's 25-year history, the FBI also broke out AI-related complaints as their own category: 22,364 complaints and about $893 million in losses. The report itself suggests that slice is too small. Investment-scam losses alone passed $8 billion, and many victims never realize how much AI was involved.

For households, another figure in the same report matters more: 85% of 2025 losses came from cyber-enabled fraud, meaning schemes that talk a person into paying or handing over access, rather than attacks that break into systems.

The FTC's data says the same thing from another angle. Americans reported about $16 billion lost to fraud in 2025, the highest on record and roughly 25% more than in 2024, and $3.5 billion of that went to imposters, nearly three times the 2020 figure. Among fake businesses, bank impersonators did the most damage, and fake government officials took about $920 million.

Looking forward, Deloitte's Center for Financial Services projects that fraud losses enabled by generative AI in the US could reach $40 billion by 2027, up from $12.3 billion in 2023, which Deloitte puts at 32% compound growth a year. Part of the reason is price: Deloitte notes that scam software sells on the dark web for anything from $20 to thousands of dollars.

These are US numbers because the US publishes the most detailed ones, but the same scripts run elsewhere. McAfee's survey covered nine countries, including the UK, Germany and France, and one in four people said they had experienced an AI voice-cloning scam or knew someone who had.

Unlike a dip in your portfolio, money wired to a scammer is usually gone for good, so one phone call can wipe out years of savings.

---

The Five AI Scams Hitting People's Money Now

Each of these scams existed before generative AI. What AI adds is a familiar voice, a face on a video call, or thousands of personalized messages run by one operator.

1. The voice-clone emergency call. The call above. The raw material is usually public: a TikTok, a voicemail greeting, a podcast clip. The scammer types and the software speaks in a voice you trust. Fake kidnapping calls use the same trick: the FBI warns that criminals clone a relative's voice to stage a crisis and ask for urgent money or demand a ransom. CrowdStrike counted a 442% jump in voice phishing between the first and second half of 2024, in attacks that included callback phishing and help-desk social engineering.

2. The live deepfake video call. The best-known case hit Arup, the British engineering firm. A finance worker in Hong Kong suspected that an email asking for a secret transaction was phishing. Then he joined a video call where the CFO and several colleagues looked and sounded right, and he made 15 transfers totaling HK$200 million, about $25.6 million. Everyone else on that call was a deepfake.

3. Fake bank alerts by text and phone. A text that looks like it came from your bank: "Did you authorize a $899 payment to M. Rivera? Reply NO." You reply NO. Seconds later a calm "fraud team" calls, sometimes with your bank's name on caller ID, and walks you through moving your money to a "safe account". The safe account belongs to the scammer. Fake fraud alerts were the FTC's third most-reported text scam of 2024, and in 2025 bank impersonators caused the highest losses of any business that scammers pretended to be.

4. AI romance and investment bots. Generative AI lets one operator keep a lot of believable conversations going at once. The IC3 report describes AI producing convincing social media profiles and personalized conversations "often in mass quantities". The trust gets built over weeks before the "opportunity" shows up. Investment fraud alone accounted for $8.6 billion of the 2025 IC3 losses.

5. Delivery texts, QR codes and payment-app traps. "Your parcel is held. Pay a $1.99 redelivery fee." The fee is small; what the scammer wants is your card details. Fake package-delivery texts were the FTC's most-reported text scam of 2024, and Americans reported $470 million lost to text scams that year, more than five times the 2020 figure.

---

Deepfake Tax Scam Calls: What the IRS and HMRC Never Do

Scammers like posing as the tax office because almost everyone owes it something and few people want to argue with it on the phone. Security researchers reported fraudsters using AI-generated audio to impersonate IRS officials and tax preparers during the 2025 filing season, sometimes offering to "help" set up an online tax account while fishing for financial details.

Instead of judging the voice, check what the caller is asking for:

• The IRS says it generally contacts people by mail first, and that it does not leave urgent, threatening prerecorded messages, call to demand immediate payment, or threaten arrest (2026 "Dirty Dozen" scam list, March 2026).
• HMRC warns about an automated call claiming it is "filing a lawsuit against you" and asking you to press 1 to pay a caseworker. Its advice: if you can't verify who is calling, don't speak to them.
• A demand to pay a tax bill by gift card, crypto or a wire to a "safe account" is the giveaway. The FTC lists exactly those payment methods as red flags.

The fix is the same callback rule as for family calls. Hang up. Log in to your tax account through the official website or app you already use, or call the number printed on a letter you already have. In the UK you can forward scam texts to HMRC on 60599 and scam emails to phishing@hmrc.gov.uk.

---

Why Smart People Fall for It

Being smart doesn't protect you much, because these scams work on emotion before you've had time to think.

The levers are urgency, authority, fear and isolation. The late-night call is urgent (bail by morning), carries authority (it's "your son"), is frightening (he's hurt) and isolates you ("don't tell Dad"). When all four hit at once, most people act before they've thought it through. Verizon's 2024 Data Breach Investigations Report found that the median time for people to fall for a phishing email is under 60 seconds: 21 seconds to click, then 28 more to type in their details.

Don't file this under "grandparent problem" either. In the FTC's 2024 data, people in their 20s said they had lost money in 44% of the frauds they reported, against 24% for people in their 70s. Older victims lose more each time: a median of $1,650 for people 80 and over, versus $417 for people in their 20s. So younger people lose money more often, and older people lose more when they do.

And don't count on a detector app. When Australia's CSIRO and Sungkyunkwan University tested 16 leading deepfake detectors on real-world fakes, they scored between 39% and 69%, about 55% on average. The safe word and call-back rule below don't depend on spotting the fake at all.

---

How to Set Up a Family Safe Word

The FBI recommends a family safe word directly: "Create a secret word or phrase with your family to verify their identity." It works because an AI can only say what the scammer types, and it can't know a word that was never posted online.

How to set it up today:

• Pick a word or phrase that's boring and un-Googleable. Not a pet's name, not a street you've lived on, nothing that has ever been on social media. "Blue otter." "Rusty teapot." Nobody outside the family should be able to guess it.
• Tell your immediate family, ideally in person rather than in a group chat that lives forever. Ask everyone to memorize it, not screenshot it.
• Set the rule: money never moves on a single call. Whatever the story and however real the voice sounds, nobody sends anything until the caller has given the safe word and you've called back.
• Add a callback rule. If a "relative" calls in a crisis, hang up and call them back on the number already saved in your phone. Caller ID can be faked, so don't trust it. If they don't answer, call another family member. The FBI gives the same advice for a call from your "bank": hang up, look up the number yourself, call it directly.

---

Lock Down the Money: Account-Level Defenses Most People Never Turn On

Beyond the safe word, your bank and broker have settings almost nobody switches on. Four of them work wherever you bank:

• Alerts on every transaction, small ones included. A push notification on a $1 charge is how you catch a test transaction before the big one lands.
• Two-factor authentication (2FA) everywhere, banking, email and social media especially. Whoever controls your email can reset most of your other passwords.
• Holds or delays on large transfers. Ask your bank whether it offers a cooling-off window on big outgoing payments. That delay gives you time to call someone and check before the money leaves.
• Spending and savings in separate accounts. Keep day-to-day money in one account and your real savings in another with no debit card and no link to payment apps. Then a scammer who gets into your everyday account, or talks you into paying from it, can only reach what's in that account.

The rest depends on your country.

In the euro area, read the name check. Since 9 October 2025, banks have had to check that the payee's name matches the IBAN before a euro transfer goes out, and to tell you whether it's a match, a close match or no match. If you get a "no match" on a payment someone is pressing you to make, stop and don't send it.

In the US, freeze your credit and block what you don't use. A credit freeze is free and stops anyone, you included, from opening new credit in your name, but you have to place it separately at Equifax, Experian and TransUnion. If you don't write checks, ask your bank about a "post no checks" block, and ask about an ACH block or filter to stop unauthorized electronic pulls.

---

Monitoring Your Accounts Without Linking Them

Alerts catch problems as they happen. The other half is a regular look at every account.

Once a week, or at least once a month, spend 15 minutes scanning your accounts for anything you don't recognize. It's the same habit as a subscription creep audit, and a fraudulent charge turns up the same way a forgotten subscription does.

Be careful with one popular shortcut, though. A lot of new "AI finance assistants" ask you to link every bank account through a third-party aggregator so a chatbot can read your transactions. That puts live access to all your accounts in one place, which is exactly the kind of target scammers go after. The ChatGPT personal finance review walks through the red flags before you link anything.

If you'd rather not link anything, the monthly statements your bank already sends you are enough. Read each one line by line, and don't type your bank login into any app that isn't your bank's own.

---

Protecting the People You Love: A Plan for Parents and Kids

For aging parents, who lose the most per incident: combined losses reported by older Americans who lost more than $100,000 rose eight-fold between 2020 and 2024, from $55 million to $445 million, according to the FTC. Sit down and set up a shared family safe word with them. Ask their bank about view-only or trusted-contact access so you can spot trouble without taking over their independence. And gently help them shrink their social-media footprint, because every public voicemail greeting and video is voice-cloning material. If you're supporting parents while raising kids, the sandwich generation guide covers how to carry both loads and keep saving.

For teens and young adults, who get caught most often: remind them that scams are not a grandparent problem, that a "redelivery fee" text was the FTC's most-reported text scam of 2024, and that their TikToks and reels are raw material for the next clone. The same safe word protects them too.

The FBI's advice covers the whole family: limit public video and audio of yourself, make accounts private, and keep followers to people you know, so there is less public audio to clone.

---

If It Already Happened: The First-24-Hours Recovery Checklist

If you've already sent money or shared details, don't wait until you feel less embarrassed. Work through this list today:

1. Call your bank's fraud line immediately and freeze the affected accounts. The faster you move, the better the odds of stopping or recalling a transfer.
2. Change every credential: banking logins, PINs and especially your email password. Turn on 2FA if it wasn't on already.
3. Report it to the fraud reporting service where you live (table below). Under the EU's upcoming rules, a refund for a bank-impersonation scam will depend on a police report, so file one early wherever you are.
4. If your identity details were stolen and you're in the US, use IdentityTheft.gov for a step-by-step recovery plan.
5. Document everything: screenshots, times, amounts, phone numbers. It's what investigators and your bank will ask for.

Whether you get the money back depends heavily on your country:

Where you live	Where to report	Will the bank refund you?
United States	ic3.gov (FBI) and ReportFraud.ftc.gov. People 60+: National Elder Fraud Hotline, 833-372-8311 (Mon–Fri, 10 a.m. to 6 p.m. ET)	Often not. Regulation E covers unauthorized electronic transfers, but money you sent yourself after being tricked usually counts as authorized, and wires typically can't be reversed.
United Kingdom	Report Fraud (reportfraud.police.uk, 0300 123 2040), which replaced Action Fraud in December 2025. In Scotland, Police Scotland on 101	Usually yes for Faster Payments and CHAPS: mandatory reimbursement up to £85,000 per claim since 7 October 2024. In the first nine months, 88% of the money claimed back was returned.
European Union	Your national police and your bank, straight away	Depends on the country for now. A rule that makes banks refund victims of bank-impersonation scams was agreed in November 2025, but it still needs formal adoption and is expected to apply around 2028.

This is where an emergency fund matters. Cash in a separate savings account keeps the bills paid while you try, possibly without success, to get the money back, so you don't have to cover the gap with high-interest debt.

---

Your Fraud-Proofing Checklist

Here is everything above in one table. Almost all of it is free, and most of it fits into an afternoon.

Defense	Where	Cost	Time
Family safe word + callback rule	In person, with family	Free	2 min
2FA on bank, email, social	App settings	Free	10 min
Alerts on every transaction	Bank app	Free	5 min
Credit freeze at all 3 bureaus (US)	Bureau websites	Free	15 min
ACH block / "post no checks" (US)	Call your bank	Free–low	1 call
A monthly look at every account	Your bank statements	Free	15 min a month

Start with the safe word and the call-back rule, because they are the only items here that help during the call itself. Then go through the same list with your parents, or with anyone else likely to get that call.