AI Scams in 2026: How to Protect Yourself and Your Family

The best protection against AI scams in 2026 is a set of family rules and account settings that still work when the voice or face on the other end seems real. Agree on a family safe word, make it a rule that money never moves because of a single call, video or text, and always hang up and call back on a number you already have saved. Then lock the accounts themselves with alerts on every transaction, two-factor authentication on your bank and email, and your real savings kept away from the account your cards and payment apps touch.

Three seconds of audio is enough to clone a voice with an 85% match, according to McAfee's voice-cloning research, and detector apps do little better than a coin toss on real-world fakes. After a scam, UK banks now have to refund most push-payment scam victims, US banks usually don't have to when you sent the money yourself, and the EU has agreed a narrower refund rule for bank-impersonation scams that isn't in force yet.

In the classic version, the phone rings late at night and it's your son, shaky and scared. He's been in a car accident, he needs money wired for bail before morning, and please don't tell Dad. It sounds exactly like him, because it was built from a short clip he posted online. The FTC warns about this family-emergency script, and its advice is to call the person back on a number you know is theirs instead of trusting the voice.

With a family safe word, you ask the caller for it, and when a cloned voice can't give it, you hang up and call your son on the number saved in your phone.

---

Are AI Scams Getting More Common in 2026?

Yes. The FBI's Internet Crime Complaint Center (IC3) logged 1,008,597 complaints and $20.9 billion in reported losses in 2025, up 26% on 2024, according to its 2025 annual report, a total that covers all internet crime. For the first time in the report's 25-year history, the FBI also broke out AI-related complaints as their own category: 22,364 complaints and about $893 million in losses, a slice the report itself suggests is too small.

The same report attributes 85% of 2025 losses to cyber-enabled fraud, meaning schemes that talk a person into paying or handing over access, rather than attacks that break into systems.

Americans told the FTC they lost about $16 billion to fraud in 2025, the highest on record and roughly 25% more than in 2024, and $3.5 billion of that went to imposters, nearly three times the 2020 figure. Bank impersonators did the most damage of any fake business, and government impersonators took about $920 million.

Looking forward, Deloitte's Center for Financial Services projects that fraud losses enabled by generative AI in the US could reach $40 billion by 2027, up from $12.3 billion in 2023, which Deloitte puts at 32% compound growth a year. Deloitte also notes that scam software sells on the dark web for anything from $20 to thousands of dollars.

Outside the US, McAfee's survey of nine countries, including the UK, Germany and France, found that one in four people had experienced an AI voice-cloning scam or knew someone who had.

---

The Five AI Scams Hitting People's Money Now

1. The voice-clone emergency call. The raw material is usually public, such as a TikTok, a voicemail greeting or a podcast clip. The FBI warns that criminals clone a relative's voice to stage a crisis and ask for urgent money or demand a ransom, the same script fake kidnapping calls run on. CrowdStrike counted a 442% jump in voice phishing between the first and second half of 2024, in attacks that included callback phishing and help-desk social engineering.

2. The live deepfake video call. The best-known case hit Arup, the British engineering firm. A finance worker in Hong Kong suspected that an email asking for a secret transaction was phishing. Then he joined a video call where the CFO and several colleagues looked and sounded right. Every one of them was a deepfake, and he went on to make 15 transfers totaling HK$200 million, about $25.6 million.

3. Fake bank alerts by text and phone. A text that looks like it came from your bank: "Did you authorize a $899 payment to M. Rivera? Reply NO." You reply NO, and seconds later a calm "fraud team" calls, sometimes with your bank's name on caller ID, and walks you through moving your money to a "safe account" that belongs to the scammer. Fake fraud alerts were the FTC's third most-reported text scam of 2024, and in 2025 bank impersonators caused the highest losses of any business that scammers pretended to be.

4. AI romance and investment bots. Generative AI lets one operator keep a lot of believable conversations going at once. The IC3 report describes AI producing convincing social media profiles and personalized conversations "often in mass quantities". The trust gets built over weeks before the "opportunity" shows up. Investment fraud alone accounted for $8.6 billion of the 2025 IC3 losses.

5. Delivery texts, QR codes and payment-app traps. "Your parcel is held. Pay a $1.99 redelivery fee." The small fee is a way to collect your card details. Fake package-delivery texts were the FTC's most-reported text scam of 2024, and Americans reported $470 million lost to text scams that year, more than five times the 2020 figure.

---

AI Scam Trends to Watch in 2026

• Bots that run the whole conversation. Experian's 2026 fraud forecast expects generative AI bots to run romance and "relative-in-need" scams "without a human behind the keyboard", so one operation can work far more victims at once. On the phone, AI bots can run thousands of vishing calls at the same time and adjust the script to how you answer.
• Cloned websites. The same forecast expects AI-copied bank and shop sites to keep coming back after takedowns, collecting logins and card numbers. Type your bank's address yourself or use its app.
• Fake data-breach notices. ESET warns that scammers invent breaches, or piggyback on real ones, and use AI to write convincing notices in the local language. With 3,322 US breaches reported in 2025 and nearly 280 million notices emailed to victims, a fake one blends in. Check any breach notice by logging in to the company's site directly, never through the link in the message.

---

Deepfake Voice Call Tax Scams: What the IRS and HMRC Never Do

The IRS put "AI-enabled IRS impersonation by phone", meaning robocalls, voice mimicry and spoofed caller ID, second on its 2026 "Dirty Dozen" list of filing-season scams. The calls columnist Michelle Singletary described in March 2026 came from a "Tax Resolution Oversight Department", told people their account was "listed for verification" and pitched "IRS liability reduction programs" that the FTC says aren't real; the same column notes that AI lets scammers create messages that don't sound robotic. Security researchers reported fraudsters using AI-generated audio to impersonate IRS officials and tax preparers as early as the 2025 filing season, sometimes offering to "help" set up an online tax account while fishing for financial details. The IRS says to create that account yourself on IRS.gov and to ignore unsolicited offers of help.

• The IRS says it generally contacts people by mail first, and that it does not leave urgent, threatening prerecorded messages, call to demand immediate payment, or threaten arrest (2026 "Dirty Dozen" scam list, March 2026).
• HMRC warns about an automated call claiming it is "filing a lawsuit against you" and asking you to press 1 to pay a caseworker. Its advice is not to speak to a caller you can't verify.
• A demand to pay a tax bill by gift card, crypto or a wire to a "safe account" matches the payment methods the FTC lists as red flags.

As with family calls, hang up and log in to your tax account through the official website or app you already use, or call the number printed on a letter you already have. HMRC warns that numbers can be spoofed, so don't trust caller ID. It logged more than 135,500 HMRC-related scam reports in the ten months to December 2025. In the UK you can forward scam texts to HMRC on 60599 and scam emails to phishing@hmrc.gov.uk.

---

Why Do Smart People Fall for AI Scams?

These scams work on four levers before you've had time to think: urgency, authority, fear and isolation. The late-night call is urgent (bail by morning), carries authority (it's "your son"), is frightening (he's hurt) and isolates you ("don't tell Dad"). Verizon's 2024 Data Breach Investigations Report found that the median time for people to fall for a phishing email is under 60 seconds (21 seconds to click, then 28 more to type in their details).

In the FTC's 2024 data, people in their 20s said they had lost money in 44% of the frauds they reported, against 24% for people in their 70s. Older victims lose more each time, a median of $1,650 for people 80 and over, versus $417 for people in their 20s.

When Australia's CSIRO and Sungkyunkwan University tested 16 leading deepfake detectors on real-world fakes, they scored between 39% and 69%, about 55% on average.

---

How to Set Up a Family Safe Word

The FBI recommends a family safe word directly: "Create a secret word or phrase with your family to verify their identity."

• Pick a word or phrase that's boring and un-Googleable. Skip pets' names, streets you've lived on and anything that has ever been on social media. "Blue otter." "Rusty teapot."
• Tell your immediate family, ideally in person, since a group chat keeps the word forever. Ask everyone to memorize it.
• Set the rule: money never moves on a single call. Whatever the story and however real the voice sounds, nobody sends anything until the caller has given the safe word and you've called back.
• Add a callback rule. If a "relative" calls in a crisis, hang up and call them back on the number already saved in your phone. Caller ID can be faked, so don't trust it. If they don't answer, call another family member. The FBI gives the same advice for a call from your "bank": hang up, look up the number yourself, call it directly.

---

Lock Down the Money: Account-Level Defenses

• Alerts on every transaction, small ones included. A push notification on a $1 charge is how you catch a test transaction before the big one lands.
• Two-factor authentication (2FA) everywhere, banking, email and social media especially. Whoever controls your email can reset most of your other passwords.
• Holds or delays on large transfers. Ask your bank whether it offers a cooling-off window on big outgoing payments.
• Spending and savings in separate accounts. Keep day-to-day money in one account and your real savings in another with no debit card and no link to payment apps.

In the euro area, read the name check. Since 9 October 2025, banks have had to check that the payee's name matches the IBAN before a euro transfer goes out, and to tell you whether it's a match, a close match or no match. If you get a "no match" on a payment someone is pressing you to make, stop and don't send it.

In the US, freeze your credit and block what you don't use. A credit freeze is free and stops anyone, you included, from opening new credit in your name, but you have to place it separately at Equifax, Experian and TransUnion. If you don't write checks, ask your bank about a "post no checks" block, and ask about an ACH block or filter to stop unauthorized electronic pulls.

---

Check Your Accounts Without Linking Them to Apps

Once a week, or at least once a month, spend 15 minutes checking every balance, in a spreadsheet or a manual net worth tracker that needs no bank login, and scanning the monthly statements your bank already sends for any transfer you didn't make.

A lot of new "AI finance assistants" ask you to link every bank account through a third-party aggregator so a chatbot can read your transactions, which puts live access to all your accounts in one place, a single target for scammers.

---

Protecting the People You Love: A Plan for Parents and Kids

Aging parents lose the most per incident, and combined losses reported by older Americans who lost more than $100,000 rose eight-fold between 2020 and 2024, from $55 million to $445 million, according to the FTC. Sit down and set up a shared family safe word with them. Ask their bank about view-only or trusted-contact access so you can spot trouble without taking over their independence. And gently help them shrink their social-media footprint, because every public voicemail greeting and video is voice-cloning material.

Teens and young adults report losing money more often than people in their 70s, according to the FTC figures above, and their TikToks and reels are raw material for the next clone. Include them in the same family safe word.

For the whole family, the FBI advises limiting public video and audio of yourself, making accounts private and keeping followers to people you know.

---

If It Already Happened: The First-24-Hours Recovery Checklist

If you've already sent money or shared details, work through these five steps today.

1. Call your bank's fraud line immediately and freeze the affected accounts. A transfer reported quickly is more likely to be stopped or recalled.
2. Change every credential: banking logins, PINs and especially your email password. Turn on 2FA if it wasn't on already.
3. Report it to the fraud reporting service where you live (table below). Under the EU's upcoming rules, a refund for a bank-impersonation scam will depend on a police report, so file one early wherever you are.
4. If your identity details were stolen and you're in the US, use IdentityTheft.gov for a step-by-step recovery plan.
5. Document everything investigators and your bank will ask for: screenshots, times, amounts, phone numbers.

---

Your Fraud-Proofing Checklist

Set up the first row this week: pick the safe word with your family, as the FBI recommends, and agree that anyone who gets a money call hangs up and calls back on a number already saved in their phone.