Deepfakes have erased the tell-tale signs. Check the request instead

For years we taught people to spot scams by their mistakes: the odd spelling, the robotic voice, the photo that didn't look right. INTERPOL put it plainly this week: AI is erasing those tell-tale signs. So the defence has to move from spotting fakes to checking requests.

What changed

On 19 October INTERPOL launched a public awareness campaign about scams that use AI-generated or AI-altered media. It says public awareness is low, and that deepfakes are now used against ordinary people through investment scams, impersonation, romance scams and sextortion, not just against big companies. Its message is short: Wait. Validate. Don't take the bait.

At the same time, a different kind of AI lure is getting into businesses. A sponsored BleepingComputer article from Push Security describes fake install pages for AI tools such as Claude Code and Codex. The page looks right, but the command copied to your clipboard is malicious. It also describes shared chats and artifacts on ChatGPT and Claude being used to host fake instructions, which works because they sit on trusted domains. The figures in that piece come from a security vendor, so I'd treat them as a signal rather than gospel, but the method is real and easy to fall for.

The red flags have moved

If you can no longer trust how something looks or sounds, look at what it asks you to do. INTERPOL's list of red flags is a good one to share with users:

Unexpected contact, even from someone claiming to be a friend, relative or trusted organisation, that quickly turns to personal details or money.
Pressure to act right now, usually with a crisis attached.
Fear, distress or a request for secrecy, designed to stop you checking with anyone.
Requests to pay by bank transfer, cryptocurrency or gift cards.

For IT, I'd add one more: any page that asks you to paste a command into Run, PowerShell or Terminal. That is the whole ClickFix trick, and AI tools make it feel normal because so many are installed from the command line.

What I'd put in place

1. Call-back rules for money and data

INTERPOL recommends multi-step checks for payments and data transfers, including face-to-face confirmation for large sums. In practice that means a written rule: a change of bank details, an urgent payment or a request for sensitive data is confirmed by calling a number you already hold, never the one in the email, message or call. A cloned voice can't survive a call-back to the real person.

2. A code word for the people who matter

INTERPOL suggests agreeing a secret phrase with close family or friends. The same idea works for finance teams and directors. It's low-tech, which is exactly why it works against high-tech fakes.

3. Train on the new tricks, not the old ones

INTERPOL calls for mandatory training on deepfakes, voice phishing and social engineering. If your training still centres on spotting bad grammar, update it. Show people what a voice clone sounds like and what a fake install page looks like.

4. Control how software gets installed

For staff, the rule is simple: never paste commands from a website. For anyone who does need developer or AI tools, install them from a link you've checked yourself, not from a search result or ad. Where you can, restrict who can run PowerShell and scripts, and push approved tools through your device management instead.

5. Turn on MFA and keep things patched

INTERPOL lists two-factor authentication and keeping software updated. It's not exciting, but if a scam does land, MFA and patching limit how far it gets.

If someone has been caught

INTERPOL's advice is to contact the police straight away and, if a payment has been made, the bank as soon as possible. Speed matters with the bank. For a business, also reset the user's passwords, revoke their sessions and check for new mailbox rules or app consents, because a scam call is often the start of an account takeover rather than the end of it.

The short version

Stop asking "does this look real?" and start asking "how do I check this another way?" That habit beats every deepfake, however good it gets.

Sources

← All posts