AI-powered scams no longer announce themselves with clumsy spelling and broken grammar. That is the central warning from Prasad Calyam, a cybersecurity expert at the University of Missouri, in a question-and-answer interview the university published on 26 October 2026. “Artificial intelligence can make a scammer sound like your boss, your bank or even someone you love,” the release begins, and spotting a fraud “isn’t as simple as looking for spelling mistakes.” Tech Xplore republished the interview the next day under the headline “Cybersecurity expert shares tips to spot AI-powered scams”.
Calyam’s advice is short and practical. Watch for requests for money, personal details or verification codes. Be suspicious of urgency and secrecy. Check anything doubtful through an official website or a phone number you already trust. Then harden your accounts with a password manager, multifactor authentication and, where you can, passkeys or hardware security keys.
This guide takes each of his five answers in turn and adds the evidence behind them. That includes the FBI’s first-ever count of AI-linked complaints, a Consumer Reports survey of nearly 5,000 Americans, and the FBI’s own advice on cloned voices. It ends with a checklist for households, a short plan for businesses and a step-by-step response if an account has already been taken over. For the wider picture of how criminals are adapting, see our guide to game theory and cybersecurity in the AI era.
Table of contents
- What the Mizzou Expert Says About AI-Powered Scams
- How Criminals Build AI-Powered Scams
- The Numbers Behind AI-Powered Scams
- Why Spelling Mistakes No Longer Give AI-Powered Scams Away
- What Not to Share With AI Tools
- How to Protect Your Accounts From AI-Powered Scams Today
- What to Do First if an Account Is Compromised
- AI-Powered Scams at Work
- A Family Plan Against AI-Powered Scams
- Our Verdict on the Expert’s Advice
- AI-Powered Scams FAQs
- References
What the Mizzou Expert Says About AI-Powered Scams
The interview is a short release from Mizzou’s news office, with Eric Stann listed as the media contact. It is organised around five questions that most readers will recognise from their own inboxes.
Who Prasad Calyam is
Calyam is a Curators’ Distinguished Professor in Mizzou’s College of Engineering. He also directs the Artificial Intelligence Education, Research and Infrastructure Center, known as Mizzou AERI. The release says he explains “how AI is changing online security, what information people should keep private and what steps they can take to recognize scams and protect their accounts.”
That framing matters. Calyam is not only talking about spotting a bad email. He is describing a chain that runs from what you share with AI tools, through how criminals reach you, to what you do once something has gone wrong.
The five questions the interview answers
The release asks Calyam five things, and each one maps to a section of this guide:
| Question in the interview | Calyam’s short answer |
|---|---|
| How are criminals using AI? | Phishing emails, fake shops, cloned voices, deepfake video and chatbots |
| What should you keep away from AI chatbots? | ID numbers, passwords, bank and medical details, work files, plus dates, travel and family |
| How do you tell if a message is a scam? | Ignore spelling; watch for money, codes, urgency and secrecy |
| What can you do today? | Password manager, MFA, passkeys or hardware keys, privacy settings, updates |
| What do you do first after a compromise? | Change the password, sign out other devices, secure your email, call your bank |
None of these answers needs special software or technical skill. That is deliberate. The best defence against AI-powered scams is a set of habits that work no matter how polished the message looks.
How Criminals Build AI-Powered Scams
Calyam lists the main techniques in one sentence: “Cybercriminals can use AI to generate convincing phishing emails, create fake retail websites and imitate trusted individuals through cloned voices or deepfake videos.” He adds that “they can also use AI-powered chatbots to pose as customer service representatives or potential romantic partners.” Each of those works a little differently.
Phishing emails that read like the real thing
Phishing is the oldest of the AI-powered scams, and it has always been a numbers game. What has changed is the cost of writing a good lure. A language model can produce a fluent, on-brand message in seconds, in any language, and rewrite it a thousand ways so spam filters see no repeated pattern. The FBI says “chat generators can quickly create official-sounding emails mimicking a company’s CEO or other officials,” which is exactly the kind of message that used to give itself away through awkward phrasing.
Personalisation is the other shift. Colin Ferris, a cybersecurity expert at Silverfort, told CBS News: “You couldn’t personalize 50 phishing messages; it was too much work.” With AI, tailoring a message to your job title, your employer or a recent purchase costs almost nothing.
Fake shops built in minutes
A convincing online store used to take real effort: product photos, descriptions, reviews, a checkout. AI tools can now generate all of that quickly. The result is a site that looks like a legitimate retailer, often promoted through social media ads, which takes payment and either ships nothing or ships a cheap knock-off. This is one of the AI-powered scams Calyam names directly, and it is one where the usual visual cues fail completely.
Cloned voices and deepfake video
Voice cloning is the form of AI-powered scams that alarms people most, because it attacks trust in the people closest to you. A few seconds of recorded speech, often taken from social media, can be enough to produce a passable copy of someone’s voice. The FBI’s 2025 report describes “distress” scams, also known as grandparent scams, “in which voice cloning technology is used to mimic the sound of a loved one in distress.” Victims reported losses of more than $5 million to those scams in 2025.
Deepfake video adds a face to the voice. The FBI notes that investment fraudsters use “AI-generated videos and voices of celebrities, CEOs, or trusted figures” to sell fake opportunities. In job scams it has seen interviews where “the actions and lip movement of the person interviewed on-camera do not completely coordinate with the audio.”
Chatbots that build trust over weeks
The newest of these AI-powered scams is also the most patient. Calyam says AI chatbots “can carry on natural conversations, respond to questions and gradually build trust before asking for money or sensitive information.” He adds: “Because AI can adapt to what a person says, these interactions may be harder to recognize as fraudulent.”
This is how romance and investment scams now scale. One operator can run hundreds of conversations at once, with a bot keeping each one warm. We looked at the romance side in detail in The Sexy AI-Powered Dating App Scams Are Here.
The Numbers Behind AI-Powered Scams
Calyam’s interview does not cite statistics on AI-powered scams, but the official data backs him up. The clearest source is the FBI’s Internet Crime Complaint Center (IC3), whose 2025 annual report included a chapter on AI for the first time.
What the FBI counted in 2025
IC3 received 1,008,597 complaints in 2025, with reported losses of $20.877 billion, a 26% increase on 2024. Within that, it says it received “more than 22,000 complaints reporting AI-related information,” with adjusted losses of more than $893 million. The exact figures in its tables are 22,364 complaints and $893,346,472.
Some simple arithmetic puts that in context. AI-linked complaints were 2.2% of all complaints (22,364 ÷ 1,008,597) but 4.3% of all losses ($893.3 million ÷ $20,877 million). The average AI-linked complaint lost about $39,946 ($893,346,472 ÷ 22,364), compared with an average of $20,699 across all complaints. In other words, AI-powered scams reported to the FBI cost victims nearly twice as much per complaint.
Where the AI-linked losses landed
The FBI breaks the AI-linked losses down by crime type. The largest categories are below, taken from the “AI References by Complaint Loss” table on page 42 of the report.
| Crime type (AI-linked) | Complaints | Losses |
|---|---|---|
| Investment | 4,356 | $632.0 million |
| Business email compromise | 135 | $30.3 million |
| Tech or customer support | 574 | $19.5 million |
| Confidence or romance | 626 | $19.0 million |
| Personal data breach | 1,204 | $18.8 million |
| Employment | 691 | $12.6 million |
| Phishing or spoofing | 803 | $10.3 million |
Investment fraud dominates. The $632.0 million it accounts for is 70.7% of all AI-linked losses ($632.0 million ÷ $893.3 million). Business email compromise has the fewest complaints on the list but the second-highest losses, at roughly $224,000 per complaint ($30.3 million ÷ 135).
Bars are scaled to the business email compromise figure: 19.5 is 64% of 30.3, 19.0 is 63%, 18.8 is 62%, 12.6 is 42% and 10.3 is 34%. Investment fraud is left out because, at $632.0 million, it would be about 21 times the longest bar shown.
Why the real cost of AI-powered scams is higher
The FBI says itself that the AI count is an undercount. Total investment fraud losses in 2025 were $8.65 billion, but only $632.0 million of that, about 7.3%, came from complaints that mentioned AI. The report says this shows “that many victims do not realize the extent AI may be involved in scams.” A victim only reports an AI link if they noticed one, and a well-made fake is designed so that you don’t.
The Consumer Reports survey points the same way. In its 2026 Consumer Cyber Readiness Report, produced with Aspen Digital and the Global Cyber Alliance, 90% of nearly 5,000 US adults polled in March and April said they had met a digital scam or cyberattack, and 17% said they had lost money. CBS News reported that about one in five scams now includes some personalisation. “AI is making fraud faster, cheaper and more personal, and no one can outsmart that alone,” said Consumer Reports president Phil Radford.
Why Spelling Mistakes No Longer Give AI-Powered Scams Away
This is the heart of the interview, and the biggest change AI-powered scams have brought. Calyam says: “Traditional warning signs, such as spelling mistakes and poorly written messages, are becoming less reliable because AI can produce professional-looking messages and imitate familiar voices.”
The old red flags
For years the standard advice was to look for typos, odd grammar, generic greetings such as “Dear Customer”, strange formatting and logos that looked slightly off. Those cues worked because writing a clean, convincing message took time and skill that most fraudsters didn’t have. AI removed that barrier. A message can now be grammatically perfect, written in the tone of your bank and signed with the name of your actual manager.
The new red flags for AI-powered scams
Calyam moves the focus from how a message looks to what it asks you to do. He says to “be cautious of unexpected requests for money, personal information or verification codes, especially when a message creates a sense of urgency or demands secrecy.”
That gives four questions to ask of any message, call or chat, however polished:
- Does it ask for money? Especially by gift card, wire transfer, cryptocurrency or a payment app.
- Does it ask for personal details? Your date of birth, account number, ID number or address.
- Does it ask for a code? A one-time passcode sent to your phone is the key to your account. Nobody legitimate needs you to read it out.
- Does it rush you or ask you to keep quiet? “Act now”, “don’t tell anyone” and “this is confidential” are pressure tactics, not business process.
If the answer to any of these is yes, treat the message as one of the AI-powered scams Calyam describes until you have proved otherwise.
Verify through a channel you already trust
The second half of Calyam’s answer is the one that actually stops fraud: “If something seems questionable, contact the organization through its official website or call the person using a trusted phone number.” He also says to “avoid clicking unfamiliar links or responding directly to suspicious messages.”
The key word is trusted. Don’t use the phone number in the email, don’t reply to the text, and don’t call back the number that just rang you. Type the bank’s address yourself, use the number on the back of your card, or ring your relative on the number already saved in your phone. A clone can copy a voice, but it can’t answer a call placed to the real person.
There is a related idea from the Take9 campaign mentioned in the CBS report: pause for nine seconds before responding to anything unexpected. AI-powered scams depend on a fast, emotional reaction, and a short pause is often enough to break the spell.
What Not to Share With AI Tools
Calyam’s second answer turns the problem around. Instead of how criminals reach you, it asks what you are giving away when you use chatbots and other AI assistants.
The obvious list
He says people “should avoid sharing sensitive information such as Social Security numbers, home addresses, passwords, banking details, medical records and confidential work documents.” In the UK the equivalent of a Social Security number is your National Insurance number, and the same rule applies to passport numbers and driving licence details.
The less obvious list
The more useful part of his answer is the second sentence: “Even details such as birth dates, travel plans and information about family members can be misused if exposed.” These are exactly the facts that make a scam feel personal. A message that knows your mother’s name, your holiday dates or your child’s school is far more convincing than one that doesn’t. AI-powered scams run on that kind of context, and much of it is given away freely.
Why oversharing feeds AI-powered scams
Calyam explains the risk plainly: “Depending on the platform, information shared with an AI tool may be stored, reviewed or used for model training. If that information is exposed, criminals could use it for identity theft, account takeovers or personalized scams.”
His practical advice is simple: “Before uploading documents, remove sensitive details whenever possible and review the platform’s privacy settings.” If you are asking a chatbot to tidy up a CV, a contract or a medical letter, strip out names, numbers and addresses first. The tool can usually do the job just as well with placeholders.
How to Protect Your Accounts From AI-Powered Scams Today
Calyam’s list of immediate steps against AI-powered scams is short, and each item closes a specific gap that criminals exploit.
Use a password manager
“Start by using a password manager to create and store strong, unique passwords,” he says. Unique is the important word. When one site is breached, criminals try the same email and password everywhere else. A password manager means a leak at one shop doesn’t open your email, your bank and your social media.
Turn on multifactor authentication
He also says to “enable multifactor authentication on important accounts.” Start with your email, your bank, your mobile phone account and any account that can reset others. MFA means a stolen password alone isn’t enough, which blunts the many AI-powered scams that start with a leaked login.
Move to passkeys and hardware keys where you can
Calyam adds that “passkeys and hardware security keys offer additional protection against phishing attempts.” This is the strongest technical defence on his list, and the reason is worth understanding. A one-time code can be phished: a fake site asks for it and passes it straight to the real one. A passkey or hardware key is tied to the genuine website’s address, so it simply won’t work on a lookalike. Against AI-powered scams that copy a login page perfectly, that is a decisive advantage.
Review your AI privacy settings
“Review the privacy settings of AI platforms and disable optional data sharing for model training when that option is available,” he says. Most major chatbots now offer this setting, though it is often buried in a data or privacy menu.
Keep everything updated and watch your accounts
Finally: “Keep devices and applications updated, avoid suspicious links and monitor financial accounts for unusual activity.” Updates close the holes that malicious links try to use, and checking your statements catches fraud early.
| Defence | What it stops | What it doesn’t stop |
|---|---|---|
| Password manager | One breach unlocking every account | You typing a password into a fake site |
| Multifactor authentication | A stolen password used on its own | You reading a code out to a scammer |
| Passkey or hardware key | Lookalike login pages | You sending money willingly |
| AI privacy settings | Your chats being used for training | What you choose to share |
| Call-back on a trusted number | Cloned voices and fake requests | Nothing, if you always do it |
The last column is the important one. Technology handles stolen credentials well, but it can’t stop you from authorising a payment yourself. That is why the verification habit sits alongside the technical controls, not after them.
What to Do First if an Account Is Compromised
Calyam’s final answer is the one people need when AI-powered scams have already succeeded and it’s too late for prevention. Speed matters, so it helps to know the order before anything happens.
The first hour
His steps are:
- Change the password “immediately through the official website or app”. Don’t use a link from an email about the breach.
- Sign out of unfamiliar devices. Most services list active sessions in their security settings.
- Change any reused passwords. “If you reused that password on other accounts, change those passwords, too.”
- Call your bank or card provider if financial information was exposed.
Why your email comes first
Calyam singles out one account: “Secure your primary email account because attackers may use it to reset passwords for other services.” Your inbox is the master key. Anyone who controls it can click “forgot password” on almost every other site you use. If you only have time to protect one thing, protect that.
Where to report it
For identity theft, Calyam points to IdentityTheft.gov, the US Federal Trade Commission’s recovery site, which builds a personal recovery plan. Online fraud can also be reported to the FBI at ic3.gov. In the UK, fraud and cybercrime are reported to Report Fraud (reportfraud.police.uk), the City of London Police service that replaced Action Fraud in December 2025, and suspicious emails can be forwarded to [email protected]. Reporting AI-powered scams helps even when the money can’t be recovered: the FBI’s AI figures exist only because victims filed complaints.
AI-Powered Scams at Work
The interview is aimed at individuals, but the same tactics hit businesses, often for much larger sums. The FBI says businesses reported losses of more than $30 million to business email compromise involving AI in 2025, and it warns that “voice cloning can also be used to request wire payment.”
Make call-backs a written rule
The most effective control is Calyam’s own advice turned into policy. Any request to change bank details, pay a new supplier or move money urgently should be confirmed by a call to a number already on file, never one in the request. A cloned voice on a call from the “finance director” fails that test. We walk through how these attacks unfold in Business Email Compromise in Accountancy Firms: How Invoice Fraud Happens.
Treat video interviews with care
The FBI’s employment findings matter for anyone hiring remotely. It describes deepfaked candidates whose lip movements don’t match their audio, and says the goal “generally appears to be gaining access to private computer networks.” A short in-person or verified-ID step before granting system access closes that door.
Give staff the same four questions
The money, details, codes and urgency checklist works just as well in an office. Staff who feel safe pausing a request from a senior name, without fear of looking unhelpful, are the strongest control against AI-powered scams aimed at a company. If you need help putting those controls in place, our cybersecurity services team works with organisations of every size.
A Family Plan Against AI-Powered Scams
Calyam’s advice works best when everyone in a household follows it. A few agreed rules make the difference between one person being careful and a whole family being hard to fool.
Agree a family safe word
The FBI recommends it directly as a defence against AI-powered scams that use cloned voices. In a December 2024 public service announcement on generative AI fraud, its first tip was to “create a secret word or phrase with your family to verify their identity.” If a call claims to be your son in trouble, ask for the word. A clone that has copied his voice from a video won’t know it.
Talk to older relatives first
People aged 60 and over filed 201,266 complaints with the FBI in 2025 and reported $7.748 billion in losses, a 59% rise on 2024. Grandparent-style AI-powered scams are built for this group, so a calm conversation about voice cloning, the safe word and the call-back rule is worth having now, before anyone gets that call.
Share less in public
Short clips of your voice and details of your family and travel plans are the raw material of AI-powered scams. Calyam’s advice on what not to give AI tools applies just as much to public social media. Making accounts private and posting holiday photos after you get home are small changes that cut off a lot of that supply.
Use the tools that already exist
Phone makers are starting to fight AI with AI. We covered one example in Google Messages Scam Detection: How Android Is Using AI to Catch Scammers, and another in AI Is Getting Really Good at Messing With Cybercriminals. These help, but they are a safety net, not a replacement for the habits above.
Our Verdict on the Expert's Advice
Calyam’s interview is short, and there is nothing in it that needs a computer science degree. That is its strength. The core message is that the warning signs of AI-powered scams have moved. You can no longer judge a message by how it looks. You have to judge it by what it asks you to do, and you have to check it through a channel the sender doesn’t control.
The FBI’s data shows why this matters. AI-linked complaints already cost victims nearly twice as much on average as the typical complaint, and the bureau says many victims don’t realise AI was involved at all. As tools improve, AI-powered scams will only get harder to spot by eye. Habits are the one defence that doesn’t degrade: pause, check the request, call back on a number you trust, and lock your accounts with passkeys and MFA.
AI-Powered Scams FAQs
What are AI-powered scams?
They are frauds that use artificial intelligence to make the approach more convincing. Common examples include phishing emails written by language models, fake shopping sites, cloned voices of family members or bosses, deepfake videos of celebrities or executives, and chatbots that pose as customer service or romantic partners.
Can I still spot a scam by its spelling?
Not reliably. Calyam says spelling mistakes and poor writing “are becoming less reliable because AI can produce professional-looking messages.” Focus instead on requests for money, personal details or verification codes, especially when combined with urgency or secrecy.
How do I know if a voice on the phone is cloned?
You often can’t tell by listening, which is what makes voice-based AI-powered scams so effective. Hang up and call the person back on a number you already have, or ask for a family safe word agreed in advance, as the FBI recommends.
Is it safe to share personal details with an AI chatbot?
Avoid sharing ID numbers, passwords, bank details, medical records and confidential work files. Calyam also warns about birth dates, travel plans and family details. Information may be “stored, reviewed or used for model training” depending on the platform.
What is the best single protection for my accounts?
Use passkeys or a hardware security key on your most important accounts, starting with your email. They are tied to the genuine site and won’t work on a fake login page, which makes them strongly resistant to phishing.
How much money is lost to AI-powered scams?
The FBI’s 2025 report counted 22,364 complaints with an AI link and losses of $893.3 million. It says the true figure is higher because many victims don’t know AI was used.
What should I do first if I’ve been scammed?
Change the affected password through the official site or app, sign out of unfamiliar devices, change any reused passwords, secure your main email account and contact your bank. In the US, visit IdentityTheft.gov and report at ic3.gov; in the UK, report to Report Fraud at reportfraud.police.uk.
References
Mizzou expert shares tips to spot AI-powered scams (University of Missouri)
Cybersecurity expert shares tips to spot AI-powered scams (Tech Xplore)
2025 Internet Crime Report (FBI Internet Crime Complaint Center)
Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (FBI IC3)
9 in 10 Americans have encountered a cyber scam as AI fuels fraud, Consumer Reports finds (CBS News)
