In Thing 11, you saw how convincing AI video has become. In Thing 8, you heard how natural AI voices can sound. Now let's look at what happens when those tools are used to deceive.
Fraudsters were early adopters. A cloned voice on the phone that sounds just like a family member in trouble. A video of a well-known face recommending an investment. A perfectly written email that seems to come from your manager. These scams are already costing people in the UK a great deal of money, and they can be very hard to spot.
The aim of this Thing isn't to make you suspicious of everything. It's to give you a few simple, reliable habits. Slow down when something feels urgent. Check through a different channel. Look for the tell-tale signs. Know where to report it. These habits protect you, and they help you look out for the people around you, like friends and family who might be more likely to be targeted.
In the activity, you'll test your eye against real and AI-made examples, try out some free checking tools and put together a short checklist you can share. It might be the most useful thing you pass on from this programme.
How AI has changed scams
The scams are old. What AI has changed is how polished, personal and cheap they are to run.
Most scams still follow a familiar pattern. Someone pretends to be a person or organisation you trust, creates a sense of urgency and asks you to pay, click or share something. AI hasn't invented a new kind of crime. What it has done is remove many of the clues that used to give scammers away, and let them reach far more people for very little effort.
The scale in the UK
UK Finance, the banking trade body, found that criminals stole almost £1.3 billion through payment fraud in 2025, across more than four million cases. Losses to investment scams rose by 40% and to romance scams by 23%, both the highest ever recorded. Two thirds of scams where people are tricked into sending money start online, and UK Finance names AI as one of the ways criminals are scaling up.
Those are big numbers, but here's the reassuring part: the habits that protect you against an AI-powered scam are almost exactly the same ones that protect you against an old-fashioned one.
What AI-enabled scams look like
Voice cloning calls. As you saw in Thing 8, a voice can be cloned from a short recording, and plenty of us have our voices online. Scammers use cloned voices to phone or leave messages that sound like a son, daughter, partner or friend in trouble and needing money now. A 2024 survey for Starling Bank found nearly half of UK adults hadn't heard of this kind of scam.
Deepfake video adverts. Fake adverts featuring well-known faces are a common route into investment scams. MoneySavingExpert's Martin Lewis, who doesn't do adverts at all, is one of the most impersonated people in the UK. In 2026, MoneySavingExpert warned about deepfake videos of him promoting fake schemes, and even a fake copy of its own website built to make the scam look genuine.
Polished phishing emails and texts. Poor spelling and clumsy grammar used to be a reliable warning sign. The National Cyber Security Centre (NCSC) has warned that AI lets criminals write convincing messages without those mistakes. A scam email might now be fluent, friendly and personalised with details from your social media.
Fake websites. AI makes it quick to build a convincing copy of a shop, a bank or a news site, complete with reviews and product photos that never existed. The giveaway is usually the web address, not the look of the page.
Romance and investment scams. AI can generate profile photos of people who don't exist and keep a conversation going around the clock. These scams play out over weeks or months and usually end with a request for money or an "investment opportunity". Watch for AI itself being used as the bait: fake trading platforms often claim to use "AI" to guarantee returns.
CEO or manager impersonation. Scammers pose as a senior colleague or a supplier and ask for an urgent payment or a change of bank details. In one widely reported case in 2024, an employee at the engineering firm Arup joined a video call where the finance director and other colleagues were all deepfakes, and went on to transfer around $25 million. Most workplace versions are far simpler: a convincing email or a voice message that sounds like your manager.
Thing 9 (images), Thing 8 (voice) and Thing 11 (video) cover how this kind of content is made. This Thing focuses on protecting yourself.
Habits that protect you
You don't need to become a deepfake expert. You need a few habits that work whatever the technology does next.
Spotting a fake by eye is getting harder all the time. The good news is that the strongest protections don't rely on spotting anything. They rely on what you do next.
Slow down when something is urgent
Almost every scam tries to rush you. Your account will be closed today. Your daughter needs money right now. This offer ends at midnight. Urgency is designed to stop you thinking clearly, so treat it as a signal to pause. A genuine bank, employer or family member will understand if you take ten minutes to check.
Verify through a separate channel you already trust
If a call, message or email asks you to pay, click or share something, don't use the contact details it gives you. Hang up and call back on a number you already have, such as the one on the back of your bank card or one saved in your phone. If a colleague emails asking you to change a supplier's bank details, check with them by phone or in person, and follow your organisation's process for approving payments, even if the request seems to come from someone senior.
If you get an unexpected call about money, you can also hang up and dial 159. It's a short number run by Stop Scams UK that connects you securely to most major UK banks, and scammers can't fake it.
Agree a family safe word
A simple, low-tech defence against voice cloning is a safe word or phrase that only your close family or friends know. If someone calls claiming to be a loved one in trouble, ask for it. Choose something that isn't guessable from social media, agree it in person and don't send it in messages or emails.
Check the source
Look at the full email address, not just the display name. Check the web address in your browser bar letter by letter. If you see a celebrity endorsement or a shocking video, search for the story on a news site you trust. If it's real, others will be reporting it. If it only exists in one advert or one post, be very wary. And remember that scammers build convincing messages from what they can find about you online, so it's worth checking who can see your posts (Thing 15 looks at privacy in more depth).
Checking whether an image or video is real
A label can tell you something was made with AI. A missing label never proves that it wasn't.
There's no perfect test for a deepfake, and "AI detectors" that claim to spot fakes can be wrong in both directions. But a few free tools can give you useful clues alongside the habits above.
Reverse image search
A reverse image search lets you upload a picture and see where else it appears online. It's useful for checking whether a "breaking news" photo is actually years old or whether a dating profile uses someone else's photos. Google Lens (built into Google search, the Google app and Chrome) and TinEye are both free. If an image turns up attached to a completely different story, that tells you a lot.
Content credentials
Content credentials are a kind of digital label, based on an open standard called C2PA, that records how an image or video was made and edited. They're backed by companies including Adobe, Microsoft, Google, OpenAI and the BBC. Images made with some popular AI tools, including ChatGPT, carry them, and some newer phones add them to real photos. You can upload a file to the free Content Credentials Verify site to see what it says.
Watermarks such as SynthID
Some AI companies also hide an invisible watermark inside the content itself. Google's SynthID is the best known, and it's added to images, video and audio made with Google's AI tools. You can upload a file to the Gemini app and ask whether it was made or edited with Google AI. Gemini checks for SynthID and for content credentials.
Why a missing label doesn't prove anything
Here's the catch. Content credentials can be stripped out when a file is screenshotted, edited or uploaded to some social media sites. Watermarks only exist if the tool that made the content added one, and many tools don't. Google's own guidance says that if SynthID isn't found, the content could still have been made by another AI system. Scammers aren't going to label their work.
So treat these tools as one-way clues. A label that says "made with AI" is useful information. No label tells you nothing either way, and it's never a reason to trust something that's asking you to pay, click or share.
Where to report it and what the law says
Reporting takes a minute, helps get scams taken down and protects the next person.
Many people don't report scams because they feel embarrassed. Scammers are professionals and anyone can be caught out. Reports really do help: the NCSC uses them to take down scam websites, and phone companies use them to block numbers.
If you've lost money or shared bank details
- Contact your bank straight away, using the number on the back of your card or by calling 159. The sooner they know, the better the chance of stopping or recovering a payment.
- In England, Wales and Northern Ireland, report it to Report Fraud, the national service that replaced Action Fraud in early 2026, at reportfraud.police.uk or on 0300 123 2040.
- In Scotland, report it to Police Scotland by calling 101.
- If someone is in immediate danger, or a crime is happening right now, call 999.
If you've spotted a scam but haven't been caught out
- Forward scam texts to 7726. It's free and alerts your mobile provider.
- Forward phishing emails to report@phishing.gov.uk, the NCSC's reporting service.
- Report scam websites to the NCSC through its online form.
- Report scam adverts to the Advertising Standards Authority, and to the platform where you saw them.
What the law says
The Online Safety Act requires online platforms used in the UK to reduce the risk of illegal content on their services and remove it quickly when they find it. Fraud and intimate image abuse are both priority illegal content. Ofcom, the regulator, enforces these duties and is working on extra rules requiring the largest platforms to tackle scam adverts.
The law on sexually explicit deepfakes has also tightened, and it differs across the UK. In England and Wales, sharing an intimate image of someone without their consent, including a deepfake, is a criminal offence, and since February 2026 so is creating or requesting one. In Scotland, sharing or threatening to share an intimate image without consent, including one that's been altered, has been an offence since 2017, and the Scottish Government has consulted on a new offence of creating these images. If this has happened to you or someone you know, it isn't your fault and you can report it to the police. The Revenge Porn Helpline offers free, confidential support to adults across the UK.
Resources to explore
The UK government's national anti-fraud campaign. Clear, practical advice on spotting scams, protecting your accounts and what to do if it happens to you.
The National Cyber Security Centre's guide to recognising phishing and reporting each type of scam. Includes the forms for reporting scam websites and adverts.
A free online quiz from Microsoft's AI for Good Lab that shows you a series of images and asks you to decide which are real and which are AI-made. In Microsoft's study of over 12,500 players, people got it right only about 62% of the time.
A free tool for checking whether an image or video carries content credentials, and what they say about how it was made and edited. Upload a file and see what it reveals.
MoneySavingExpert's regularly updated page on fake adverts and deepfake videos using Martin Lewis's name and face, with real examples and advice on what to look for.
How the 159 short number works, and which banks you can reach through it. Worth sharing with family members who might get unexpected calls about their money.
Activity: spot it, check it, share it
You'll test your eye, try some free checking tools and turn what you've learned into something you can share. You'll never be asked to copy a real person's voice or make a fake of a real person, and you shouldn't, even as an experiment.
What you'll need: a web browser. A free Google account is optional (for Google Lens or the Gemini app). An AI image you made in Thing 9 is useful but not essential.
- Test your eye. Go to the Real or Not quiz at realornotquiz.com. It's free and works in any browser without an account. Decide which images are real photographs and which are AI-made, and note your score. As you go, jot down what made you decide: hands, lighting, text, backgrounds, something "too perfect"? Afterwards, look at the ones you got wrong. What fooled you?
If the quiz isn't available, make your own comparison. Use the free image tools from Thing 9 to create two or three realistic images of everyday scenes (a café table, a street, a dog in a park) and mix them with similar photos you've taken yourself. Ask a friend or family member to sort them.
- Try a reverse image search. Choose an image that's safe to upload, such as your own photo of a landscape or an object, or an image from a news story about a viral fake. Upload it to Google Lens (use the camera icon in Google search) or to TinEye at tineye.com. Where else does it appear? Do those places tell the same story? Take a screenshot of what you find.
- Look for content credentials. If you made an image with ChatGPT in Thing 9, upload the original file to Content Credentials Verify at contentcredentials.org/verify. What does it tell you? Now take a screenshot of the same image and upload the screenshot. Are the credentials still there?
If you have a Google account, you can also upload an image you made with Gemini to the Gemini app and ask, "Was this made or edited with Google AI?" No AI image to hand? Upload one of your own photos and see what the tool says when there are no credentials at all. Write two or three sentences on what this tells you about a missing label.
- Write your "before I click, pay or share" checklist. Create a one-page checklist you could give to a friend, a relative or a neighbour. Keep it short, friendly and in plain language. You might include:
- Warning signs (urgency, secrecy, unusual ways of paying, offers that are too good to be true)
- What to do before acting (pause, check the source, call back on a number you already trust)
- A reminder to agree a family safe word, without writing the word itself on the sheet
- Where to report (7726 for texts, report@phishing.gov.uk for emails, your bank or 159 about money, Report Fraud or Police Scotland 101 for crimes)
You can ask a chatbot to help tighten the wording, but check the reporting details against this page, as chatbots sometimes get them wrong (Thing 13 explains why).
- Share it and reflect. If you feel comfortable, share your checklist with someone and talk it through. Then write a short reflection. Did the spot-the-fake test change how confident you feel about spotting fakes by eye? Which habit do you think would protect you best? Who do you know who'd benefit from the checklist?
Your output
Your spot-the-fake score with brief notes on what fooled you, screenshots of your reverse image search and content credentials results with your two or three sentences on missing labels, your one-page checklist and a short reflection.
Claim your Open Badge
Submit your spot-the-fake score and notes, your reverse image search and content credentials screenshots, your one-page "before I click, pay or share" checklist and your short reflection via cred.scot. Remember to leave your family safe word off anything you submit.
Submit your spot-the-fake results, checking-tool screenshots and shareable scam checklist to claim this badge via cred.scot.
Claim now