On this page
A familiar voice asks for an urgent transfer. A video call appears to show a senior executive approving a payment. An investment advert features a person you recognise. Each can feel persuasive, but the identity on screen and the authority to move money are separate questions. Pause the payment and verify the request through a contact route you already trust. You do not need to prove that artificial intelligence was used before treating an unverified request as a security incident.
The FBI’s 2025 Internet Crime Complaint Center report helps explain the scale of the issue. It also contains an important qualification: an AI reference in a complaint is not the same as a forensic finding that AI caused the loss.
Verify the request, rather than testing how convincing it looks
The FBI warns that generative AI can make text, images, voices and video more believable. Its guidance includes independently contacting the organisation and agreeing a family verification phrase. Visual or audio oddities may raise suspicion, but a smooth call should not be treated as confirmation. Source: FBI guidance on generative AI and financial fraud.
Use a simple sequence: end the incoming conversation, find the genuine contact independently, and ask that person or institution to confirm the specific instruction. Calling a number supplied by the same caller, or following the link in the disputed message, leaves the verification inside the suspect conversation.
| The request | A useful check |
|---|---|
| A relative needs urgent money | Call their established number or a trusted person who can check their safety. Ask the agreed verification phrase, if available. |
| An executive orders an exceptional transfer | Use the organisation’s existing approval process and a known contact. Confirm the beneficiary and amount, not just the executive’s identity. |
| A bank says funds must move to safety | End the call and contact the bank through its official app, an established statement or the number on the card. |
| A public figure endorses an investment | Check the claimed offer and provider separately. A recognisable face does not establish authorisation or the existence of the investment. |
A family phrase helps only if it stays private. A business should also resist urgency, secrecy or seniority as reasons to bypass approval. The key question is concrete: who has independently authorised this exact payment to this exact beneficiary? For a changed supplier account, see our business email compromise and invoice fraud response guide.
Preserve the evidence without overstating what it proves
If the request may be fraudulent, keep the original material you have lawfully received. A forwarded video or a cropped screenshot can be useful, but may omit the account identifier, sequence or surrounding instruction. Record where the original remains and work from a copy where practical.
- Communication: keep the full message thread, profile URL or user ID, relevant emails and their original headers, and voicemails or media already received.
- Payment instruction: record the claimed reason, beneficiary details, amount, currency, deadline and any last-minute changes.
- Chronology: note dates, times and time zones, including when independent verification was attempted and what the genuine contact said.
- Money trail: retain transfer confirmations, bank references, exchange withdrawal records and cryptocurrency transaction hashes where applicable.
Describe observations precisely: “The caller sounded like my manager” and “My manager later denied making the call” are different from “A forensic test proved a voice clone.” An account name, media file or beneficiary record does not by itself identify the person controlling the fraud. Keep those distinctions in a complaint and any expert instruction.
Do not upload confidential company calls, identity documents or intimate material to an unknown “AI detector.” A tool’s score cannot settle who authorised a transfer, and submitting the file creates another disclosure. If specialist examination is needed, identify the question to be answered and agree a secure handling process.
If money or account access has already been provided
Contact the bank, payment service or exchange through an independently verified channel promptly. Explain the actual sequence and ask what can still be stopped, recalled or secured. Provide the transaction reference and recipient details. A request to intervene is time-sensitive, but it does not guarantee that funds remain available or can be returned.
If credentials or remote access were supplied, tell the institution that as well. Use a trusted device for urgent account protection and ask the relevant security team about exposed sessions and access. Avoid deleting material merely to make the device look clean before anyone records what happened.
For a supposed investment, separate a displayed balance from a real withdrawal and preserve every demand for further “tax,” verification or release fees. Our crypto investment scam guide explains that evidence problem. Be cautious about a second approach promising guaranteed recovery after another payment.
Reporting suspected AI impersonation
A useful report states the suspected deception, the independent check that failed, and any payment or access provided. Mark the use of AI as suspected unless there is reliable technical evidence. Include the original communications and transaction identifiers through the reporting body’s accepted process; do not make a public accusation merely because a profile or wallet appears in the record.
IC3 is a US reporting channel. Local authorities and the affected financial institution remain relevant, particularly when the victim, payment or recipient is elsewhere. See our guide to reporting cyber fraud from outside the United States. Reporting can support assessment and investigation; it is not a promise of individual contact or reimbursement.
What the FBI’s AI fraud figures actually show
IC3 recorded 22,364 complaints referencing AI and $893,346,472 in associated reported losses in 2025. Within that section, investment complaints accounted for $632,041,188, while business email compromise accounted for $30,256,592. The report describes voice cloning, synthetic profiles and convincing conversations as possible tools in several fraud types. These are figures reported to a US reporting system, not a measure of worldwide AI crime. Source: FBI IC3 2025 Annual Report, pages 39–42.
“AI Related” means that information reported contains a reference to AI. Cryptocurrency and AI are descriptors that can overlap the underlying crime category. An AI-assisted investment pitch paid in cryptocurrency may appear in all three descriptions; the losses must not be added together. Our guide to the 2025 IC3 report and its methodology explains the broader figures. See the report definitions and data notes, pages 61-62.
