10 AI-Powered Scams You Need to Know About in 2026

In January 2024, a finance employee at Arup — the engineering firm behind the Sydney Opera House — joined a video call with his CFO and several colleagues to authorize a confidential transfer. Everyone on that call looked right. Sounded right. Over the course of one call, he approved 15 transfers totaling $25.6 million.

None of the people on that call were real. Every face and voice had been built from publicly available footage — old earnings calls, LinkedIn videos, recorded meetings — and stitched into a live deepfake by scammers he never met.

On our team at Nexora Shield, this is the case we bring up most often when people ask whether AI scams are actually a serious threat or just tech-press exaggeration. It's neither hypothetical nor rare anymore — it's what a well-resourced phishing attack looks like today.

AI hasn't just made scams more common. It's made them cheaper to produce, harder to spot, and personalized in ways that used to require real human effort. A scammer who couldn't string together a convincing sentence in English three years ago can now generate a flawless, tailored phishing email in seconds. Here's what that actually looks like in practice, broken down by the ten patterns we see most, and what we'd tell you to do about each one.

1. Deepfake Video Scams

The Arup case above is the clearest example on record, but it's far from isolated — Hong Kong police described it as one of the first large-scale cases of its kind, and our read is that it won't be the last. Deepfake tools no longer need a studio budget; a few minutes of someone's public video footage is enough to build a convincing likeness.

Watch for:

• Slightly unnatural blinking or facial movement

• Audio that lags a beat behind the lip movement

• A request framed around urgency, secrecy, or "don't loop anyone else in yet"

The move we'd make: Verify through a separate channel — call the person back on a number you already had before the call, not one they gave you during it. A genuinely urgent transfer can survive being confirmed tomorrow morning.

2. AI Voice Cloning Scams

Modern voice-cloning tools need only a handful of seconds of someone's voice — lifted from a social media clip, a voicemail greeting, anything public — to produce a convincing clone. Back in 2019, this technique was used to trick a UK energy firm's CEO into wiring $243,000 to a fraudulent supplier account; the cloned voice matched the real executive's accent and cadence closely enough to hold up over a live phone call.

The same technique now shows up closer to home, in "family emergency" calls — a voice that sounds exactly like your kid, panicked, asking for money right now.

Where we'd draw the line: Set a family safe word that's never shared over text or social media, only spoken aloud, in person. If the caller can't produce it, hang up and dial the actual person yourself.

3. AI-Generated Phishing Emails

The old advice — "check for typos and stiff grammar" — has stopped being useful. AI-written phishing emails read like they came from your own HR department, because the model has no trouble producing polished, error-free, context-aware copy. Some are built using information scraped straight from your public profile: your job title, your manager's name, a project you're visibly working on.

Still reliable, even now:

• The sender's actual email address, not just the display name

• Hovering over a link before clicking to see where it actually goes

• Treating "urgent" and "confidential" as reasons to slow down, not speed up

4. Fake Customer Support Chatbots

Real companies use AI chatbots for support, and scammers are counting on people extending that same default trust to a fake one. These show up embedded in ads, cloned login pages, and fake social accounts posing as brand support — and they'll ask for exactly what a real agent never should: your password, an OTP code, or a request to install "remote access" software.

Our standard advice here: Navigate to the company's site by typing the URL yourself, never through a link someone else sent. No legitimate support agent needs your password or a one-time code to help you.

5. AI-Generated Fake Shopping Websites

Building a convincing storefront used to take real design effort. Now an entire fake e-commerce site — product photos, fake reviews, checkout flow and all — can be assembled in minutes. These sites lean hard on urgency: countdown timers, "only 2 left," discounts that don't quite add up.

Once payment goes through, the pattern is consistent: the order never ships, support goes quiet, and the site itself often vanishes within weeks.

A habit worth building: Check how old the domain actually is before you buy, and search the store's name alongside "reviews" or "scam" — not after the charge has already cleared.

6. AI Investment Scams

"AI trading bot," "guaranteed returns," "risk-free crypto growth" — these platforms use AI in two ways: to generate persuasive marketing copy, and sometimes to power a fake dashboard showing your "returns" climbing in real time, right up until you try to withdraw.

The single filter that catches almost all of these: no legitimate investment is risk-free, and nobody can guarantee returns. That claim alone is the red flag — you don't need to evaluate anything else about the platform once you've spotted it.

7. AI Resume and Job Offer Scams

Fake recruiters now run entire hiring processes end to end — job postings, AI-generated interview questions, even scripted "interviews" — that lead nowhere except a request for money, usually disguised as a "training fee," an equipment cost, or an upfront background-check charge.

What we tell job seekers: A real employer never asks you to pay them to get hired. Confirm the recruiter's email domain actually matches the company's, and search the company name plus "hiring scam" before sending anyone a cent.

8. AI Social Media Impersonation

AI-generated profile photos — the kind that come up empty in a reverse image search because the face never existed — paired with a cloned bio make fake accounts far harder to catch at a glance. These accounts impersonate friends, influencers, and brands, usually to push a fake giveaway, a "verify your account" phishing link, or a money request dressed up as an emergency.

Our rule of thumb: Confirm through a second, independent channel before trusting an account. A follower count and a profile photo were never real verification to begin with.

9. AI-Generated Malware

This one's less visible to everyday users, but worth understanding: attackers are using AI to help write malware that adapts its own behavior to dodge antivirus detection, instead of staying static like older strains. That doesn't change your day-to-day defenses much — updated software and a reputable security tool remain the baseline — but it does mean having antivirus installed isn't a license to get careless about what you click or download.

10. Personalized AI Scam Messages

AI can scrape your public social media and web presence — your city, your employer, your hobbies, even a recent purchase — and fold that into a message that feels like it knows you. That familiarity is the entire mechanism: a message referencing something real about you earns trust a generic one never would.

Our takeaway: Tighten your privacy settings, and stop treating "they know details about me" as proof a message is legitimate. Scammers can search the web too.

The Habits That Actually Cover All Ten

Individually, these scams look different. In practice, the defenses overlap almost completely — and this is the short list we'd put in front of anyone, regardless of which scam eventually reaches them:

• Turn on multi-factor authentication (MFA) everywhere it's offered — it alone blocks most account-takeover attempts even when a password leaks

• Use a unique password per site, ideally through a password manager

• Verify urgent requests through a second, independent channel — never the one the request arrived on

• Keep software updated — plenty of exploited vulnerabilities were patched months before attackers used them

• Slow down on anything urgent + financial + unverifiable — that combination runs through nearly every scam on this list

Why This Is Accelerating Right Now

None of this requires a particularly skilled attacker anymore. The tools that generate convincing voices, video, and text are commercially available, inexpensive, and don't demand any programming background to use. What used to take a small, capable team now takes one person and an afternoon.

That shift is exactly why we keep pushing awareness over any single tool or setting — not because these scams are unbeatable, but because the old advice ("check for typos," "look for a shaky photo") stopped being reliable a while back.

Before You Trust It, Verify It

Deepfaked executives, cloned voices, AI-written phishing emails, fake storefronts — these all lean on the same weakness: trust extended a little too fast, under a little too much pressure. The fix isn't paranoia. It's a habit: before sending money, sharing credentials, or clicking a link, take the extra thirty seconds to confirm through a channel the attacker doesn't control.

That thirty seconds is, consistently, the difference between a close call and a $25 million wire transfer.