Scam & Deepfake Defense

Fraud with AI looks and sounds more convincing than the old kind, so you stop relying on spotting fakes and start relying on a procedure that works even when the fake is perfect.

The threat picture is tracked in the Stanford HAI AI Index (2026) among responsible-AI incidents. The EU AI Act adds transparency duties for AI-generated content and, via the 2026 amendment, bans on tools that generate sexual images of real people without consent (Regulation (EU) 2024/1689 as amended by 2026/1744). The defense habits are practice, not research.

Use it when:

• You have never agreed with your family or team what to do when an urgent request arrives by phone, video or message.
• You look after someone who is easy to pressure, such as a teenager or an elderly relative.
• Your work involves payments, access or sensitive data that a fake manager or supplier could ask for.

Skip it when:

• You want to control what AI services learn about you: use 10.4 Personal Privacy Check.
• You are checking whether an AI-written text is accurate: use 10.9 AI Output Verification Checklist.

The scams are old. What AI changed is cost and polish: a fluent message in your language, a cloned voice or a fake video can now be made cheaply and aimed at you. The Stanford HAI AI Index (2026) tracks such cases among responsible-AI incidents, and the EU AI Act now requires labeling of generated content and bans some abusive image tools (Regulation (EU) 2024/1689, as amended).

The limit of labels and law is that criminals ignore both, and a missing label proves nothing. So the old tells (bad spelling, a strange voice, a blurry face) stop being a defense. What stays constant is the shape of the attack: urgency, emotion and a request for money, codes or secrecy. This page therefore trains a procedure instead of an eye. It is practice, not research: a short list of rules you set in calm, so you do not have to judge under pressure.

For each attack, tick it if it could plausibly reach you, and write the most likely route in a few words (a channel and a person to impersonate, no real names).

Strong answer: "Voice cloning: a call to my mother, posing as me, using a clip from a public video of mine." Not: "Could happen to anyone."

The constant underneath: every version combines urgency, emotion and a request (money, codes, secrecy, a click). The defense targets that pattern, not each new format.

Illustrative example: the family and the figures are made up.

A family in Norway agrees the protocol on a Sunday: a code question, the callback rule, the money rule and the no-shame rule.

Step 1: the grandmother ticks voice cloning. Most likely route: a call posing as a grandchild, using a clip from a public video.

Step 2: her version of the second-channel rule: hang up, call the saved number.

Two months later a caller with the grandson's voice says there has been an accident abroad and a lawyer needs a transfer within the hour. She asks the code question. The caller improvises. She hangs up and calls the grandson's saved number: he is at home. The family reports the number.

Three weeks later a teenager pays for a fake concert ticket and tells the family that evening. Because the report to the bank came fast, there was a better chance to act.