Kathryn Jones — Founder, The Identity Vault

Kathryn built The Identity Vault to stop scams before they happen. Updated April 2026.

Last Updated: April 2026 · 10 min read

In early 2024, a finance worker at a multinational company in Hong Kong joined a video call with several colleagues, including the company’s CFO. Over the course of the call, he was instructed to process 25 transactions totaling $25 million.

Every person on that video call was a deepfake. The CFO, the colleagues, the voices — all AI-generated in real time, using publicly available footage of real employees. The finance worker did not realize what had happened until days later.

Twenty-five million dollars. One video call. No one in the room was real.

This is not a story from a science fiction movie. It was reported by the Hong Kong Police in February 2024. And it represents a new category of fraud that is now operating at scale — targeting not just corporations, but ordinary families, elderly parents, small business owners, and anyone who uses a phone, a computer, or the internet.

2026 is the year AI-powered scams went fully mainstream. The tools that were expensive and experimental as recently as 2024 are now cheap, accessible, and widely deployed by criminal organizations around the world. If you have not updated your threat model in the last 18 months, you are defending against the last generation of scams while the current one has already moved on.

Why AI Changed Everything About Scams

The traditional warning signs of a scam — bad grammar, obvious lies, implausible scenarios — worked because scammers were limited. They operated with limited language skills, limited technical tools, and limited information about their targets. A scam email with five spelling errors and a Nigerian prince story was easy to spot.

AI eliminated those limitations almost entirely.

Language is now perfect. AI generates grammatically flawless text in any language, in any tone, calibrated to sound like whoever it is pretending to be. The “obvious fake” email does not exist anymore. A phishing email from your bank now reads exactly like a real email from your bank — because it was written by the same AI tools that banks use to generate communications.

Personalization is now automatic. Data brokers sell detailed personal profiles for pennies per record — your name, address, employer, family members’ names, spending habits, social media posts. AI scam tools ingest this data and personalize every contact. The email references your actual bank. The phone call mentions your actual neighborhood. The message knows your brother’s name. This specificity destroys the “they don’t know anything about me” defense that used to protect people.

Scale is now unlimited. A human scammer can run maybe a dozen active conversations at once. An AI system can run ten thousand simultaneously — with no fatigue, no inconsistencies, no slip-ups that would reveal the deception. Criminal operations that used to need large call centers can now operate with minimal staff, using AI to do the actual contact work.

Speed has become a weapon. AI tools can identify a potential victim, research them, craft a personalized contact, and initiate the first message in minutes. The speed of targeting has accelerated beyond any realistic human ability to screen for it.

AI Voice Cloning: When Your Child’s Voice Calls You

This is the one that keeps me up at night.

AI voice cloning tools — some of them free and publicly available — can generate a convincing replica of anyone’s voice from three to ten seconds of audio. Three seconds. That is less than one sentence. It is the length of a voicemail greeting. It is the length of a video someone posted to social media two years ago.

The attack is simple: a scammer finds a voice sample of your child, grandchild, or sibling online. They use a cloning tool to replicate that voice. They call you — usually late at night or very early morning when defenses are lowest — and you hear the voice of someone you love, in obvious distress, telling you there has been an accident, an arrest, a medical emergency.

The emotional impact is immediate and overwhelming. Your heart rate spikes. Your rational thinking shuts down. You want to help. That is what they are counting on.

The defense: A family safe word. This is a private word or phrase that only real family members know — agreed on in advance, written down, shared only within the family. Any caller claiming to be a family member in an emergency must know this word when asked. AI cannot know your private family safe word. This single system defeats voice cloning scams entirely.

Deepfake Video Scams

If voice cloning is the threat of today, deepfake video is the threat of right now. The Hong Kong case described at the start of this article was the headline — but smaller-scale deepfake video scams are running daily against ordinary people.

The most common versions in 2026:

Fake investment advisor video calls. A scammer reaches out on social media posing as a financial advisor. When the target asks for a video call, they produce one — using deepfake technology to appear as a credible, well-dressed professional. They then guide the victim through depositing money into a fraudulent investment platform.

CEO fraud upgraded with video. An employee receives a video message from what appears to be their company’s CEO, directing them to process an urgent wire transfer to a new vendor. The face and voice match. The request seems official.

Romance scam video verification. A target in a long-running online romance asks their “partner” to video call to verify they are real. The scammer produces a deepfake call — pre-generated or live — that passes a visual check. The relationship continues. The financial requests follow.

AI Romance Scams at Industrial Scale

Romance scams have always been devastating — but they used to be limited by the sheer human effort required to maintain convincing relationships with multiple targets at once. An individual scammer could manage perhaps a dozen relationships before the quality degraded and targets became suspicious.

AI removed that ceiling.

Criminal operations now deploy AI chatbot systems that can maintain thousands of simultaneous “relationships” — each one personalized to the individual target, each one consistent, each one emotionally calibrated based on the target’s responses. The AI remembers details from previous conversations. It celebrates birthdays. It references things the target mentioned weeks ago. It builds genuine emotional intimacy — genuine on one side, completely artificial on the other.

When the financial request comes — after weeks or months of relationship-building — it feels different from a cold fraud attempt. It feels like asking a real partner for help. And the AI is programmed to know exactly when the emotional investment has reached the level where that request is most likely to succeed.

The FBI’s most recent Internet Crime Report documented $650 million in losses from romance scams in the FBI’s most recent Internet Crime Report — and notes this is almost certainly a significant undercount due to shame-related underreporting.

AI-Generated Phishing That Knows Your Life

The phishing emails and texts of 2026 are not the Nigerian prince messages of 2010. They are personalized, contextually accurate, and often indistinguishable from legitimate communications — even to trained eyes.

AI phishing tools work by combining your personal data (scraped from data breaches, social media, public records, and data broker databases) with language models that generate contextually appropriate messages. The result is a phishing email that:

• Knows your actual bank and references your actual branch
• References recent activity — a purchase, a travel booking, an insurance renewal — that is real and verifiable
• Uses your actual name, and sometimes the name of a real employee at your bank
• Arrives at a time when you are likely to be checking email — based on your social media patterns
• Contains no spelling errors, no suspicious formatting, no tells from the previous generation of phishing

Fake AI Investment Platforms

A specific category of AI scam deserves its own section because it is responsible for some of the largest individual losses in 2025 and 2026: fake AI investment platforms.

The pitch is consistent: an “AI trading system” or “AI crypto arbitrage tool” that delivers consistent, impressive returns — often 20–40% monthly. The platform looks professional. It shows real-time account balances that grow convincingly. Customer service is responsive. Withdrawals of small amounts are sometimes permitted to build trust. Then, when a significant sum has been deposited — anywhere from $10,000 to several hundred thousand dollars — the platform goes dark and the money is gone.

The platforms use AI to generate convincing trading histories, to man customer service chat systems that sound knowledgeable and reassuring, and to identify the moment when a victim’s investment has reached optimal withdrawal for the criminal operation.

The rule here is absolute: Any investment opportunity that cannot be verified through a licensed broker registered with the SEC or FINRA, that promises guaranteed or consistent returns regardless of market conditions, or that you learned about through social media or an unsolicited contact — is a scam. 100% of the time. No exceptions.

How to Defend Against AI Scams in 2026

The defenses against AI scams are not dramatically different from the defenses against traditional scams — but they need to be applied more rigorously, because the attacks are more sophisticated.

Build verification into every financial decision. No money moves — no wire transfers, no gift cards, no Zelle payments, no investment deposits — without a verification step that happens off the channel of the original contact. If someone emails you with an urgent request, call them on a number you already have. If someone texts you, call back. If someone calls you, tell them you will call back — and call the official number, not the one they give you.

Create a family safe word. Defeats AI voice cloning entirely. Set one up tonight.

Slow down. AI scams are engineered around urgency. The urgency is artificial — it is designed to prevent you from doing the one thing that would stop the scam: taking time to verify. Any communication that demands immediate action and threatens consequences for delay deserves your maximum suspicion, regardless of how legitimate it looks.

Freeze your credit. AI-powered identity theft operations use stolen personal data at industrial scale. A credit freeze costs nothing and blocks the most financially damaging consequences — new accounts opened in your name — regardless of how much personal data a criminal has acquired.

Assume your personal data has already been compromised. Multiple major data breaches in the last five years have exposed hundreds of millions of Americans’ personal information. Your name, address, date of birth, and possibly your Social Security number are likely already in criminal databases. Operating on the assumption that your data is already out there leads to better security practices than assuming it is protected.

The honest message about AI scams in 2026 is uncomfortable: the technology available to criminals has improved faster than most people’s awareness of it. The gap between what scammers can do and what most people expect them to be capable of is currently very wide.

Closing that gap is exactly what this guide is for. The voice on the phone might not be your grandson. The face on the video call might not be your CFO. The email from your bank might not be from your bank.

Verify everything. Slow down on anything urgent. Trust the instinct that says something is slightly off.

The scammers are using the best tools available. Now you know what those tools can do.