Stop the request before trying to spot the fake
The practical way to protect yourself from AI-powered scams is not to decide within seconds whether a voice is genuine. Instead, decide in advance which actions will never follow an incoming message alone: transferring money, sharing a login code, changing payment details or installing software. When such a request arrives, pause and verify it through a channel you choose yourself. This applies even when the caller sounds familiar, knows personal details or shows a convincing picture.
AI can improve the wording and personalisation of deceptive messages and help create familiar-looking images or voices. However, not every scam uses AI, and you do not need to prove that it does before avoiding a risky action. The important questions are what you are being asked to do and why you trust the request. A message written in flawless language is still not proof of the sender's identity.
Set a simple household rule: unusual requests get an extra check. Keep trusted contact numbers for relatives, your bank and a workplace contact somewhere accessible, using sources you already know. Someone who struggles with apps can prepare a printed card of trusted contacts. Preparation should make checking easy under pressure, rather than require everyone to become a cybersecurity expert.
A familiar voice or video call is not identification
The FTC, the US consumer protection agency, has warned about family emergency scams that use voice cloning. Its central recommendation is to contact the person on a known number instead of trusting the voice alone. If they are unavailable, try reaching them through a relative or friend. A lack of response does not prove the story is true, but genuine danger should not be ignored either: keep checking through people and organisations whose identities you can establish independently.
Consider a hypothetical caller who sounds like a family member and asks for an immediate money transfer without telling anyone. You do not have to argue or try to expose the fake. Say you will check, end the call and dial the number you already have saved. Do not use an alternative number supplied by the caller, or allow them to stay on the line and dictate how you verify their story.
Families can agree on a code word that is not published online or based on easily guessed biographical information. It is an extra safeguard, not automatic authorisation to send money. Change it if it is exposed. Even a correct answer does not replace a callback for an unusual request. In video calls, unnatural movements or mismatched audio may raise suspicion, but their absence does not establish authenticity. Verify the request outside the call instead of relying on an improvised visual test.
Check convincing messages through the service itself
A delivery, payment, tax refund or account suspension message can seem routine precisely because it is well written. Instead of looking only for spelling mistakes, examine the context: were you expecting contact, does it demand an unusual action, and can you see the same request inside the app or website you normally use? A familiar display name or profile picture does not answer these questions.
If a message claims there is a problem with your account, open the official app yourself or type a known address. Do not use the message's link to investigate. A browser padlock does not guarantee that a site belongs to the right organisation. A QR code can also lead to a deceptive destination, so it deserves no special trust merely because it does not look like an ordinary link.
There is no need to paste a message containing personal information into an AI tool for a verdict. Such a tool may suggest warning signs, but it does not necessarily know who sent the message or whether an account has been compromised. If you use one, remove sensitive details first and treat its answer only as assistance. Your decision should rest on verification with the service, not the confident wording of an automated reply.
Fake support: do not hand control to the caller
An impersonated support agent may claim your computer is infected, your bank has detected unusual activity or your business account needs immediate attention. The practical warning sign is the demand: install remote-control software, share your screen, provide a password or read out a code. Pause before acting and contact the organisation through a familiar app or independently checked contact details. A patient, professional-sounding person can still be an impostor.
Screen sharing may expose messages, documents and details you never intended to disclose. Before legitimate support that you initiated, close unrelated windows and establish what the agent will be able to see or do. Do not sign in to online banking while an unverified person watches your screen. Approving an installation or permission is not a minor technical step: it may change access to your device and its information.
A one-time code relates to a particular action. Read the accompanying message and do not give the code to someone who contacted you. If you did not initiate a login or payment, do not approve a notification simply to dismiss it. Repeated approval prompts are not a reason to agree either. Access the service independently and check your account's security. At work, contact support through the established organisational channel.
WhatsApp and social networks: familiar account, new request
A message in an existing conversation may come from a compromised account rather than its owner. An unusual request for money, a code or a vote requiring a new login therefore needs checking even if the conversation history looks normal. Call your friend on a number you already had saved. If the message says their number has changed, try the old number or a mutual contact before updating details and acting.
Do not scan a code or approve linking a device merely because someone calls it identity verification. Read what the app itself says the action does. Periodically review linked devices and unfamiliar activity in account settings, and remove connections you do not recognise. Enable the service's available protections and keep recovery details somewhere accessible even if your phone is lost.
When you discover impersonation, save a screenshot, the account name and the time of contact before blocking and reporting it on the platform. If your account was used to contact others, warn them through another channel. Briefly explain which requests were not yours and what they should avoid doing. You do not need to circulate the suspicious link again to illustrate the incident; describe it without creating another opportunity to click.
Small businesses: separate requests from payment approval
In a small business, a fraudulent message may resemble an instruction from the owner or a supplier's bank account update. Require every change of payment details to be verified by calling the number already held in your records, not the number attached to the change request. Even an apparently correct invoice does not replace this check. Where possible, a second person should approve unusual transfers after seeing how the details were verified.
Exceptions matter too. If the owner is away, a supplier is pressing or payment is urgent, a procedure that ignores these situations may remain a paper exercise. Designate a substitute and a threshold above which additional approval cannot be skipped. Do not create a culture where employees fear pausing a request that appears to come from the manager. Managers are responsible for making verification possible, even when it delays them.
A brief exercise can use a fictional example: a familiar supplier asks for payment to a new account. Employees explain whom they would call, where the number is held and who would approve the transfer. There is no need to send frightening messages or collect employees' passwords to practise. The aim is to check whether the safe route is available and clear, then fix gaps before a real incident.
Already clicked? Match the response to what was exposed
Clicking a link, giving away a password and transferring money are different incidents. Record what actually happened: did a page merely open, were details entered, was a file downloaded, and was a permission approved? If you only opened a page without providing anything, close it and check for downloads or installations. Do not assume every click means a breach, but do not ignore an unfamiliar change on the device.
If you shared a password, change it through the official service on a trusted device, and anywhere else you reused it. Check recovery details, active sessions and permissions, and revoke access you do not recognise. If you supplied a code or approved a connection, changing the password alone may be insufficient. For a work account, tell the responsible team immediately so they can also check organisational permissions and activity.
If you transferred money or disclosed payment details, contact your bank or payment provider immediately on a known number and ask about stopping transactions or blocking access. Recovery of money is not guaranteed. If unfamiliar remote-control software was installed, disconnect the device from the network and seek help using another device. Preserve evidence where possible without delaying steps to stop harm. Do not pay someone who promises to recover funds in exchange for another advance payment.
Reporting in Israel and preparing for next time
According to the Israel National Cyber Directorate, the national cyber incident response centre takes reports and provides initial assistance on 119, free of charge, around the clock. You can contact it on suspicion, not only after damage has occurred. Prepare a brief description, times, screenshots and details of what you did. Do not send passwords or login codes as part of your account of the incident.
A cyber report does not replace contacting the bank when money is at risk, making a police complaint when a crime is suspected or contacting emergency services when there is immediate danger. You do not need to wait for one channel to reply before taking appropriate action through another. If a work device is involved, also notify the organisation and do not delete potentially relevant material without guidance.
After the immediate response, improve the habit that failed: a missing telephone number, a reused password, unnecessary access or an unchecked payment approval. Review alternative contact arrangements with your family and keep recovery details current. A matter-of-fact conversation without blame makes early reporting easier next time. Effective protection is a sequence of actions you can take under pressure: pause, verify independently, limit harm and report.